What is zero-knowledge encryption?
Zero-knowledge encryption means the service provider never possesses the key required to read your data. Encryption and decryption happen on your device with a key derived from a secret you never transmit. The provider stores ciphertext it cannot open. That protection comes from mathematics, not policy.
- Topic
- Cryptography
- Also called
- zero-knowledge architecture, zero-access encryption
- Reading time
- 1 min
- Reviewed
On this page
How to tell whether a claim is real
Three questions separate a real zero-knowledge design from marketing. Can the provider reset your password and still give you your data? If yes, they hold a key. Can they show you a preview of your content in a web dashboard without you entering your passphrase? If yes, they hold a key. Do they publish where key derivation happens and let it be audited? If not, you are trusting a claim rather than a design.
What it does not protect against
Zero-knowledge protects data at rest on the provider's servers. It does nothing about malware on your own device, a phishing page that captures your passphrase as you type it, or metadata such as which services you hold accounts with. Treat it as one strong guarantee, not a complete threat model.
Sources
These primary references support the terminology and current security guidance used in this definition.
