Zero-Knowledge
Zero-knowledge is an architecture in which the service provider never has access to the user's master password or plaintext data: all encryption and decryption happens on the user's own device.
In a zero-knowledge architecture, the user's master password is never transmitted to or stored on the provider's servers. Instead, the device locally derives a key from the master password (typically with a KDF such as PBKDF2 or Argon2) and uses that key to encrypt and decrypt data before it ever leaves the device. The server only stores and transports already-encrypted data, and at best a symmetric key that it itself cannot unwrap without the key derived by the user.
This means that if the provider's servers were compromised, an attacker would only obtain encrypted data, not passwords or plaintext content — as long as the encryption and key derivation are implemented correctly.
V4ult implements this principle: the master password is processed only on-device via PBKDF2-HMAC-SHA256 with 600,000 iterations; from that, a key is derived that wraps the vault's actual symmetric key (encrypted with AES-256-GCM). Only a verification hash derived from the password (used to authenticate the session) and the already-wrapped symmetric key reach the server — a key the server cannot unwrap without the locally derived key.
Advantages
- The provider cannot read the user's data even if it wanted to
- Reduces the impact of a breach on the provider's servers to encrypted data only
- Forces a design where security doesn't depend on trusting the provider
Related
Frequently asked questions
What does it mean for a password manager to be zero-knowledge?
It means the service provider never has access to your master password or the plaintext content of your vault, because all encryption and decryption happens on your device before data is synced.
Can a master password be recovered in a zero-knowledge architecture?
No, and that's intentional: if the provider could recover the master password, it wouldn't be a zero-knowledge architecture. If the user forgets it, they lose access to the data encrypted with that key.
Does V4ult use a zero-knowledge architecture?
Yes. V4ult's master password is processed locally with PBKDF2-HMAC-SHA256 (600,000 iterations) and never transmitted in plaintext; vault content is encrypted on-device with AES-256-GCM before syncing.