What it means

In a zero knowledge design, encryption and decryption happen on the user's device, and the provider stores only encrypted data. The key is derived from something the user holds, such as a master password. Zero knowledge is mostly a marketing label for client-side encryption, and it is not the cryptographic zero-knowledge proof that the name resembles. It is close to end-to-end encryption, which describes data that stays encrypted between the sender and the recipient. Password managers use the idea to protect a vault.

Why it matters when you buy software

The design means a provider breach exposes encrypted data and not readable passwords, and it means the provider cannot hand over readable data. The trade-off is recovery. If you lose the master password, the provider may be unable to restore your data. Check what recovery options a product offers and what other data stays outside the encrypted vault, such as account metadata. Vendors state the design themselves, so the claim is vendor-sourced.

Where it appears in the reviews

Password manager reviews describe each vendor's model. The 1Password review reports that the vendor states it cannot read customer data because data is decrypted only locally, and that a user who loses both the Secret Key and the master password cannot recover the account. The NordPass review reports that the vendor encrypts data locally before upload. The best password managers roundup compares all six.

See also: SOC 2, Single sign-on and the glossary index.