# What is Zero-knowledge encryption?

> A design where the service provider never holds the key needed to read your data, so it cannot decrypt it even under compulsion.

Last reviewed: 2026-09-01

## Zero-knowledge encryption

Category: Cryptography

Also called: zero-knowledge architecture, zero-access encryption

Canonical page: https://moolkey.com/glossary/zero-knowledge-encryption

Zero-knowledge encryption means the service provider never possesses the key required to read your data. Encryption and decryption happen on your device with a key derived from a secret you never transmit. The provider stores ciphertext it cannot open. That protection comes from mathematics, not policy.

### How to tell whether a claim is real

Three questions separate a real zero-knowledge design from marketing. Can the provider reset your password and still give you your data? If yes, they hold a key. Can they show you a preview of your content in a web dashboard without you entering your passphrase? If yes, they hold a key. Do they publish where key derivation happens and let it be audited? If not, you are trusting a claim rather than a design.

### What it does not protect against

Zero-knowledge protects data at rest on the provider's servers. It does nothing about malware on your own device, a phishing page that captures your passphrase as you type it, or metadata such as which services you hold accounts with. Treat it as one strong guarantee, not a complete threat model.

Further reading: [What a zero-knowledge password manager really means](https://moolkey.com/blog/what-is-a-zero-knowledge-password-manager)

### Sources

- [OWASP: Password Storage Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html): Practical guidance for salts, peppers, PBKDF2, Argon2id, and password hashes.
- [NIST: Computer Security Resource Center glossary](https://csrc.nist.gov/glossary): Canonical terminology used across US computer security guidance.