What "Zero-Knowledge" Actually Means
"Zero-knowledge" is thrown around a lot in security marketing. Let us define it precisely.
Zero-knowledge architecture means the service provider has zero knowledge of your data. They cannot read it, they cannot decrypt it, and they have nothing meaningful to hand over even if legally compelled.
This is different from "encrypted storage," which usually means data is encrypted at rest on servers — but the service provider holds the decryption key. They could read your data, they just don't (you hope).
With true zero-knowledge: - You control the key (your passphrase) - The provider never sees the plaintext - The provider cannot decrypt even if they wanted to - A court order gets them nothing useful — only encrypted bytes
How VaultSends Achieves Zero-Knowledge
Step 1: Key Derivation
When you set a passphrase, VaultSends runs it through PBKDF2-SHA512 at 310,000 iterations combined with a server-side master key. This produces the actual AES-256 encryption key.
The server only receives a verification hash — not the passphrase itself.
Step 2: Encryption
Your plaintext is encrypted with AES-256-GCM using a unique 256-bit random salt and 128-bit random IV per secret. The server stores only binary ciphertext — completely unreadable without the key.
Step 3: No Passphrase Storage
Your passphrase is never stored. Only a verification hash allows the server to confirm you entered the correct passphrase before decryption. Even this verification hash does not give access to your plaintext.
The Limits of Zero-Knowledge
Zero-knowledge protects against: - ✅ Database breach — encrypted data is useless - ✅ Rogue employees — no access to plaintext - ✅ Legal orders — nothing meaningful to hand over
Zero-knowledge does NOT protect against: - ❌ Compromised endpoint — malware that reads data before encryption - ❌ Phishing — being tricked into using a fake site - ❌ Sharing the link publicly
Conclusion
Zero-knowledge is not just a feature — it is an architecture that removes the need to trust VaultSends with your data. We architecturally cannot read your secrets.
VaultSends implements genuine zero-knowledge encryption. Free at vaultsends.com.