| Admin | Role in a Business organization. Invites, confirms, creates vaults and groups and uses the admin console. |
| AI agent | A program such as Claude Code or Cursor that uses secrets through pbx mcp with your approval. |
| Co-organizer | Role in a family. Invites, confirms and creates shared vaults. |
| Device code | Short code a signed-in device uses to add a new device. |
| Emergency access | A trusted person may read chosen vaults after a waiting period. |
| Emergency Kit | A page with the server address, email address and Secret Key, optionally with a recovery code. |
| End-to-end encryption | Data is encrypted and decrypted on your device. In between, including on the server, it cannot be read. |
| Environment | An item with the variables of an application, as a replacement for a .env file. |
| Family vault | The shared vault every family gets automatically. |
| Group | Several people in a Business organization with whom you share vaults together. |
| Guest | A free person in a family or organization who may only view what is shared with them. |
| Item | Anything you store: login, note, card, document and more. |
| Master password | The password only you know, which opens your vault. Nobody can reset it. |
| Member | A person in an organization who is billed for Business. Guests, AI agents and service accounts are not members. |
| OPAQUE | A sign-in method in which the password never reaches the server. |
| Organizer | The person who started a family and manages it. |
| Passkey | Sign-in without a password, with a key your vault keeps for the website. |
| Policy | An organization's rules, such as required two-factor sign-in. Signed by an admin. |
| Recovery code (account) | Code from the Emergency Kit with which you set a new master password. Starts with "R1-". |
| Recovery code (two-factor) | One of ten codes that each replace a lost second factor once. |
| Request code | Digits you compare with the admin during a recovery through your organization. |
| SCIM | A standard with which a company directory creates and suspends people automatically. |
| Secret Key | A random key that protects your vault alongside your master password. Starts with "P1-" and is in your Emergency Kit. |
| Secret reference | A pointer such as pbx://vault/item/field that the command line replaces with the value. |
| Security check | A review of your vault for weak, reused and leaked passwords. |
| Security code | Twelve groups of digits that uniquely describe an account's key. For comparing when sharing. |
| Service account | Access for machines such as CI pipelines or AI agents, with a token instead of a master password. |
| Single sign-on (SSO) | Signing in through your company account at an identity provider. |
| Trusted device | A device that may unlock with single sign-on without a master password, if the organization allows it. |
| Two-factor code (2FA) | A six-digit code that changes every 30 seconds. Passbox can create it for your websites. |
| Two-factor sign-in | An extra proof when signing in to Passbox, such as a code or a security key. |
| Vault | A collection of items. Personal, or shared in a family or organization. |
| View, Edit, Manage | The three permissions for a shared vault. |
| Waiting period | The time during which you can decline an emergency access request. |