Reference
Glossary
The vocabulary used throughout zcrypt and these docs, defined in one place.
Terms
A few of these are general cryptography terms; the rest are specific to how zcrypt works. They build on each other, so it can help to read them in order.
| Term | Definition |
|---|---|
| Vault | Your private, encrypted drive in zcrypt: the folders and files only you can decrypt. It is locked until you unlock it with your passphrase. |
| Passphrase | The secret you choose to protect your vault. It is used on your device to derive your encryption keys and is never sent to or stored by the server, so it cannot be recovered if lost. |
| CEK (content encryption key) | The key that actually encrypts a file's contents. In an envelope scheme the CEK is itself encrypted by a higher-level key rather than used directly from your passphrase. |
| Envelope encryption | A two-layer scheme: data is sealed with a content key (the CEK), and that content key is in turn sealed ("wrapped") by another key. It lets zcrypt re-key or re-share data without re-encrypting every byte. |
| Chunk | A piece of a file, sized to your device (4, 8, 10 or 16 MiB; 10 MiB is the usual). A file is split into chunks first, then each chunk is compressed and encrypted on its own. Chunks make uploads parallel, resumable, and easy to spread across storage repositories. |
| Salt | Random bytes mixed into key derivation so the same passphrase produces a different key each time. zcrypt uses a unique salt per file, which defeats precomputed-hash attacks. |
| KEK (key encryption key) | A key whose job is to encrypt other keys rather than data. zcrypt derives a per-user KEK from the instance master key (via HKDF) to wrap your stored platform tokens at rest. |
| Zero-knowledge | An architecture where the service holds no ability to read your data, no plaintext and no keys ever cross to the server. The trade-off is that nobody, including us, can recover a lost passphrase. |
| BYOB (bring your own backend) | zcrypt's storage model: you connect your own GitHub, GitLab, Hugging Face, or Telegram account as the backend, so your encrypted data lives on infrastructure you control and your capacity is your platform's free space. |
| Repo pool | The set of repositories zcrypt uses on a storage platform. As a repo nears the platform's size limit, the pool auto-rotates to a new repo, so storage grows without manual intervention. |
| Decoy vault | A second, innocent-looking vault opened by a separate decoy password, for plausible deniability. If compelled to log in, you can reveal the decoy instead of your real vault. |
| Dead man's switch | An optional safeguard that notifies a trusted contact if you stop checking in within a configured window: useful for handing off access if something happens to you. |
| TOTP | Time-based One-Time Password: the six-digit, 30-second codes from an authenticator app. zcrypt uses TOTP for two-factor authentication on sign-in. |
| Zstd | Zstandard, a fast, high-ratio compression algorithm. zcrypt compresses files with zstd before encrypting them, so less data is encrypted and stored. |
Where to go next
See these terms in context: Encryption model, Zero-knowledge architecture, and Architecture.