What is zero-knowledge encryption?

Zero-knowledge encryption means your data is encrypted on your device with a key that only you have. The company that stores your data can't read it: not its employees, and not attackers who break into its servers.

Zero-knowledge encryption is not the same as a zero-knowledge proof, a cryptography technique used in blockchains. The two share a name, but this guide is about how apps store your data.

Zero-knowledge vs. ordinary encryption

Almost every service says your data is "encrypted". The question is who holds the key.

With encryption in transit or at rest, the provider protects your data from outsiders but can still read it. With zero-knowledge encryption, the provider never has the key.

How it works

1. You choose a master password.
2. Your device turns it into an encryption key. The password and the key never leave your device.
3. Your data is encrypted on your device.
4. Only the encrypted data is uploaded and synced.
5. Your other devices download it and decrypt it locally with the same key.

Why it matters for your IDs and documents

Passport numbers, driver licenses and Social Security numbers are exactly what identity thieves need. Unlike a password, you can't easily change them after a leak, and a Social Security number lasts a lifetime.

With zero-knowledge encryption:

• A breach exposes nothing readable. If the provider's servers are hacked, attackers get encrypted data without the key.
• No insider can look. Employees can't browse your documents.
• The provider can't hand over what it can't read. It can't share, sell or disclose a readable copy of your data, because it doesn't have one.

How to tell if a service really is zero-knowledge

• Does encryption happen on your device? Look for "end-to-end" or "client-side" encryption.
• Does it publish how its encryption works? A detailed security model is a good sign.
• Is your password sent to the server when you sign in? The best services use protocols such as SRP so it never is.

Zero-knowledge in Citadel

• Your vault is encrypted on your device with AES-256-GCM, using keys derived from your master password with PBKDF2-HMAC-SHA512 and 650,000 iterations.
• Sign-in uses the Secure Remote Password (SRP) protocol, so your master password never leaves your device.
• Our servers store only encrypted data and your account ID. What our servers store

Read the full security model.