{
  "$schema": "https://appvau.lt/api/v1/openapi.json",
  "dataset": "glossary",
  "title": "Encrypted-vault glossary",
  "description": "One-sentence definitions of the cryptography and vault-app terms used across appvau.lt, each with the explainer page and the standard behind it.",
  "updated": "2026-09-11",
  "source": "https://appvau.lt",
  "documentation": "https://appvau.lt/api/",
  "publisher": "Vast Flow, LLP",
  "licence": {
    "name": "CC BY 4.0",
    "url": "https://creativecommons.org/licenses/by/4.0/",
    "attribution": "App-Vault (https://appvau.lt)",
    "terms": "Free to reuse, republish and build on, including commercially, with attribution and a link to the source page."
  },
  "caveats": [
    "Definitions are written for a general reader. Where a term has a formal definition in a standard, the standard is linked and wins."
  ],
  "count": 12,
  "terms": [
    {
      "term": "AES-256-GCM",
      "definition": "AES-256-GCM is a symmetric authenticated cipher that encrypts data with a 256-bit key and produces an authentication tag, so any modification of the ciphertext is detected on decryption rather than silently decrypted into garbage.",
      "explained_at": "https://appvau.lt/guides/what-is-aes-256-gcm/",
      "standards": [
        {
          "id": "fips197",
          "title": "NIST FIPS 197 — Advanced Encryption Standard (AES)",
          "url": "https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.197-upd1.pdf"
        },
        {
          "id": "sp80038d",
          "title": "NIST SP 800-38D — Galois/Counter Mode (GCM) and GMAC",
          "url": "https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-38d.pdf"
        }
      ]
    },
    {
      "term": "AEAD",
      "definition": "AEAD — authenticated encryption with associated data — is a cipher interface that provides confidentiality and integrity in one operation, which is what removes the classic mistake of encrypting without authenticating.",
      "explained_at": "https://appvau.lt/guides/what-is-aes-256-gcm/",
      "standards": [
        {
          "id": "rfc5116",
          "title": "RFC 5116 — An Interface and Algorithms for Authenticated Encryption",
          "url": "https://www.rfc-editor.org/rfc/rfc5116"
        }
      ]
    },
    {
      "term": "PBKDF2",
      "definition": "PBKDF2 is a key-derivation function that turns a low-entropy secret such as a pattern or a password into a cryptographic key by repeating a hash many times with a salt, so that guessing costs the attacker the same repeated work.",
      "explained_at": "https://appvau.lt/guides/pbkdf2-explained/",
      "standards": [
        {
          "id": "sp800132",
          "title": "NIST SP 800-132 — Recommendation for Password-Based Key Derivation",
          "url": "https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-132.pdf"
        },
        {
          "id": "owaspStorage",
          "title": "OWASP Password Storage Cheat Sheet",
          "url": "https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html"
        }
      ]
    },
    {
      "term": "Salt",
      "definition": "A salt is a random value mixed into key derivation so that two installs with the same pattern produce different keys, which is what makes a precomputed rainbow table useless.",
      "explained_at": "https://appvau.lt/guides/pbkdf2-explained/",
      "standards": [
        {
          "id": "sp800132",
          "title": "NIST SP 800-132 — Recommendation for Password-Based Key Derivation",
          "url": "https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-132.pdf"
        }
      ]
    },
    {
      "term": "Secure Enclave",
      "definition": "The Secure Enclave is a separate hardware subsystem in Apple devices that holds and uses keys without ever releasing them to the main processor, so a key wrapped by it cannot be copied off the device even by code running as root.",
      "explained_at": "https://appvau.lt/guides/secure-enclave-explained/",
      "standards": [
        {
          "id": "secureEnclave",
          "title": "Apple Platform Security — Secure Enclave",
          "url": "https://support.apple.com/guide/security/secure-enclave-sec59b0b31ff/web"
        }
      ]
    },
    {
      "term": "Zero-knowledge architecture",
      "definition": "A zero-knowledge architecture is one in which the publisher has no technical ability to read user data — no keys, no server copy and no account-recovery path — as distinct from a promise not to look.",
      "explained_at": "https://appvau.lt/zero-knowledge/",
      "standards": []
    },
    {
      "term": "Decoy vault",
      "definition": "A decoy vault is a second encrypted container opened by a different unlock secret, so that a person compelled to open the app can open one that contains nothing sensitive.",
      "explained_at": "https://appvau.lt/decoy-vault/",
      "standards": []
    },
    {
      "term": "Calculator vault",
      "definition": "A calculator vault is an app that presents as a working calculator and opens an encrypted store after a specific input sequence, so the vault is not visible as a vault on the home screen.",
      "explained_at": "https://appvau.lt/calculator-vault/",
      "standards": []
    },
    {
      "term": "Intruder selfie",
      "definition": "An intruder selfie is a photograph taken silently by the front camera after a threshold of failed unlock attempts, recorded as evidence that someone tried to open the app.",
      "explained_at": "https://appvau.lt/intruder-selfie/",
      "standards": []
    },
    {
      "term": "File shredder",
      "definition": "A file shredder overwrites a file’s bytes before removing it, rather than only deleting the directory entry that points at them.",
      "explained_at": "https://appvau.lt/file-shredder/",
      "standards": []
    },
    {
      "term": "iPhone Hidden Album",
      "definition": "The iPhone Hidden Album is a folder inside the Photos app that is concealed from the main library but not encrypted, and it is unlocked by the same Face ID or passcode that already unlocked the phone.",
      "explained_at": "https://appvau.lt/guides/is-iphone-hidden-album-secure/",
      "standards": []
    },
    {
      "term": "BIP-39 recovery phrase",
      "definition": "A BIP-39 recovery phrase is a sequence of words drawn from a fixed wordlist with a checksum, which encodes enough entropy to regenerate a key and is designed to be written down on paper.",
      "explained_at": "https://appvau.lt/encryption/",
      "standards": [
        {
          "id": "bip39",
          "title": "BIP-39 — Mnemonic code for generating deterministic keys",
          "url": "https://github.com/bitcoin/bips/blob/master/bip-0039.mediawiki"
        }
      ]
    }
  ]
}