What is zero-knowledge architecture?
What end-to-end encryption and zero-knowledge architecture mean in a password manager: what the server sees, what it cannot see, and the limits.
SecurityThe Passhield team2 minute read
If you trust a password manager with all your company's passwords, the first question is: can the password manager itself see them? The terms "zero-knowledge" and "end-to-end encryption" are about the answer.
End-to-end encryption
With end-to-end encryption, information is encrypted on your device and decrypted only on authorised people's devices. Everything in between, the server included, sees only ciphertext. As long as the key never leaves the device, the server cannot reach the data itself.
What zero-knowledge means
In a zero-knowledge design, the company providing the service knows nothing about the content it stores. In a password manager this means the server cannot see your passwords, your notes and, ideally, your item titles either. Even if the server is compromised, an attacker gets nothing meaningful.
This has a price: if you forget your master password, the company cannot reset it for you, because it does not hold the key that opens your data. A good password manager therefore offers a separate way to recover. In Passhield that is a printed recovery kit for the organisation.
What Passhield's server sees and does not see
In Passhield, encryption and decryption happen only on your device. Everything sent to the server is encrypted: passwords, notes, item titles, addresses, usernames and SMS contents. The server sees what it needs to run the service: which user has permission on which vault, when an item was accessed and for what purpose. We list this split item by item on our security page.
The methods are open too: keys are derived from the master password with Argon2id, data is encrypted with XChaCha20-Poly1305, and signatures use Ed25519.
The limits
To be honest, end-to-end encryption does not solve everything:
- If your device is compromised, passwords may be visible on it during an unlocked session. Device security still matters.
- Whoever saw a password knows it. If an employee saw a password, it has to change when they leave. That is why Passhield records who saw what.
- Phishing is still a risk. The extension suggests a password only on the site at the saved address and will not fill a look-alike fake site, but care is still needed.
In short
End-to-end encryption means data opens only on authorised devices; zero-knowledge means even the provider cannot see the content. When choosing a password manager, check whether it states plainly what its server sees.