What is zero-knowledge encryption - and how is it different from end-to-end?
Zero-knowledge encryption means your cloud provider never holds your decryption keys. Files are locked on your device before upload. The server stores only a scrambled, unreadable copy. End-to-end (E2E) only protects data while it moves. Zero-knowledge also protects against the server itself. Even when forced by law, the provider cannot read your files. In 2026, only 3 of the 12 providers we compare deliver both by default.
Want to know how exposed your current setup is? Take our free privacy score quiz. Answer a few questions on your cloud and habits, and you get a score plus clear fixes.
The essentials
Want to know what's really behind the "end-to-end encrypted" and "zero-knowledge" cloud promises of 2026? Here's what to remember. The two terms are not the same thing. E2E protects data while it moves. Zero-knowledge also protects the server against itself. A service can be E2E but not zero-knowledge. That is the case for most consumer providers, which lock files at rest with their own keys.
Of the 12 providers we compare, only 3 reach true E2E + zero-knowledge with no strings attached: Proton Drive (Switzerland, OpenPGP, outside Securitum audit), Tresorit (outside audits, ISO 27001), and Nextcloud self-host with the E2E module on. Two more get there, but with a clear catch. pCloud Crypto needs a paid add-on. MEGA relies on JavaScript sent fresh each time, and researchers question how safe that is.
The rest - Dropbox, Google Drive, OneDrive, iCloud - are E2E in transit (TLS) and AES-256 at rest, but the keys live on the server. Under legal pressure (US CLOUD Act vs GDPR, an EU court request), these providers can and must hand over your data in the clear. That legal risk is what pushes sensitive users toward Switzerland. See our Proton Drive vs Tresorit vs pCloud Crypto comparison for the three providers outside 14 Eyes.
Why did "end-to-end" become a marketing term rather than a technical one?
When Apple writes "end-to-end encrypted" about iMessage, it is true to the math. Only the sender and the receiver hold keys, and Apple cannot read the messages. But when Microsoft writes "your data is encrypted end-to-end" about OneDrive Personal Vault, the meaning shifts. Data in transit is locked, and so is the content at rest. Yet Microsoft holds the decryption keys to help recover your account if you lose your password. Same words, opposite trust models.
This blur suits services that want to look private while keeping the power to read your data when needed (account recovery, search, legal requests). The term zero-knowledge came up in response. It marks services where the provider, by design, simply cannot read your data, even if it wanted to.
What technical whitepapers say
To tell marketing from real tech, the only solid sign is the whitepaper. Proton publishes its own (the 2014, 2018, and 2023 versions). It shows how the key is built from your password via Argon2id. Tresorit does the same. Dropbox, by contrast, publishes an "encryption white paper" that covers AES-256 at rest but skips how keys are handled. The reason is simple: the keys live on the server.
When a whitepaper dodges the "key management" part, it is usually because the model does not hold up to a close look.
Who sees what on your cloud - the real matrix
| Actor | Standard cloud (Dropbox, GDrive, iCloud) | pCloud Crypto / MEGA | Proton Drive / Tresorit / Nextcloud E2E |
|---|---|---|---|
| Provider (internal employee) | Content readable with internal privilege | No (Crypto folder only for pCloud) | No |
| Provider (legal request) | Must decrypt if required | Not technically possible | Not technically possible |
| Attacker breaching server | Reads files decrypted in memory | Blocked (Crypto only for pCloud) | Blocked |
| You (compromised client device) | Reads everything | Reads Crypto folder + accesses key | Reads everything |
| Metadata (name, size, date) | Visible server | Name encrypted, size visible | Everything encrypted except size (Proton) |
This matrix makes the choice concrete. Say you store tax, medical, or legal documents that must stay private even if a court asks the provider for them. Then only the right column will do. Say you store family photos with no legal stakes. Then the middle column is enough, though pCloud means paying for the Crypto add-on. For the wider picture of the laws behind these demands, see our 5/9/14 Eyes and cloud storage overview.
What are the most common zero-knowledge marketing pitfalls to avoid?
Pitfall 1: password recovery available
With real zero-knowledge, forgetting your password means losing your data. Some providers offer a recovery path without first storing a recovery key on your device (one you printed and they never saw). When that happens, the keys live on the server and the zero-knowledge label is misleading.
Apple iCloud Advanced Data Protection is a good counter-example. At setup, Apple makes you register either a recovery contact or a paper recovery key (28 characters). This key never reaches Apple. If you lose both the password and the key, Apple can do nothing. That is the real-world sign of true zero-knowledge.
Pitfall 2: server-side search indexing
Say a service offers full-text search across your files from the web app (as Dropbox and Google Drive do). That cannot work with zero-knowledge, because the server has to read your content to index it. Proton Drive and Tresorit choose to limit their search to filenames.
Pitfall 3: client-side encryption via server-delivered JavaScript
MEGA and many "zero-knowledge" web services rely on JavaScript that the server sends fresh each session. If the server is hacked or forced by law, it can send slightly changed JS that steals your password before the file is locked, without you ever seeing it. Mathias Bynens described this risk back in 2013, and it still holds in 2026.
How to lower the risk: use native apps (desktop, mobile) instead of the web. Or use web apps with Subresource Integrity checked on the key JS bundles, which is rare.
Pitfall 4: unencrypted metadata
Even the best zero-knowledge services let some metadata through:
- File sizes (used for billing)
- Creation and change timestamps
- How often you log in (used for caching)
- Your IP address (logged for security)
For very sensitive cases (a whistleblower, a journalist protecting a source), this leftover data may be enough to tie your activity to an event. How to lower the risk: pair a private cloud with a VPN and odd login hours. Or lock the file yourself first, then upload it to a non-zero-knowledge cloud under a meaningless filename (the "blob storage" model).
How to verify in 5 minutes that a service is really zero-knowledge
You don't need to read a 40-page whitepaper. Here's the quick check:
- Search "whitepaper" + provider name on Google. If there's no public whitepaper, that's a strong bad sign.
- Search "audit" + provider name. True zero-knowledge needs a recent (2 years or less) outside audit by a known firm (Cure53, SEC Consult, NCC Group, Trail of Bits).
- Read the password recovery steps. If recovery works without a prior recovery key, it's not zero-knowledge.
- Check if the client code is open-source or audited. Without that, you trust the app blindly.
- Read the metadata docs. The provider must list what the server can still read. What stays in the clear is what you give up.
If even one of these 5 points is missing, the service is marketing zero-knowledge, not the real thing. That does not make it bad. Dropbox is still a great work tool. But it should not be your pick for data that must stay private against a state actor or a server leak.
Our practical verdict for 2026
For most consumer users, a smart middle path is to split your usage. Use standard services (Google Drive, Dropbox) for everyday files whose leak would not matter. Use a true zero-knowledge service for sensitive documents (Proton Drive by default, or pCloud Crypto if you prefer the lifetime deal). Before you pick, work out the 5-year total cost of each option with our cloud storage cost calculator. This split works better than moving everything at once.
For high-risk profiles (journalists, lawyers, doctors, activists), only Proton Drive, Tresorit, or Nextcloud self-host with the E2E module hold up. And even then, the cloud is just one link. Your device security, your VPN, and keeping your public identity apart from your protected identity matter just as much.
The real value of Priviy here is not to sell you one service. It is to give you the tools to tell marketing spin from real cryptographic guarantees. By that measure, in 2026, marketing has sadly won in 75% of cases. Users buy "privacy" and get "encryption at rest".
For a short guide to all the technical terms in this article (zero-knowledge, E2EE, AES-256, metadata, convergent encryption, KDF, PFS, and more), see our encrypted cloud & privacy glossary.
Read next
- pCloud review 2026 - 8-month test, lifetime deal and Crypto add-on
- Best encrypted cloud storage services 2026 - six-criteria provider ranking - which services are cryptographically zero-knowledge vs marketing zero-knowledge
- Proton Drive vs Tresorit vs pCloud Crypto - the 2026 Swiss showdown
- 5/9/14 Eyes and cloud storage - which jurisdictions to avoid
- US CLOUD Act vs GDPR - what really happens under legal pressure
- Our cloud privacy methodology
- Priviy Wikidata Q140050544
- Academic reference: EFF Surveillance Self-Defense (
https://ssd.eff.org/) - RFC 8446 (TLS 1.3):
https://datatracker.ietf.org/doc/html/rfc8446
Article published June 4, 2026. Methodology: editorial comparison of 12 cloud storage providers (Proton Drive, Tresorit, pCloud, Sync.com, MEGA, Internxt, Cryptee, Filen, Icedrive, NordLocker, SpiderOak, Nextcloud self-host). Sources: vendors' public whitepapers, published independent audits, official documentation of password recovery procedures, full-text search behaviour and the way client-side JavaScript is delivered.
Related guides
To dig deeper, see how client-side encryption works, how zero-knowledge handles cloud metadata, the most secure messaging apps, what metadata is and what zero-knowledge encryption is.
Frequently asked questions
- What is zero-knowledge encryption in cloud storage?
- Zero-knowledge encryption means the cloud provider never holds your decryption keys. Files are locked on your device before upload. The key comes from your password, and the server stores only the scrambled file. Even under a court order, the provider cannot read your data. In 2026, only Proton Drive, Tresorit, and Nextcloud self-host with the E2E module do this by default, on all files, at no extra cost.
- What's the difference between E2E and zero-knowledge?
- End-to-end (E2E) means data is locked from the sender's device to the recipient's device. No middleman (ISP, host) can read it. Zero-knowledge goes further: the server never holds keys in the clear. So even the provider cannot read your data, even when forced by law. A service can be E2E but not zero-knowledge if the keys live on the server. A zero-knowledge service, by contrast, is always E2E for the content it protects.
- Is pCloud truly zero-knowledge?
- Standard pCloud is NOT zero-knowledge. Your files are AES-256 encrypted at rest, but pCloud manages the keys. True zero-knowledge needs the pCloud Crypto add-on ($49.99/year or $125 lifetime). It locks files on your device with a key from your password, so pCloud cannot read them even under a warrant. If you lose this password, the files are gone for good.
- Is Proton Drive zero-knowledge by default?
- Yes. All data on Proton Drive is locked on your device with OpenPGP before upload. Proton sees neither content nor filenames, which are encrypted on their own. The method is described in their public whitepaper and was checked by an outside auditor (Securitum). The only data left in the clear: file sizes and technical timestamps.
- Which cloud providers are truly E2E + zero-knowledge?
- We compare 12 providers (pCloud, Proton Drive, Tresorit, Sync.com, MEGA, Internxt, Cryptee, Filen, Icedrive, NordLocker, SpiderOak, Nextcloud self-host). Only 3 are E2E + zero-knowledge by default with no extra fee: Proton Drive, Tresorit, and Nextcloud self-host with the E2E module on. pCloud Crypto and MEGA reach this level, but with a catch: pCloud needs a paid add-on, and MEGA's JS code gets little review.
- Does zero-knowledge protect against everything?
- No. Zero-knowledge guards against the provider reading your files, server attackers, and legal demands. But it does NOT guard against: (1) a hacked device (keylogger, malware), (2) a lost password (no way to recover), (3) data left in the clear (size, timing, how often you log in), (4) JS attacks if the web app code is tampered with. It is needed, but not enough on its own.
- How can I verify a service is truly zero-knowledge?
- Five signs to check: (1) a public whitepaper that spells out how keys are handled; (2) a recent outside audit (Cure53, SEC Consult, NCC Group, Trail of Bits); (3) open-source or reviewable client code; (4) a documented password recovery that is shown to be impossible (= a good sign); (5) a clear list of what data stays in the clear. If even one of these 5 points is missing, the service sells marketing zero-knowledge, not the real kind.
Store your files privately → pCloud
Swiss privacy · 10 GB free · optional zero-knowledge Crypto
