Zero-knowledge encryption in password managers, explained

What zero-knowledge means for a password manager, how your main password becomes the key, what the makers state, and what zero-knowledge does not protect.

Key points

Zero-knowledge means the maker stores your vault but cannot read it: the vault is encrypted on your device with a key made from your main password.
The same design is why the maker cannot reset a forgotten main password.
Zero-knowledge does not protect against malware on your own device, a weak main password, or data that is kept outside the encryption.

What zero-knowledge means

A password manager has to keep a copy of your vault on its servers to sync it between your devices. Zero-knowledge means the copy arrives there already encrypted, and the key never leaves your devices. The maker stores data it cannot read.

All four makers listed here say so in their own words:

	What the maker states
1Password	“Our dual-key model ensures that even we can’t see exactly what you’ve saved in 1Password.”
Bitwarden	“Bitwarden uses end-to-end encryption for all vault data, which only your master password can decrypt.”
Keeper	“Keeper is a zero-knowledge security provider.”
Proton Pass	“your data is never accessible to us and only you can decrypt it using your secret password.”

Bitwarden adds that data is “encrypted locally before being sent to the server for storage.”

How the main password becomes the key

The app does not use your main password as the key directly. It runs it through a key derivation function many times, so that every guess costs an attacker the same work:

	How the key is made, according to the maker
1Password	PBKDF2 with 650,000 rounds, plus a Secret Key that stays on your devices
Bitwarden	PBKDF2 with 600,000 rounds by default, Argon2id as an option
Keeper	PBKDF2 with 1,000,000 rounds
Proton Pass	bcrypt, number of rounds not stated

1Password’s Secret Key is a second, random secret that is combined with your main password. A stolen copy of the vault cannot be cracked by guessing the main password alone.

Why nobody can reset your main password

If the maker could reset your main password, it would hold a key to your vault, and the vault would no longer be zero-knowledge. That is why Bitwarden writes that it “has no way to access, retrieve, or reset your master password.” Each maker offers its own way back instead, such as 1Password’s Emergency Kit or a trusted emergency contact.

What zero-knowledge does not protect

Malware on your device: while the vault is unlocked on your computer, malware there can read what you read.
A weak main password: a stolen copy of the vault can be attacked offline, with no limit on guesses. The guide Is a password manager safe? shows this with the LastPass breach of 2022.
Data outside the encryption: at LastPass, the website addresses in the stolen backups were not encrypted. Your account’s email address and billing details are never part of the vault.

What you can do

Use a long main password that you use nowhere else.
Keep your recovery information in a safe place, because nobody can reset the main password for you.
Keep your devices free of malware with updates and an up-to-date system.
Lock the vault automatically after a few minutes without use. Look for the auto-lock setting in your manager.

Next step

The guide Passkeys and 2FA codes in your password manager shows what else the vault can hold.

The figures in this guide come from the archive and change with every data update. As of November 13, 2026.

Zero-knowledge encryption explained: why nobody can reset your password