Zero-Knowledge Architecture: We Can Never See Your Data

Note: This article was written under the v1 architecture. Under the current v2 architecture, we are more precise: KeyMe Pass provides end-to-end encryption with server-side ignorance of the master password (Bitwarden-class), rather than a strict zero-knowledge protocol such as SRP or OPAQUE. The practical guarantees described here — server cannot decrypt your data, master password is never sent — still hold. See KeyMe Pass v2 Key Architecture for the current design and honest limits.

What is Zero-Knowledge Architecture?

Zero-Knowledge Architecture is a security design principle that ensures the service provider (us) cannot access or view any user data, even if the data is stored on our servers.

KeyMe Pass's Zero-Knowledge Promise

We promise you:

✅ We can never access your master password (PIN)
✅ We can never decrypt your stored data
✅ Even with sync enabled, we can never view any plaintext
✅ Your data is completely under your control

Technical Implementation

1. Encryption Completed Locally on Device

All data is encrypted before it leaves your device. This means:

The encryption key (DEK) is only stored on your device
The server can only see encrypted data
Even if we wanted to view it, we couldn't decrypt it

2. Key Derivation is Irreversible

Your PIN is used to derive the encryption key through a Key Derivation Function (KDF):

We cannot reverse-engineer your PIN from the encryption key
Even if we obtained the encryption key, we couldn't know the original PIN
This is a one-way function, mathematically irreversible

3. Server Only Acts as Storage

Our servers are only responsible for:

Storing encrypted data
Providing data transmission services
Not participating in any encryption/decryption process

Why Does This Matter?

Zero-knowledge architecture protects you from multiple threats:

Server Attacks: Even if attackers gain access to server data, they cannot decrypt it
Insider Access: Our employees cannot view your data
Legal Requests: Even if law enforcement requires it, we cannot provide plaintext data
Data Breaches: Even if a data breach occurs, your data remains encrypted

Your Privacy, Your Control

At KeyMe Pass, we believe:

Your data belongs to you, and only you should be able to access it. We simply provide a secure storage and sync service, but we should never, and can never, see your data.

Conclusion

Zero-knowledge architecture is not a marketing slogan, but a core design principle of KeyMe Pass. We ensure through technical means that we can never access your data—this is our highest commitment to your privacy.

For the concrete mechanisms behind "we cannot see your data", see the security page.