Inside zero knowledge encryption

When a password is stored with a provider, who else can see it? Zero knowledge encryption is the security architecture designed to make sure the answer is: no one. 

End-to-end encryption forms the foundation of zero knowledge encryption, a security architecture that keeps sensitive data accessible only to the people who own it. As both personal and professional activities move online, zero-knowledge architectures protect business data and support compliance with privacy regulations.

Zero-knowledge encryption password management is one of the most practical steps organizations and individuals can take to strengthen their security. But how can users trust that a password manager keeps all of their secrets secret? The answer starts with zero-knowledge end-to-end encryption.

In a TechRadar piece, author Christian Rigg noted:

"Zero knowledge refers to policies and architecture that eliminate the possibility for a password manager to access one's password."

While this is a clear explanation for a broad audience, security professionals may interpret zero knowledge more precisely. At a technical level, zero knowledge encryption ensures privacy by enabling verification of information without ever exposing the underlying sensitive data. Not all password managers that claim zero knowledge meet this standard.

A secure zero-knowledge architecture begins with end-to-end encryption. Bitwarden Password Manager encrypts sensitive data the moment it enters any Bitwarden client — before it reaches a device, the Bitwarden cloud, or a self-hosted server. Vault data stays encrypted in transit and at rest, and only appears unencrypted during an authenticated session after the user provides an email address and master password.

Bitwarden is a zero-knowledge encryption solution, meaning: 

• the company cannot access user passwords

• all sensitive information remains encrypted end-to-end with the individual's email and master password

• Bitwarden never stores or has access to any master password

For vault data, Bitwarden uses AES 256-bit encryption, an industry-standard algorithm considered unbreakable. For master password derivation, Bitwarden supports PBKDF2 with SHA-256 and Argon2id to generate the key used to encrypt vault data. 

More detail is available in the Bitwarden security FAQ.

When users have exclusive access to the encryption key, they control access to the data, and the password management company has zero knowledge of it. This is the fundamental premise of zero-knowledge encryption: well-designed password managers facilitate strong and unique passwords that only the user can access, because the provider never holds the key.

There is information beyond the secret vault data that might be shared with a software or service provider. For example, an email address might serve as a unique customer identifier. One could argue that this isn’t zero-knowledge, and that would be correct.

At a minimum, zero knowledge must pertain to secret data. In the case of a password manager, this means that all information within the password vault must adhere to zero-knowledge encryption standards. At the same time, it is essential to acknowledge the realities of software, services, and users, recognizing that a commercial relationship requires some form of knowledge exchange between parties.

In the world of password managers, that line can get blurry. Some password managers (excluding Bitwarden) retain unencrypted URLs and websites for which they store passwords, thereby compromising zero-knowledge principles. While they claim that this benefits users, ultimately, it provides these companies with detailed information on which websites users visit, when they do so, and every login.

Bitwarden takes a more conservative view of what constitutes sensitive data and therefore encrypts all information in a user’s vault, including the websites they visit and the names of their individual items and folders, thereby maintaining true zero-knowledge encryption standards. 

Bitwarden uses the term zero-knowledge encryption because only users retain the keys to their vaults, and the vaults themselves are fully encrypted. Bitwarden cannot see a user’s passwords, websites, or any other information stored in their vault, thanks to its zero-knowledge architecture. Bitwarden also does not know a user's main password. If it gets lost, the Bitwarden team cannot recover it — a direct result of the zero-knowledge model.

Enterprise administrators need a way to recover access when employees lose credentials, without compromising the security model. Bitwarden offers account recovery (formerly admin password reset), which enables administrators and owners to reset passwords while remaining consistent with zero-knowledge encryption. More information is available in the account recovery documentation. 

Key control and encryption address data protection at the vault level. At the organizational level, zero trust adds another layer of defense.

The zero-trust model moves organizations beyond traditional perimeter-based security by addressing threats that originate both internally and externally, using technologies like identity and access management, encryption, multifactor authentication, and permissions — all of which work well alongside zero knowledge.

Zero trust and zero knowledge form complementary layers: zero trust verifies every access request, while zero knowledge encryption ensures that even the service provider cannot view the protected data.

Some element of trust always exists between a password manager and its users. The password management provider trusts that users will follow the terms of service; users trust the provider to deliver on its stated offering. Limiting those boundaries of required trust reduces the possibility that sensitive data is compromised.

Bitwarden supports its customers through a trusted relationship, and a company can reduce reliance on implied trust with the Bitwarden self-hosted offering, which features zero-knowledge encryption capabilities. This deployment enables businesses with greater flexibility and control over their infrastructure. Businesses that run their own Bitwarden instance can be on an air-gapped network, further reducing risks by being disconnected from the internet while maintaining zero-knowledge security.

Zero-knowledge encryption is evolving rapidly, with applications expanding well beyond password management. For password management, these advances point toward even stronger guarantees that sensitive data remains private without sacrificing usability or interoperability.

As research continues, zero-knowledge encryption will play an increasingly vital role in protecting user privacy, securing sensitive data, and enabling new forms of authentication and access control.

Making zero-knowledge encryption accessible to everyone is a core part of the Bitwarden mission. Plans are available for individuals and organizations looking to securely share information among users, teams, and enterprises with zero-knowledge protection. Explore which Bitwarden plan is right for you.

Webcast: Building a zero-knowledge architecture for password management with end-to-end encryption. Watch the replay.