What "zero-knowledge" actually means
Every security app says it is zero-knowledge. Here is the honest version: what the server can and cannot see, and how to check the claim.
The one-sentence version
Zero-knowledge means the company you trust with your data can never read it. Your information is encrypted on your own device, with a key only you hold, before anything leaves it. The server stores a locked box it has no key to.
What the server actually sees
When you save a password in a zero-knowledge app, your device turns it into ciphertext — a block of random-looking bytes — using a key derived from your master password. Only the ciphertext is uploaded. The company's servers, its staff, and anyone who later breaks into those servers all see the same thing: noise. There is no "admin view" of your vault, because the admin has no key either.
This is the whole point, and it is also the uncomfortable part: if the provider genuinely cannot read your data, it also cannot recover it for you. That trade-off is the honest signal that zero-knowledge is real.
What zero-knowledge can't do
It is not magic, and a few things are worth being clear about:
- It can't recover a forgotten master password. No key, no way back in — only your recovery kit can help, so keep it somewhere safe.
- It can't protect a device that is already compromised. If malware is watching your screen while your vault is unlocked, encryption at rest will not save you. Keep your device clean.
- It can't hide metadata it doesn't encrypt. A sloppy implementation might still leak how many items you have or when you log in. Good ones minimise this — it is fair to ask.
Zero-knowledge is about where the keys live, not about making you invincible.
How to check the claim
"Zero-knowledge" is just a marketing phrase until an app can answer three questions:
- Where is my data encrypted — on my device, or on their server? (It has to be your device.)
- Can the company reset my master password? (If yes, they can read your data, and it is not zero-knowledge.)
- What happens if their servers are seized tomorrow? (The honest answer is "nothing readable is on them.")
If a company dodges any of these, the label is doing more work than the engineering.
Where Guardikey stands
Guardikey is built this way on purpose. Your data is encrypted locally with a key derived from your master password, which is never transmitted. We store only opaque blobs. We cannot decrypt your vault, reset your master password, or hand your data to anyone — because we never hold the key. If a server were seized tomorrow, there would be nothing readable on it.
That is also why your recovery kit matters: it is the one way back in, and it is yours to keep safe.
Guardikey is a zero-knowledge password manager, self-custody crypto wallet and encrypted messenger in one vault you own.