In one sentence: a zero-knowledge password manager encrypts your vault on your own device with a key derived from your master password, so the provider never holds a key that could read it.
Secure It Password Manager goes one step further. Secure It is a zero-knowledge password manager that stores your encrypted vault in your own Google Drive: no company servers, not even ours.
This page explains what the term means, what it does and doesn't protect you from, and how to check any vendor's claim. Facts about other products were checked on 19 Oct 2026.
Zero-knowledge in one paragraph
"Zero-knowledge" is shorthand for a design rule: the service stores your data but cannot read it. Your master password is run through a key-derivation function on your device. That produces the encryption key, and the vault is encrypted with it before anything is uploaded or saved. The provider receives ciphertext. It never receives your master password or the key.
Two consequences follow:
- If the provider's servers are breached, the attacker gets encrypted blobs, not readable passwords.
- If you forget your master password, the provider can't read your vault for you either. Recovery has to be designed in advance (see below).
The term is used loosely in marketing. Strictly, it describes where encryption happens and who holds the key, not whether the product is audited, open source or free of bugs.
What zero-knowledge protects against, and what it doesn't
It protects against:
- A provider-side breach. Stolen vault files are still encrypted. How long they stay safe depends on your master password and the key-derivation settings (more on that below).
- A curious or compelled provider. A company can't hand over plaintext it can't read.
- Insider access. Employees have no key to your vault.
It does not protect against:
- Malware on your device. If an attacker can read your screen, log your keystrokes or read memory while the vault is unlocked, encryption at rest doesn't help.
- A weak or reused master password. Anyone who steals an encrypted vault can guess offline, at their own speed. A long, unique passphrase is your real defence. NIST's guidance on memorised secrets (SP 800-63B) is a good reference for how to choose one.
- Phishing. You can still type a correct password into a fake site.
- Losing your master password with no recovery method. Zero-knowledge means the vendor can't rescue you.
The LastPass breach shows why the first point matters. In 2022 an attacker copied a backup of customer vault data from LastPass's cloud storage. Usernames, passwords, secure notes and form data were encrypted, but website URLs were stored unencrypted. LastPass's March 2023 update says the attacker took "backups of all customer vault data". On 11 December 2025 the UK Information Commissioner's Office fined LastPass UK Ltd £1.2 million over security failings in that incident, and found no evidence that customer passwords were decrypted.
Zero-knowledge limited the damage. But a central store holding every customer's vault is still a target. That is the design choice we avoided.
Where the encrypted vault lives
Almost every reputable manager encrypts on the device. The difference is where the encrypted file ends up. There are three models:
| Model | Examples | Where the encrypted vault lives | Source |
|---|---|---|---|
| Vendor cloud | Bitwarden | Bitwarden's cloud, in a US or EU region (an account exists only in the region where it was created). Self-hosting needs your own server. | Bitwarden, self-host docs |
| Vendor cloud | 1Password | Hosted by 1Password in the region chosen at sign-up (US, Canada or EU). | 1Password |
| Vendor cloud | Dashlane | AWS (Ireland, Germany) is the only subprocessor named for storage and processing of encrypted data. | Dashlane |
| Vendor cloud | NordPass | Encrypted on the device, then stored on NordPass's servers (secondary source). | security.org |
| Local file | KeePass, KeePassXC | A database file you manage. KeePassXC has no built-in cloud sync; its docs say to put the file in a cloud folder and let that service sync it. | KeePassXC |
| Your own Drive | Secure It Password Manager | A single encrypted file, vault.enc, in your own Google Drive. No company servers. |
Security |
Checked 19 Oct 2026.
None of the vendor-cloud options is "not zero-knowledge". They are all designed so the vendor can't read your vault. The difference is that their servers hold one copy of everyone's vaults, and ours don't exist. A breach of Secure It's company can't expose vaults, because we never hold them.
KeePass avoids vendor servers too, but sync is left to you. Secure It does the Drive part inside the app, with first-party Android, Windows and Chrome versions.
How Secure It does it
The pipeline is short, and each step uses a named, standard primitive:
- Key derivation. Your master password goes through Argon2id (via libsodium) on your device. Argon2id is the primary variant defined in RFC 9106, and OWASP's Password Storage Cheat Sheet recommends it as the first choice, with a minimum of 19 MiB of memory, 2 iterations and 1 degree of parallelism.
- Encryption. The vault is encrypted with AES-256-GCM on the device.
- Storage. The encrypted file is saved locally. If you turn on sync, it's stored as
vault.encin your Google Drive, using Google's narrowdrive.filescope. - Unlock. You unlock with your master password (or fingerprint on a device you've already set up).
Two details matter for trust:
- No account is needed for one device. You can create and use a vault fully offline. A Google account is needed only to sync the same vault across devices (Android, Windows, the browser extension).
- Google holds a file it can't read. Drive stores an encrypted file. The key is derived from your master password, which we never see.
The Security page has the full model, and Secure It at a glance is a dated summary of the facts.
Recovery without the vendor
Zero-knowledge makes recovery your responsibility, so it has to be easy to do right. Most vendors say plainly that they can't help:
- Bitwarden states it "has no way to access, retrieve, or reset your master password". Without another unlocked device, emergency access or another listed option, the account must be deleted and recreated.
- Dashlane says that if you lose your Master Password and have no recovery method set up, it cannot help you regain access. Its recovery key is a single-use spare that must be created in advance.
- Google Password Manager's on-device encryption works the same way: if you lose all recovery options and every signed-in device, you lose your saved passwords.
Secure It gives every user a 12-word recovery phrase (the BIP-39 word-list format) and an Emergency Kit PDF that includes an offline recovery script. Both live with you, not with us. You can recover your vault without us existing.
Keep the phrase offline and private. Anyone who has it and your vault file can get in.
What Secure It has not done yet
You should know these before you decide:
- No independent security audit yet. We use named, standard algorithms and publish how the vault works, but no third party has audited the app. Bitwarden and 1Password, for example, publish independent audit results.
- Several devices need a Google account. Sync goes through your own Drive. Without it, the vault stays on one device.
- No iOS app yet. It's coming soon to the App Store; we have no date.
- A small, independent developer. We're not a large security company.
How to check any "zero-knowledge" claim
Use this checklist on any password manager, ours included:
- Named algorithms. Does the vendor say which key-derivation function and cipher it uses (for example Argon2id and AES-256-GCM), rather than "military-grade"?
- Encryption on the device. Does the vault get encrypted before it is sent anywhere, and does the vendor say so in its documentation?
- Published audits. Is there an independent audit you can read, with a date and a scope? If not, treat the claim as unverified.
- An honest recovery model. Does it say what happens if you forget your master password? A vendor that can reset it for you doesn't have a zero-knowledge design for that account.
- What the vendor still sees. LastPass's 2022 incident showed website URLs stored unencrypted. Ask what metadata is visible.
Is Google Password Manager zero-knowledge?
Not by default. On-device encryption is something you set up yourself in settings, and Google says that "over time, this security measure will be set up for everyone". As of 19 Oct 2026 it can't be removed once enabled. Secure It always encrypts the vault on the device, so it is zero-knowledge from the first launch. See pricing and downloads for how to get it.