What zero-knowledge encryption means
“Zero-knowledge” describes a privacy property: the provider cannot read the contents of the vault it protects. The exact scope depends on the product’s architecture. The term does not mean that the provider knows nothing about how the service is used, or that no third party can access data from a compromised device.
In a password manager that syncs an encrypted vault, encryption and decryption are designed to happen on the user’s devices. A server may then hold an encrypted copy without having the information needed to read the vault. Metadata, devices, and recovery methods still need to be assessed separately.
What zero-knowledge protects, and what it does not guarantee
This type of architecture is intended to prevent the provider from reading the secrets in the vault. A server breach therefore does not automatically reveal their plaintext, provided the encryption and key management work as intended and the decryption material remains secret.
This property does not make a vault invulnerable. An unlocked or compromised device, an exposed passphrase, a software vulnerability, or an unprotected backup can create other paths to access. Metadata protection also depends on the service and its implementation.
The difference between zero-knowledge and local-first
Zero-knowledge concerns the provider’s access to the contents: can it read the vault’s secrets? Local-first concerns where the primary data is stored and how it is synchronised. The two properties can coexist, but they do not mean the same thing.
Soclyde: a vault kept on your devices
Soclyde is designed to keep the encrypted vault on authorised devices rather than in a central cloud vault operated by Soclyde. Soclyde cannot access vault contents or the passphrase that protects them. This can be described as zero-knowledge in the product sense, limited to vault contents.
With Soclyde Premium, authorised devices synchronise the vault directly. The absence of a central copy reduces exposure to a breach of a provider-held central vault. It does not remove risks involving devices, their backup copies, or the passphrase. Each authorised device keeps a complete copy, so you can access the vault offline on that device.
A zero-knowledge password manager can limit what the provider can read. Also understand where copies are kept, how devices are protected, and what is possible if a device or passphrase is lost.
