An honest look at a term that's often used as a marketing word — and how finilog actually implements it.
Most online services encrypt data "in transit" between your device and their servers, and "at rest" on disk. That protects against someone eavesdropping along the way or a stolen hard drive — but the provider itself usually holds the key and could read your data if it wanted to, or had to.
Zero knowledge goes one step further: encryption happens exclusively on your device, with a key that never reaches the provider unencrypted. All that gets stored is technically meaningless to the provider — ciphertext. Even with full database access, a legal order, or a successful breach, there is nothing readable left for them to find.
If a provider can reset your password without you losing anything, it is not a zero-knowledge system. finilog cannot reset your vault password — that's the test, not the promise.
Your vault password is processed exclusively in your local browser. It is never transmitted to a server — not even in encrypted form.
Before any content leaves your device, it has already been encrypted. The server only ever sees the finished ciphertext, never the plaintext.
Even a complete database dump gives an attacker nothing but unreadable ciphertext — without your vault password, there's nothing to do with it.
A key is derived locally from your vault password using PBKDF2-SHA256 with one million iterations. That key encrypts every entry in your vault individually with AES-256-GCM before any network request is even made.
For the inheritance case and for a forgotten password, additional, independently encrypted copies of the same key exist — not an exception to the rule, but a second path to the same result, secured just as strictly on the client.
Encryption alone doesn't protect against every risk. See how we think about threat models, recovery mechanisms, and our roadmap as a whole.
See our security philosophy →The source code of our encryption is open to review, and the demo vault shows the principle without any registration.
View the demo vault