Zero-knowledge in 2 minutes
A plain-language explanation of what zero-knowledge means in PulsVault — which data the server can read, which it cannot, and why that protects your secrets.
Most services protect your secrets by promising not to look at them. PulsVault is built so that it cannot look at them. That difference is what "zero-knowledge" means — and it applies to your secrets, not to every word you type (see the table below).
The one-sentence version#
Your passwords and other secret fields are encrypted and decrypted on your own device with keys that PulsVault never receives — so the server stores locked boxes it has no key to open. Item names and non-secret fields are not in the box: we can read those.
What the server can and can't see#
| The server can see | The server cannot see |
|---|---|
| That an item exists, its type, and when it changed | Passwords, PINs, keys, card numbers and every other field marked secret |
| Item names, tags and remarks | Your Notes — titles and contents |
| Fields not marked secret: usernames, emails, URLs, card-holder names… | The contents of file attachments |
| Vault and folder names | Your master password or Access Key |
| Verification hashes used for login | The keys that decrypt your vaults (UMK / DEK) |
| Who a vault is shared with | The secrets shared with them |
Four item types — Secure note, Medical record, Reward program and Document — have no secret field, so the server can read everything in them. Keep private text in Notes instead. The full list is in the zero-knowledge model.
Why it works#
When you sign in, your master password and Access Key are combined on your device to derive a key that unwraps your User Master Key (UMK). The UMK unwraps each vault's Data Encryption Key (DEK), and the DEK decrypts the fields of an item — all in your browser or app. The keys live in memory only for as long as your session is unlocked.
Open your browser's network inspector while using PulsVault. Secret fields leave your browser as encrypted envelopes and raw keys never leave it at all; an item's name and its non-secret fields travel as readable text inside the encrypted connection.
What this means for you#
- A server breach doesn't expose your secrets. Attackers get ciphertext without keys — though they would see item names and non-secret fields.
- Recovery is your responsibility. Because we can't see your keys, we can't reset them for you. That's what the Emergency Kit and Recovery Key are for.
- Sharing stays zero-knowledge. When you share, the vault key is re-wrapped for the recipient's keys — the server still never sees your secrets. See vault sharing.
Ready for the details? Read how encryption works.