---
title: "What Is Zero-Knowledge Encryption? A Plain-English Guide (2026)"
description: "Zero-knowledge encryption means only you hold the keys, so the company storing your data can't read it. How it works, what it misses, and how to check an app."
url: https://www.vaultforyou.app/blog/zero-knowledge-encryption
lang: en
published: 2026-10-29
updated: 2026-10-29
author: "VaultForYou Editorial Team"
publisher: VaultForYou
---

# What is zero-knowledge encryption, and how can you tell if an app uses it?

> Zero-knowledge encryption keeps the company out of your data, but it's a marketing term, not a standard, so check what an app actually does.

Published 2026-10-29 - Updated 2026-10-29 - By VaultForYou Editorial Team

## Quick answer

Zero-knowledge encryption means your data is encrypted with keys that only you hold, usually on your own device, so the company that stores or syncs it can't read it. The provider has "zero knowledge" of your content and of the password that unlocks it. The trade-off: if you lose your password, the company can't recover your data.

- **In one line:** The company stores your data but never has the key to read it.
- **Not a standard:** It's an industry phrase. In cryptography, "zero-knowledge proof" means something else.
- **Easiest test:** Can the company reset your password and give you your data back? Then it holds a key.
- **What it misses:** Metadata, an unlocked or compromised device, and a weak password.

Zero-knowledge encryption means your data is encrypted with keys that only you hold, usually on your own device, so the company that stores or syncs it can't read it. The provider has "zero knowledge" of your files and of the password that unlocks them. That protects you if the company is breached, curious or asked to hand data over, because all it has is scrambled data. It's an industry term, not a formal standard, and it covers your content only: it doesn't hide metadata or protect a device someone has already unlocked.

We checked the Apple details below against Apple's support and Platform Security documentation in October 2026.

## What is zero-knowledge encryption, in plain English?

Picture a storage unit where you bring your own padlock and never give the company a copy of the key. The company rents you the space, moves the boxes and keeps the building secure, but it can't open your unit. If someone breaks into its office, there's no key to steal.

In software terms, zero-knowledge encryption has three parts:

- **Encryption happens on your device**, before anything is uploaded.
- **The keys are created and kept on your side**, often protected by a password the provider never receives.
- **The provider only ever stores encrypted data.** It can't decrypt it, so it can't show it to anyone.

EFF's encryption guide puts the general idea simply: encryption makes information unreadable except to someone who has the key. Zero-knowledge is about who has that key.

## Where VaultForYou fits: the facts, so you can compare

We make VaultForYou, so we'd rather give you facts than a label. Files are encrypted on your iPhone. The encryption keys stay in the iOS Keychain and never reach us. We never see your pattern and have no copy of your keys, so we can't see your files. There's no account. If you turn on the optional iCloud backup (Premium), each file is encrypted before it goes to your iCloud. The flip side: a forgotten pattern means that vault can't be opened, by you or by us. Run it through the checklist below like any other app.

> **Check the facts, then decide.** Encrypted on your iPhone, keys in the iOS Keychain. No account needed. [Download on the App Store](https://apps.apple.com/app/vaultforyou/id0000000000)

## "Zero-knowledge" is a marketing term, not a standard

Zero-knowledge encryption isn't defined by a standard that apps have to meet before using the phrase. In cryptography, "zero-knowledge" usually refers to a **zero-knowledge proof**, which NIST defines as a scheme where one party convinces another that a statement is true without revealing anything more. That's a different tool.

Companies borrowed the phrase to say "we can't see your data". Sometimes you'll also see **zero-knowledge architecture**, which means the whole service is designed so the provider never holds the keys. The idea is sound. The problem is that anyone can use the words, so the label alone tells you little. What matters is where the keys live and what the company can do without you.

## How does zero-knowledge encryption work?

A typical zero-knowledge design works like this:

1. **You set a password or the app creates a key on your device.** The key never leaves in readable form.
2. **The key is stored in secure storage on your device.** On iPhone, that's typically the keychain, which Apple's Platform Security guide describes as a secure way to store items such as keys and login tokens.
3. **Your data is encrypted on the device** before it's saved or uploaded.
4. **The provider stores only the encrypted copy.** OWASP's Cryptographic Storage Cheat Sheet recommends keeping keys separate from the data they protect; zero-knowledge takes that to the extreme by keeping them off the provider's systems entirely.
5. **You decrypt on your device** when you open the data, using a key the provider never had.

## Zero-knowledge vs. end-to-end vs. standard encryption

Most services say they "encrypt your data". The question is who else holds the key.

| Type | Who holds the keys | Can the provider read your data? | Example |
|---|---|---|---|
| Transport encryption (HTTPS/TLS) | You and the service, during transfer only | **Yes**, once it arrives | A website protected by HTTPS |
| Encryption at rest with provider keys | The provider | **Yes**, it can decrypt on your behalf | iCloud standard data protection for most data |
| End-to-end encryption | Only the endpoints, your devices or the people you message | **No** | iCloud Keychain passwords; Advanced Data Protection |
| Zero-knowledge encryption | Only you, on your devices | **No** | Storage designed so the provider never has the key |

EFF explains the transport row well: with transport-layer encryption, the service provider can see unencrypted copies of your data in the middle. With end-to-end encryption, only the endpoints can decrypt it.

## Who can read your data under zero-knowledge encryption?

| Who | Can they read your content? | Why |
|---|---|---|
| The company's employees | **No** | They never have your key. |
| Someone who breaches the company's servers | **No** | The servers hold only encrypted data. |
| Anyone the company is asked to give data to | **Not the content** | It can only hand over encrypted data and whatever metadata it holds. |
| Someone with your password or recovery key | **Yes** | That's the key to your data. |
| Someone using your unlocked device | **Often yes** | Data is decrypted on your device for you to use. |
| Malware on your device | **Possibly** | EFF warns that if your endpoints are compromised, encrypted data can be too. |
| You, after forgetting your password | **Only with a recovery method you set up** | The company has nothing to reset you with. |

## Apple's example: standard protection vs. Advanced Data Protection

iCloud is a clear, well-documented example of the difference.

With **standard data protection**, the default, iCloud data is encrypted in transit and at rest, but the keys for most categories are kept in Apple's data centers. Apple says this lets it decrypt your data on your behalf, for example when you sign in on a new device or recover your data after forgetting your password. A smaller set of categories, including passwords in iCloud Keychain, is end-to-end encrypted even here.

With **Advanced Data Protection**, an optional setting, your trusted devices keep sole access to the keys for most iCloud data, including iCloud Backup, Photos and Notes. Apple says no one else can access that data, not even Apple, and it stays secure even in a data breach in the cloud. Two consequences show how the model works:

- **Recovery becomes your job.** Before turning it on, you set up a recovery contact or a recovery key, because Apple can't help you recover end-to-end encrypted data.
- **Web access switches off.** Turning it on disables access to your data at iCloud.com. If you turn web access back on, you approve each visit from a trusted device.

Apple doesn't call this "zero-knowledge"; it calls it end-to-end encryption. For iCloud specifics, see [is iCloud encrypted?](/blog/is-icloud-encrypted) and [can Apple see your photos?](/blog/can-apple-see-your-photos)

## What zero-knowledge encryption doesn't protect

- **Metadata.** EFF notes that encryption protects content, not information about it: who, when, how often, how much.
- **Your device.** Data has to be decrypted to be used, so an unlocked or compromised phone exposes it.
- **Weak passwords.** If the key is protected by a password, a guessable password is a guessable key.
- **Shared links.** Sharing can step outside the model. Apple, for example, says Shared Albums and "anyone with the link" sharing aren't end-to-end encrypted even with Advanced Data Protection.
- **Copies elsewhere.** An unencrypted backup, an export or an original in your photo library isn't covered.

## How to tell if an app really uses zero-knowledge encryption

Ignore the label and ask these questions. The app's help pages, privacy policy and App Store listing should answer them:

1. **Can the company reset your password and give your data back?** If yes, it holds a key or a way to get one.
2. **Can you see your data in a web browser** with just an email and password, without a trusted device? If yes, the company's servers can likely decrypt it.
3. **Where are the keys stored?** Look for "on your device" or the iOS Keychain, not "on our servers".
4. **Is the backup encrypted before it leaves your device?** "Encrypted in the cloud" isn't the same thing.
5. **What does the privacy policy say about access to content?** Look for a plain statement that the company can't read it.
6. **Does sharing keep the same protection?** Shared links and collaboration features are where models often change.
7. **What data does it collect anyway?** Check the App Privacy section of the App Store listing for account, usage and tracking data.

Answers that line up across all seven are a better sign than any badge. If you're comparing vault apps specifically, our guide to [what a vault app is and how to judge one](/blog/what-is-a-vault-app) applies the same tests, and our comparison of [photo vault apps for iPhone](/blog/best-photo-vault-apps-iphone) shows how specific apps describe their backups.

## Frequently asked questions

### Is zero-knowledge encryption the same as end-to-end encryption?

They overlap. End-to-end encryption means only the endpoints, the devices at each end, can decrypt the data, and it's usually used for messages. Zero-knowledge is usually used for storage and backups, and means the provider never holds your keys or password. A service built so it can't read your stored data is effectively end-to-end encrypted between your own devices.

### What happens if I forget my password with zero-knowledge encryption?

The provider can't reset it and hand your data back, because it never had the key. Recovery only works through something you set up in advance, such as a recovery key, a recovery contact or another trusted device. Apple's Advanced Data Protection works this way: before you turn it on, you must set up a recovery contact or recovery key.

### What is zero-knowledge architecture?

It's a way of designing a service so the provider is never able to read customer data: encryption and decryption happen on your device, keys are created and kept there, and the servers only ever store encrypted data. "Architecture" is the point: the protection comes from how the system is built, not from a promise that employees won't look.

### Is iCloud zero-knowledge encrypted?

By default, not for most data. With standard data protection, Apple keeps the encryption keys for most iCloud data in its data centers, and only certain categories, like passwords in iCloud Keychain, are end-to-end encrypted. With Advanced Data Protection turned on, your trusted devices hold the keys for most iCloud data, including Photos and iCloud Backup. Apple calls this end-to-end encryption.

### Does zero-knowledge mean the app collects no data at all?

No. It describes your content and keys, not everything else. A provider can still know your email address, payment details, file sizes, when you sync and your IP address. EFF notes that end-to-end encryption doesn't hide metadata, and the same applies here. Read the privacy policy and the App Store privacy details for the rest.

### Can zero-knowledge encryption be hacked?

A breach of the provider's servers exposes only encrypted data, which is the whole point. But your data is decrypted on your device, so a compromised or unlocked device, a weak or reused password, or a phishing page that captures your password can still expose it. Encryption protects data in storage, not a device someone else controls.

### Is zero-knowledge encryption the same as a zero-knowledge proof?

No. NIST defines a zero-knowledge proof as a cryptographic scheme that lets someone convince a verifier that a statement is true without revealing anything more. Zero-knowledge encryption borrows the name to describe storage where the provider learns nothing about your data. The two are related in spirit, but they're different things.

## Bottom line

Zero-knowledge encryption means the company that stores your data never holds the key to read it: encryption happens on your device, keys stay with you, and the servers only see scrambled data. It's a strong model, but it's a marketing phrase, not a standard, and it comes with a real trade-off: lose your password and nobody can recover your data for you. Judge apps by where the keys live and what the company can do without you, not by the label.

Keep reading:

- [Is iCloud encrypted?](/blog/is-icloud-encrypted)
- [What is a vault app, and is it safe?](/blog/what-is-a-vault-app)
- [Forgot your photo vault password?](/blog/forgot-photo-vault-password)

## Sources

- [NIST CSRC Glossary: Zero-Knowledge Proof](https://csrc.nist.gov/glossary/term/zero_knowledge_proof)
- [EFF Surveillance Self-Defense: What Should I Know About Encryption?](https://ssd.eff.org/module/what-should-i-know-about-encryption)
- [Apple Support: iCloud data security overview](https://support.apple.com/en-us/102651)
- [Apple Support: How to turn on Advanced Data Protection for iCloud](https://support.apple.com/en-us/108756)
- [Apple Platform Security: Keychain data protection](https://support.apple.com/guide/security/keychain-data-protection-secb0694df1a/web)
- [OWASP Cryptographic Storage Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html)

## Keep reading

- [Is iCloud Encrypted? Yes, but Apple May Hold the Keys (2026)](https://www.vaultforyou.app/blog/is-icloud-encrypted): Yes, iCloud is encrypted, but by default Apple holds the keys to your photos and backups. What Advanced Data Protection changes, and what it doesn't.
- [Can Apple See Your Photos? Hidden Photos, iCloud and the Keys](https://www.vaultforyou.app/blog/can-apple-see-your-photos): Apple says it doesn't access photos on your iPhone, but by default it holds the keys to iCloud Photos. What Advanced Data Protection and hiding really change.
- [What Is a Vault App? How Photo Vaults Work and Who Can Open Them](https://www.vaultforyou.app/blog/what-is-a-vault-app): What is a vault app? A private space with its own lock for photos, videos and files. How photo vault apps work, which ones only hide files, and how to judge one.
- [Is Your iPhone Backup Encrypted? How to Check and Turn It On](https://www.vaultforyou.app/blog/iphone-backup-encryption): iCloud backups are always encrypted; iPhone backups on a Mac or PC aren't by default. How to check, encrypt your iPhone backup, and the password catch.

---

Our guides are written and fact-checked by the VaultForYou team against Apple's own documentation. We make VaultForYou, a private vault app for iPhone. Download on the App Store: https://apps.apple.com/app/vaultforyou/id0000000000