What Is a Zero-Knowledge Password Manager?

A zero-knowledge password manager encrypts your vault on your device before anything is sent to a server. The server stores ciphertext. It never receives your master password or the key that decrypts your entries, so it cannot read them.

That definition is short. Checking it for a real product takes three questions.

1. Where does encryption happen? On the device, before sync. If the server decrypts anything to process a request, such as a search, an import or a password check, the claim does not hold for that feature.

2. What can the server still see? Encryption hides the content of your entries, not everything. A provider usually sees account identifiers, timestamps, the size of the vault and the devices that sync. Zero-knowledge is about content, not about anonymity.

3. How is the account recovered? This is where many managers fall short. If the provider can reset your master password by email or through support, it has a path to your data. Recovery has to be designed so that the provider cannot use it alone.

How VaultKeepR applies the model

• Client-side encryption with XChaCha20-Poly1305. The key is derived from your master password with Argon2id.
• No email required. The account identity is derived from the master password and a Secret Key with Argon2id. We do not ask for an email address or a phone number.
• Separate storage layer. Encryption and storage are two different layers. The vault is designed for decentralised storage on IPFS.
• Recovery by threshold. Recovery uses Shamir Secret Sharing with a default threshold of 3 shares out of 5. No single holder can reconstruct the key. The design is explained in Shamir secret sharing in a password manager.

What zero-knowledge does not solve

Zero-knowledge protects the content of your vault from the provider. It does not protect you from:

• a compromised device, where malware can read the vault while it is unlocked;
• a weak master password, since the encryption is only as strong as the secret that derives the key;
• losing every recovery path. Without recovery material, a lost master password means a lost vault.

How to check a claim before you trust it

• Read the description of the protocol, not only the marketing line.
• Check whether the cryptography can be reviewed. VaultKeepR publishes its cryptographic core (SDK and smart contracts) under the MIT license. The web, browser extension and mobile apps are in a private repository, so they cannot be audited from the outside in full.
• Ask how a lost master password is recovered, and what the provider can do on its own.

Zero-knowledge is a property you can test. It is not a badge.