What is zero-knowledge encryption in a password manager?

What does zero-knowledge mean in plain English?

Imagine renting a safe-deposit box where you bring your own lock. The bank stores the box, moves it between vaults and keeps it safe from fire, but only you have the key. If a burglar breaks into the bank, they get a locked box. If a bank employee is curious, they get a locked box. If you lose your key, the bank cannot open it for you either.

A zero-knowledge password manager works the same way. Encryption and decryption happen on your device, in the browser or app. The provider's servers only ever see the locked box: encrypted data, known as ciphertext. The provider has "zero knowledge" of what is inside.

The term is borrowed loosely from cryptography, where "zero-knowledge proof" has a narrower, technical meaning. In password managers it is a marketing label for end-to-end, client-side encryption, so it is worth checking what each vendor actually means by it.

What can the provider see, and what can't it see?

In a well-built zero-knowledge system the provider cannot see your passwords, notes or 2FA secrets, and cannot decrypt them even if ordered to, because it never holds the key.

That does not mean it sees nothing. To run a service, a provider typically knows some account information:

• Your email address and when you sign in.
• Which teammates are in your organisation and who shares with whom.
• Roughly how much data you store and when items change.
• Network information such as IP addresses.

Vendors differ on which item fields, such as website addresses or item names, are encrypted. Ask each vendor for a precise list rather than assuming.

How is your encryption key created from your master password?

Your master password is never used directly as a key, and it should never be sent to the server. Instead, the browser runs it through a key derivation function: a deliberately slow calculation that turns a password into a strong key and makes guessing attacks expensive.

A common design, and the one BobWork Vault uses, looks like this:

1. The master password is stretched with PBKDF2-SHA256 at 600,000 iterations. Each guess an attacker makes costs the same work, which slows large-scale guessing.
2. The result is split with HKDF into two separate values: an encryption key that stays in the browser, and a sign-in proof that is sent to the server to show you know the password.
3. Because the two values are derived separately, the server can check your sign-in without ever receiving the key that decrypts your data.

The 600,000 iteration figure matches the current OWASP recommendation for PBKDF2-SHA256. It does not make a weak master password safe; length and unpredictability still matter most.

How are individual passwords encrypted?

Good designs do not encrypt the whole vault as one blob. Each item gets its own random key. In BobWork Vault every item is encrypted with AES-256-GCM, an authenticated cipher: it both hides the data and detects if anyone has tampered with it.

Per-item keys matter for teams. They let you share one password without sharing everything else, and let you remove someone's access to one item without re-encrypting the entire vault.

How can a team share passwords if the provider can't read them?

This is the clever part. Each user has a key pair: a public key that anyone can use to lock something for them, and a private key, protected by their master password, that only they can use to unlock it.

When you share a password, your browser takes that item's key and wraps it, meaning it encrypts the key, separately for each teammate using their public key. BobWork Vault uses P-256 ECDH for this wrapping. The server stores one wrapped copy per person but cannot unwrap any of them.

Removing someone works the other way: their wrapped copy is deleted and, for proper hygiene, the remaining items are re-keyed so an old copy of the key is useless. BobWork Vault's offboarding flow does this re-keying, and still builds a checklist of site passwords to change, because the leaver may have seen or used them.

What happens if you forget your master password?

This is the honest cost of zero-knowledge. If only you can derive the key, and you forget the password, nobody can derive it for you. Many services offer no recovery by design. Some offer an opt-in recovery mechanism, which is a deliberate trade of a little independence for convenience.

• Write down an emergency kit with your sign-in details and store it somewhere physically safe.
• Use a memorable passphrase, several random words, rather than a short complex password you will forget.
• For organisations, decide in advance whether admins should be able to help members recover, and who those admins are.

In BobWork Vault, by default nobody, including BobWork, can recover a forgotten master password. Organisations can opt in to admin-assisted recovery, which members enrol in, and an Emergency Kit is offered at sign-up.

Does zero-knowledge make a password manager unhackable?

No. It removes one major risk: a breach of the provider's servers exposing readable passwords. Other risks remain and deserve attention.

• Weak master passwords can still be guessed offline if encrypted data leaks.
• Malware on your device can read what you see after you unlock.
• Phishing can trick you into typing your master password into a fake page.
• Malicious code delivered by the provider could, in theory, capture keys in the browser. This is why transparency and independent review matter.

Extra sign-in checks help. BobWork Vault, for example, asks for an emailed code as well as the master password when you sign in on a new device.

How can you verify a vendor's zero-knowledge claims?

You do not have to take marketing at its word. Ask, or look for, the following:

• Named algorithms and parameters: which cipher, which key derivation function, how many iterations. Vague phrases such as "military-grade" without details are a warning sign.
• A published security design explaining where keys are created and what the server stores.
• A clear recovery policy. If a vendor can reset your vault without your master password or an enrolled recovery key, it is not zero-knowledge.
• A list of unencrypted fields and metadata.
• Independent audits or open code, where available, and how recent they are.
• Your own check: open the browser's developer tools network tab and confirm that requests to the server contain ciphertext, not your passwords.

Where does BobWork Vault fit?

BobWork Vault is a free zero-knowledge password manager for teams, with team sharing included. Everything is encrypted in the browser; the server stores ciphertext only. The full design is on the security page, and the comparison page shows how it lines up with other tools. If it fits your team, create a free vault.

Try BobWork Vault — free for your whole team

BobWork Vault is a free, zero-knowledge password manager for teams, made by BobWork (BobOffice, LLC). Shared folders, login-only access, 2FA codes and guided offboarding, end-to-end encrypted. Add it to Chrome or create a free account.

Keep reading

• How to share 2FA codes with your team without waiting for one person's phone
• How to share a password without revealing it to contractors, agencies and interns
• How BobWork Vault encrypts your passwords
• Team password managers compared

More: free team password manager · free company password manager · company password manager · password management software · how to share passwords with teammates · compare password managers