Zero-knowledge, in password-manager language, means the operator cannot decrypt your vault. Keys come from a secret you control (usually a master password) via a KDF; ciphertext is what leaves the device if sync is enabled.
What it protects
Support staff should not read item passwords. A stolen sync blob should not yield plaintext without your secret. AzAd Solutions designs AzAd Vault so Argon2id + AES-256-GCM run on device before optional Google Drive app-folder sync.
What it does not mean
It does not erase account metadata, entitlement records, or device-side malware risk. It does not let anyone recover a forgotten master password. Family Premium seats share billing � not vault contents. AzAd Vault has no multi-vault sharing mode as of September 2026.
Learn more
Read the zero-knowledge blog post, E2EE, and security.
Phrase origins and careful use
“Zero-knowledge” also names a formal proof technique in cryptography research. Marketing usage is looser. When AzAd Solutions says zero-knowledge vault, we mean client-side encryption such that we cannot read item secrets — not a claim about every metadata field in every subsystem. Prefer precise algorithm pages over absolute language.
Everyday checklist
Choose a long master passphrase. Verify the vendor names Argon2id (or equivalent) and AES-GCM (or equivalent). Confirm sync is optional and encrypted. Practice opening a backup. Use TOTP or passkeys so stolen passwords alone fail more often. Read AzAd Vault’s security page alongside the blog explainer.
If a salesperson claims they can reveal your password for you “in emergencies,” that is not a zero-knowledge vault — it is a custodial service with different trade-offs. Know which you are buying.
Practical takeaway
If the vendor can email you your vault password, it is not zero-knowledge. AzAd Solutions cannot. Protect the master password accordingly and keep encrypted backups you have tested once.