← Back to blog

Explainer

What "zero-knowledge" really means (and why it matters for you)

Published 21 July 2026 · 8 min read · by the Celestial Security Team

"Zero-knowledge" has become one of the most over-used phrases in security marketing. It sounds reassuring, but very few people can say what it actually guarantees. This article fixes that — no maths degree required.

The one-sentence version

Zero-knowledge means the service protecting your data cannot read it, because the keys never leave your device.

That's it. Everything else is detail. But the details are where most "secure" products quietly fall short.

A useful analogy

Imagine renting a safety-deposit box. In a traditional setup, the bank keeps a master key "for your convenience". If the bank is robbed, coerced, or careless, your valuables are exposed — regardless of how strong the box is.

Zero-knowledge is a box where only you have a key, and the bank physically cannot make a copy. They store the box, they guard the vault room, but they can never open what's inside. If someone breaks in, they find a sealed metal cube and nothing else.

How it works in practice

When you unlock Celestial, your master password is transformed on your device into an encryption key using a slow, deliberately expensive process (PBKDF2 with 250,000 iterations). That key encrypts every item with AES-256-GCM before anything is synced.

• Your master password is never sent to our servers.
• We only ever receive ciphertext — random-looking bytes.
• Decryption happens locally, only while your vault is unlocked.
• Lock the vault, and the key is wiped from memory instantly.

The questions to ask any provider

1. Is my master password ever transmitted? It should never be — not even hashed.
2. Can you reset my password for me? If yes, it isn't truly zero-knowledge; someone can access your data.
3. Where is encryption performed? The answer must be "on your device", not "on our servers".
4. Has the cryptography been independently audited? Trust, but verify.
5. Where is my data stored? Jurisdiction determines who can compel access.

The trade-off you should understand

True zero-knowledge has one honest cost: if you forget your master password and lose your recovery key, nobody can recover your data — not even us. That's not a bug; it's the entire point. Celestial mitigates this with a one-time 28-character recovery key and optional emergency access to trusted contacts, so you stay in control without ever handing us a backdoor.

See it for yourself

You don't have to take our word for it. Our Open Vault page runs the same PBKDF2 + AES-GCM pipeline described here, entirely in your browser. Open your developer tools and watch: nothing sensitive ever crosses the network.