Zero-knowledge, plainly explained.
The provider cannot read your data. Not because it promises not to, but because it has no technical means of doing so.
The image that explains everything.
Picture a safe deposit box where the bank holds no second key. It can store the box, guard it, protect it against fire and hand it to you at any time. It cannot open it. If somebody asks the bank what is inside, the honest answer is: we do not know. That is exactly what zero-knowledge means in software. The provider keeps blocks of data that it cannot decrypt itself, because the key was never in its hands.
What actually happens.
1. The password becomes a key
Your master password is put through a deliberately slow procedure on your own device, which derives a key from it. Slow is the point here: every guessing attempt costs noticeable computing time.
2. Encryption happens before sending
Every entry is encrypted on your device. Only then does it travel. From the very beginning, the server sees nothing but unreadable blocks.
3. The key stays where it is
It is never transmitted and never stored. Close the vault and it disappears from memory. The next time you open it, it is derived from your password again.
4. Signing in happens without the password
The server does not receive the password but a proof derived from it. That lets it verify that you know the password, without being able to work out what it says.
5. Sharing without decrypting
If a colleague is to see a folder, the folder key is wrapped with their public key. Only they can unwrap it. The server passes the parcel on without looking inside.
What it costs.
Honesty is part of this: zero-knowledge has a price, and you are the one who pays it. If you forget your master password, nobody can reset it. There is no support desk that repairs this, because a support desk able to do so would also be able to read along. That is why every serious zero-knowledge product comes with a recovery key that you print once and keep somewhere safe. On top of that, part of the work has to happen on your own device, which makes the software somewhat more demanding. Both are the price of nobody but you being able to look inside.
Common questions. Clear answers.
Your question is not here? Write to us, we answer personally.
Is zero-knowledge the same as end-to-end encryption?
Almost. End-to-end describes the journey: encrypted at the sender, decrypted at the recipient, nobody reading along in between. Zero-knowledge describes what follows from that for the provider: at no point does it hold the means to read the content. In practice both describe the same principle from two angles.
How do I tell whether a provider really does this?
By three things. First: can it reset your master password? If it can, it can also read. Second: does it describe the procedure in a way you can follow, with names and key lengths, or does it stop at advertising language. Third: is there a recovery key that only you hold. If there is none, the question is who else lets you back in.
So what does the provider see at all?
The technical accompanying data: that an account exists, when it signed in, how many entries there are and how large they are. But not which services you use or what the credentials say. This accompanying data cannot be avoided entirely without the service ceasing to work. Anyone claiming to see nothing at all is glossing over it.
Does zero-knowledge also protect against a public authority?
Against handing over content, yes, because the provider cannot hand over what it cannot decrypt. What is not protected is the accompanying data from the previous answer. And it does not protect against somebody gaining access to your own device while the vault is open.
What happens if the provider is breached?
Attackers come away with encrypted blocks. Without your master password there is nothing to be done with them. The only remaining surface is guessing your password, which is precisely why its length matters more than any special-character rule. What makes a password strong.
Enterprise Security. No Compromise.
Register for our next free, no-obligation live webinar and see how FidenoVault protects your logins.
- Zero-knowledge
- European sovereignty
- GDPR-compliant
