"Encrypted" gets used as a marketing word far more often than it gets explained as a technical claim. The single question that actually matters is: who holds the decryption key? If the answer is "the company," your data is encrypted but not private from that company. If the answer is "only you, derived from your own passcode," that's zero-knowledge encryption, and it's a fundamentally different guarantee.
Key Custody: The Detail Most Apps Don't Explain
- Custodial encryption: The service provider generates and stores the encryption keys on its own servers. It can technically decrypt your data on request, whether that request comes from a hacker who breaches their systems, an employee who misuses access, or a court order.
- Zero-knowledge encryption: The key is derived from something only you know — typically your passcode — and generated and used entirely on your device. The provider never has the key and mathematically cannot decrypt your data, even if compelled to.
Why This Distinction Determines Real Privacy
A cloud backup service can advertise "bank-level encryption" while still holding your keys, meaning your data is protected from outside attackers but not from the company itself, or from anyone with legal authority over that company. Zero-knowledge removes that middle layer entirely: there is no key to request, subpoena, or leak from a server, because the server never had it.
How This Applies to File Vault Apps
Stash is built on a zero-knowledge, zero-server model. Files are encrypted with AES-256 using a key derived from your vault passcode, entirely on your device. There is no account system, no server component, and no company database that could ever be breached, subpoenaed, or misused to access your files.
How to Check If an App You Use Is Zero-Knowledge
Read the privacy policy for specific language about where encryption keys are generated and stored. If an app requires an account and offers a "forgot password" recovery option that restores your data, that's a strong signal it is not zero-knowledge — a true zero-knowledge system cannot recover your data without your key, by design.
The Tradeoff Worth Understanding
Zero-knowledge encryption means if you forget your passcode, there is no company that can reset it and hand your files back to you — because they never had access to grant. That's the actual price of real privacy, and it's worth knowing before you rely on it.
Download Stash from the App Store