Glossary
Definitions of the key PulsVault terms — Access Key, Recovery Key, UMK, DEK, vault session, secure link, and more.
Key terms used throughout the documentation.
Keys & secrets#
Access Key — A high-entropy key shown once at signup. Combined with your master password to derive your encryption keys. Only its hash is stored; it is unrecoverable by design.
Recovery Key — A last-resort key for regaining account access if you lose your password or Access Key. Part of your Emergency Kit.
Master password — The password you type to sign in and unlock. PulsVault checks it at sign-in and stores only a one-way hash; it cannot read or reset it.
PDS (Password-Derived Secret) — Derived from your password and email; the first layer of the key hierarchy.
KEK (Key Encryption Key) — Derived from the PDS and Access Key; unwraps the UMK. Never stored.
UMK (User Master Key) — Your account's master key. Stored only in encrypted form; unwraps each vault's DEK.
DEK (Data Encryption Key) — A per-vault key that encrypts item fields. Stored only in encrypted form.
Containers & records#
Vault — An encrypted container of items; the unit of encryption and sharing.
Primary vault — The non-shareable, always-AES-256-GCM vault created with your account.
Item — A typed record (login, card, note, key, …) whose sensitive fields are encrypted.
Folder — A grouping of items within a vault.
Access & sessions#
Authentication gate — Proving who you are (password + 2FA → JWT). See the two-gate model.
Vault session — Proof that your keys are unlocked in memory, attached to vault requests as
X-Vault-Session.
Access level — The permission tier granted by a share: OWNER, MANAGER, EDITOR, VIEWER, or LIMITED. See access levels.
Trusted device — A device permitted to unlock quickly and relay unlocks to your other devices.
Sharing#
Secure link — A URL that shares a single secret without a PulsVault account; its key lives in the URL fragment. See secure links.
DEK re-wrapping — Encrypting a vault's DEK for a recipient's keys so sharing stays zero-knowledge.
Operations#
Audit log — A tamper-evident, hash-chained record of security events. See audit log.
Travel mode — A state that restricts which vaults are accessible during risky travel.