Zero-Knowledge Password Managers Explained
By Mihaly Kertesz · Updated
Zero knowledge usually describes a password-manager design in which the service does not possess the keys needed to read protected vault contents. The claim concerns a particular boundary. It does not establish that all metadata is encrypted or that every client and device is trustworthy.
Decryption keys in zero-knowledge password managers
Key ownership depends on where plaintext exists, how credentials derive keys and which components encrypt and decrypt data. A provider that stores ciphertext has a different role from one that can decrypt it. Local-only storage changes that relationship again.
Encryption algorithm names describe only part of the system. Derivation parameters, format, randomness, authentication and client implementation also determine its behavior.
Passary encryption description · Passary security model and limitations
Zero-knowledge password managers and metadata
Account identifiers, IP addresses, billing data, access times and transport metadata may have different protection from vault fields. A local application can contact an update server without uploading its vault.
A provider’s inability to read passwords does not establish the absence of network requests or third-party metadata. Each data path has its own scope.
| Question | Evidence to request |
|---|---|
| Which fields are encrypted? | Field/format documentation |
| Where are keys derived? | Client architecture and parameters |
| What leaves the device? | Privacy and transport documentation |
| What can recovery do? | Key ownership and recovery policy |
| What was independently assessed? | Dated audit scope, findings and limitations |
Client trust in zero-knowledge password managers
A hostile client, extension or compromised device can observe secrets during use. A malicious update may capture future input without decrypting an old backup through a provider’s servers.
Official distribution, software updates and extension permissions affect this boundary. Open source allows inspection but does not establish that a binary has been independently audited or built from a specific published revision.
Zero-knowledge password manager recovery
A service without the vault key needs a separate designed mechanism to restore access after credential loss. A reset that creates an empty vault does not recover existing encrypted data.
Product recovery policies describe these distinctions. Independent encrypted copies and their required credentials provide a separate recovery path where supported; the presence of a reset button alone does not establish one.
Comparing zero-knowledge password managers
Published formats, review scope, distribution status and documented recovery behavior provide evidence for a comparison. Hosted and local models have different responsibilities. Neither label alone establishes immunity from compromise or rules out every form of third-party access.