“Zero-knowledge” is one of the most overused phrases in consumer security. It shows up on landing pages next to padlock icons and vague promises that “even we can’t see your data.” Sometimes that claim is architectural. Sometimes it only means a company promises not to look — which is a policy, not a guarantee.
In Vault App, zero-knowledge has a narrow, testable meaning: the systems that store and sync your vault never receive the material required to decrypt it. Your master password is not uploaded in a recoverable form. Encryption keys are derived on your device. What leaves the device and what sits in storage is ciphertext. Without the master password, those blobs are not a vault — they are noise.
Trust vs. impossibility
Many products ask you to trust operators, contractors, and support tooling not to abuse privileged access. That trust might be well placed. It is still trust. A zero-knowledge vault aims for a stronger property: even a motivated insider, a compromised admin session, or a lawful demand for “the contents of this account” cannot produce plaintext that was never available to the service.
That is why lost master passwords cannot be emailed back to you. There is nothing on the server to look up. Account email might help with billing or signing into an empty shell of an account. It cannot reconstruct encryption keys that only existed after local derivation on your device.
What “on your device” really changes
When encryption happens before sync, the network’s job shrinks. It can authenticate an account, store sealed items, and deliver them to your other devices. It does not need — and must not hold — a working key for your notes, logins, or cards. Sync becomes distribution of sealed packages, not a shared plaintext database with nice APIs for “forgot password.”
That design also constrains features. Anything that requires the server to read a secret in order to be helpful is in tension with zero-knowledge. Vault App would rather ship less than quietly reintroduce a readable vault behind a marketing synonym for privacy.
How to evaluate the claim
When another product says zero-knowledge, ask where keys are created, whether the provider can reset access by decrypting for you, and what an export contains. Ask whether support can “look up” an item. Ask what happens if their datastore is copied wholesale. If the answer is “we’d have your passwords,” the architecture is not zero-knowledge in the sense that matters.
Vault App is built so confidentiality does not depend on hoping nobody opens the wrong dashboard. If you care about passwords, notes, and cards staying yours alone, that is the standard worth holding — and the one we design against.