What is zero-⁠knowledge encryption?

“Zero-⁠knowledge encryption” describes a simple idea: the company that stores your data cannot read it, because the key that unlocks it never leaves your devices. It is one of the most useful properties a storage service can have. It is also a label a company chooses for itself, so it helps to know exactly what it promises and what it doesn’t.

The question that matters: who holds the key

Encryption scrambles data so that it can only be read with a key. Many services encrypt your data in some way. What decides your privacy is who has that key.

Apple’s iCloud shows the difference clearly. Under its default setting, standard data protection, Apple says your data is encrypted but “the encryption keys are secured in Apple data centers so we can help you with data recovery.” With Advanced Data Protection turned on, Photos, iCloud Backup and other categories become end-⁠to-⁠end encrypted, and Apple says it “doesn’t have the encryption keys needed to help you recover your end-⁠to-⁠end encrypted data.” Same company, same servers, a different answer to who holds the key.

Where the name comes from

In cryptography research, a “zero-⁠knowledge proof” is a different thing: a way for one party to prove a statement is true without revealing anything else. Storage and backup companies borrowed the phrase to mean the company has zero knowledge of what you store.

You will also see “end-⁠to-⁠end encryption,” “client-⁠side encryption” and “no-⁠knowledge.” For storage they mean roughly the same thing: data is encrypted on your device before it is sent. Because the word is a description a company chooses, the label alone tells you little. The details below are what count.

How it works, step by step

1. Your device gets a key. It either generates a random key, or derives one from your password.
2. Your device encrypts the data. Good designs use authenticated encryption, such as AES in Galois/Counter Mode (GCM), which both hides the content and detects any change to it.
3. Only the encrypted data is uploaded. To the server, it is unreadable bytes.
4. Your other devices decrypt it. They get the key from your password, from a recovery code, or securely from a device you already trust.

Why turning a password into a key is slow on purpose

Passwords are short and guessable compared to a random key. So zero-⁠knowledge systems run the password through a key derivation function, such as PBKDF2 (described in RFC 8018). It mixes in a random value called a salt, so the same password gives different keys for different people, and it repeats its work a set number of times, called the iteration count.

That repetition is deliberate. You wait a fraction of a second once, when you unlock. Someone trying to guess your password has to pay that same cost for every single guess. Some phone apps go further and mix in a key held in the phone’s security chip, so guesses can only be tried on that one device.

The lesson: a zero-⁠knowledge system is only as strong as the password or code that protects the key. A weak password with a fast key derivation step undoes good encryption.

What zero-⁠knowledge doesn’t cover

Five things stay outside the promise: metadata, recovery, sharing, the app itself and your own device.

Metadata

The contents are hidden, but the service still handles the encrypted files. It can usually see how many there are, how big they are, when they were uploaded and which account they belong to. Some services also keep file names or dates unencrypted.

Apple is open about this for iCloud. Even with Advanced Data Protection, it says some metadata and usage information stays under standard data protection. For Photos, its list includes “whether an item has been marked as a favorite, hidden, or marked as deleted.”

Recovery

If only you hold the key, nobody else can reset it. That is the point, and it is also the main risk. Forget your password and lose your recovery code, and the data is gone for good. A trustworthy service tells you this plainly and gives you a recovery method you store yourself, ideally on paper, away from the device.

Sharing

Sharing often breaks the model, because someone else needs a way in. Apple’s Shared Albums are an example: Apple says they don’t support Advanced Data Protection, because the feature lets albums be published on the web. Check how a service handles sharing before you assume shared files are protected the same way.

Trust in the app

The app on your device does the encrypting, so it sees your data before it is encrypted. Zero-⁠knowledge describes what the server can see. It does not prove the app is honest. You are trusting that:

• it really encrypts before uploading, every time
• it doesn’t send copies, thumbnails or logs to someone else, such as analytics or ad code
• a future update won’t quietly change any of this

Things that make that trust easier to give: a published description of the file format and encryption, source code others can read, reviews by people outside the company, and fewer outside components in the app.

Your own device

Zero-⁠knowledge protects the copy on someone else’s server. On your phone, data has to be decrypted to be shown. Malware, someone who can unlock the device, or a screenshot are outside what encrypting the server copy can help with.

How to test a zero-⁠knowledge claim

Ask these five questions, and look for straight answers in the service’s own documentation:

1. Can you reset my password and give me my data back? If yes, the company holds a key, and the data is not zero-⁠knowledge.
2. Where is the key created, and does it ever leave my device unencrypted?
3. What can you see? File counts, sizes, names, dates, IP addresses.
4. How do sharing and backups work? Are they covered by the same encryption?
5. Is the design published, and has anyone outside the company reviewed it?

Is it worth it?

Zero-⁠knowledge encryption matters most when you don’t want to depend on a company’s security, staff or policies. If its servers are breached, or it receives a request for your data, it cannot hand over what it cannot read.

The cost is responsibility. You keep the key, or the recovery code, and nobody can rescue you if you lose both. For photos and documents you would hate to see leak, that trade is usually worth making. For files you would hate to lose and don’t mind a company being able to read, a service that holds the key may suit you better.