What does “zero-knowledge” mean for a vault?

“Zero-knowledge architecture” is an industry label for services built so that the provider cannot read what customers store, because encryption keys are created and kept on customers' devices rather than on the provider's servers.

Not the same as a “zero-knowledge proof”

In cryptography, a “zero-knowledge proof” is a specific kind of protocol: one party convinces another that a statement is true without revealing anything beyond that fact. Storage and password products that use the phrase rarely run such proofs. They mean client-side or end-to-end encryption, with the provider knowing nothing about the contents.

Why the label overpromises

Even a well-built client-side system knows a good deal. To route data, enforce access and keep a log, the server has to see structure:

• account email addresses;
• names of organizations, projects and environments;
• which people and machines have access to what;
• when data changed and roughly how large it is;
• the audit log of actions.

None of this is the secret values themselves, but it is not nothing. A reader who hears “zero-knowledge” may fairly assume that names and activity are hidden too.

What Crunu says instead

Crunu describes its server as a blind server: it stores only ciphertext and cannot decrypt a single value at any step. Encryption keys exist only on your devices and machines. The account key is derived from your password and your Secret Key, and neither is sent to the server in any form.

Crunu does not use the “zero-knowledge” label, because its server does see metadata: names of organizations, projects, environments and machines, email addresses, the audit log, and the size and time of each version. Saying so plainly lets you decide what belongs in a project name. The full list is on what the server sees, and the trade-offs are on the security limitations page.

The second question matters because client-side encryption is only as trustworthy as the client. Crunu's answer is signed releases, a reproducible web build and a local crunu.html file that checks the site against the signed release. See how encryption works.