Zero-knowledge

Zero-Knowledge Encryption, Explained Without the Jargon

Zero-knowledge encryption means your data is encrypted on your own device before it's uploaded, and the key never reaches the provider. So the company hosting it has zero knowledge of what's inside and couldn't read it if it wanted to. Here's what that means in plain terms, and how to tell if it's real.

Zero-knowledge encryption means your data is encrypted on your own device before it's uploaded, and the key never reaches the provider. The company hosting your data has zero knowledge of what's inside it, and couldn't read it even if it wanted to.

It sounds like a marketing phrase, and honestly the term is a bit of one. But there's a real, simple idea underneath.

The everyday version

Picture a locked box. You lock it yourself and keep the key. You hand the provider the box, and they store it in their warehouse. They can keep it safe, move it, and give it back to you on request. What they can't do is open it, because they never had the key. That's zero-knowledge, minus the cryptography.

How it differs from "encrypted"

"Encrypted" gets used to mean very different things:

Encrypted in transit means the data is protected while it travels to the provider, then unlocked when it arrives. They can read it once it's there.
Encrypted at rest means it's stored in scrambled form, but the provider holds the keys. They can still read it, and so can anyone who gets those keys.
Zero-knowledge, or client-side, encryption means it's locked on your device and the provider never receives the key. They store a version they can't open.

The first two are the ones marketing counts on you not to distinguish. "Encrypted at rest" sounds airtight, but the provider still has the key.

An honest note about the words

Security people are a little suspicious of "zero-knowledge" as a label, because it doesn't pin down a specific guarantee the way "end-to-end encryption" does. So don't buy the word. Look for the property behind it: is the data encrypted before it leaves your device, and does the provider ever hold the key? That's what actually protects you.

The one-line test is this: if the provider can recover your data for you when you forget your password, they can read it. Genuine zero-knowledge means they can't help you back in, precisely because they never had access.

The three levels, side by side

Label you'll see	Where it's encrypted	Who holds the key	Provider can read it?
"Encrypted in transit"	On the wire	Provider	Yes, once it arrives
"Encrypted at rest"	On the server	Provider	Yes
"Zero-knowledge" / client-side	On your device	You	No

Where doconvoy fits

doconvoy is a working example of the third row. Your data is encrypted in the browser before it's sent, and the key never reaches the server, so doconvoy stores a version it can't open. That's not a promise about how careful the company is. It's a limit on what the software is able to see in the first place.

Encrypted in your browser, with the key kept off our servers by design.

Data we're built not to read

Common questions

What is zero-knowledge encryption in simple terms?

It means your data is locked on your own device before it's sent, and the provider never gets the key. They store a scrambled version they can't open, so they have 'zero knowledge' of what's inside. Only you, or the person you share the key with, can read it.

Is zero-knowledge encryption the same as a zero-knowledge proof?

No, and they're easy to confuse. Zero-knowledge encryption (sometimes called a zero-knowledge service) means the provider can't read your stored data. A zero-knowledge proof is a separate cryptographic technique for proving something is true without revealing why. This guide is about the first one.

How can I tell if 'zero-knowledge' is real or just marketing?

Ask one question: if the provider can recover your data for you when you're locked out, they can probably read it. Genuine zero-knowledge means they can't get you back in, because they never held the key.