What "zero-knowledge" means for a photo app, and what to ask

Where the phrase comes from

In cryptography, a zero-knowledge proof is a way to show you know something without showing the thing itself. App makers borrowed the phrase for a looser idea: the company stores your data and can’t read it. That looser idea is useful. It just isn’t a standard with a test behind it, so each app can mean something a little different.

The useful version has one core: the company never holds the key that opens your files. Everything else on this page follows from that.

What it can’t read, if the claim is true

• The photos and videos themselves. They arrive already scrambled.
• File names and captions, if the app scrambles those too. Many apps forget. A name like “lease_signed.pdf” says a lot.
• Notes and text fields you keep next to the files.

If any of these reach the company in the clear, the claim covers less than it sounds. This guide has four questions that test who holds the key.

What it can still know

Zero-knowledge about content is not zero-knowledge about you. Depending on how the app is built, the company may still see:

A strong privacy story removes rows from this table, not just the content row. An app with no account, no server of its own and no analytics tools leaves far less to know.

Six questions to ask

1. Do I need an account? No account means no email or password on file to link to your vault.
2. Can you reset my password? If support can let you back in with an email, someone at the company has a way in too. See Forgot your photo vault password?
3. Are names and notes encrypted, or only the files?
4. Where does the backup go, and is it scrambled before it leaves the phone?
5. What does the privacy label list? The App Store label is the app’s own statement of what it collects.
6. Is the format written down? A published format lets others check the claim.

How Sealed answers them

Here is how Sealed answers the six, so you can judge for yourself.

1. Sealed has no account, so there is nothing to sign up for.
2. Because your key never reaches us, we cannot recover your vault or reset your passcode for you.
3. Names, notes and the fields of a record are sealed with your vault key too, not just the photos.
4. Backup goes to your own iCloud account, not to a server of ours. Files, names, notes and record fields are encrypted on your iPhone before they are uploaded, so iCloud receives only ciphertext.
5. Sealed contains no analytics or tracking SDKs, and it collects no data.
6. The formats are on the encryption specification page. Sealed encrypts every file with AES-256-GCM before it is saved.

Two companies, two answers

With Sealed there are two companies to ask. The first is us: We run no server, so there is nothing of yours for us to see. Sealed contains no analytics or tracking SDKs, and it collects no data. The second is Apple, because the backup sits in your own iCloud account. Apple says the data an app keeps in a user’s CloudKit private database is accessible only to that user by default, isn’t visible in the developer portal, and counts toward the user’s iCloud storage. Apple stores ciphertext, and it can still see the outline of it. In your iCloud backup, Apple can see each record’s type, a random record name, when the record was created and changed, the size of its files and how many records there are, but not what is in them.

That is what zero-knowledge looks like when it is honest: nothing readable, and a short, named list of what is still visible.

Where Sealed helps, and where it doesn’t

It helps because there is no server of ours holding your data. We run no server, so there is nothing of yours for us to see. Your vault key never reaches us.

It helps because there is no account to tie a vault to a name. Sealed has no account, so there is nothing to sign up for.

It doesn’t keep a way to let you back in if you lose your passcode and your recovery key. Because your key never reaches us, we cannot recover your vault or reset your passcode for you.

It doesn’t keep the outline of the backup from Apple: that it exists, how many records it has, their sizes and their dates. In your iCloud backup, Apple can see each record’s type, a random record name, when the record was created and changed, the size of its files and how many records there are, but not what is in them. Apple says the data an app keeps in a user’s CloudKit private database is accessible only to that user by default, isn’t visible in the developer portal, and counts toward the user’s iCloud storage.