A zero-knowledge password manager encrypts everything on your own device before it is uploaded, with a key that only you can make. The company that stores your vault keeps a locked box it has no way to open. That is the whole idea, and it changes what can go wrong.
How it works in practice
- You choose a passphrase (or master password). It never leaves your device.
- Your device turns that passphrase into a key with a deliberately slow function such as Argon2id, so guessing it is expensive.
- That key unlocks a random master key, which in turn protects every item in your vault.
- Each secret is encrypted on your device, then uploaded. The server stores ciphertext: random-looking bytes.
- On another device, you download the ciphertext and decrypt it locally with the same passphrase.
The server is still useful: it syncs, it backs up, it enforces your plan's limits. It just never holds anything it can read.
What zero-knowledge protects you from
- A database leak. An attacker who steals the servers' data gets encrypted blobs. With a strong passphrase and a slow key function, trying passphrases one by one takes far too long to be worth it.
- A curious or compromised provider. Employees, contractors or anyone who breaks into the hosting can't browse your secrets, because the key isn't there.
- Legal requests for your data. The provider can only hand over what it has, and what it has is ciphertext.
What it can't protect you from
Honesty matters here, because zero-knowledge is sometimes sold as magic.
- A weak passphrase. If someone steals the encrypted vault, they can try guesses offline. A long, unique passphrase is what makes that hopeless. See how to make a strong password you can remember.
- Malware on your own device. Once your vault is unlocked on a machine someone else controls, the encryption has done its job and can't help further.
- Forgetting everything. Because the provider can't read your vault, it also can't reset your passphrase for you. That is why a good zero-knowledge service gives you a recovery key at setup. More in what happens if you forget your master password.
How to tell if a service is really zero-knowledge
Ask these questions:
- Where does encryption happen? It must be on your device, before upload. "Encrypted at rest" alone means the provider holds the key.
- Can they reset your password? If support can give you back your data after you forget your master password, they can read it.
- Is the encryption code published? Open code and an open file format let anyone check the claims instead of trusting a marketing page.
How Potent Cipher does it
Potent Cipher encrypts every secret on your device with XChaCha20-Poly1305, under keys made from your passphrase with Argon2id. Labels, notes and file names are encrypted too, not just the values. The encryption core is open for anyone to read, and files use the open .pcipher format, so you are never locked in. Our security page lists exactly what our servers can and can't see.