You will see "zero-knowledge" on almost every password manager website. It is a useful idea, but it is worth knowing exactly what it promises and what it does not. This page explains it without jargon, and shows what NettForge actually does.
What zero-knowledge means
A zero-knowledge password manager is built so the company running it cannot read your passwords, even if it wanted to, and even if a court or a criminal asked. Your vault is locked on your device with a key that only you can make, from your master password. Only the locked result is sent to the company's servers.
The opposite design is a service that stores your passwords in a form it can read (or can unlock with its own key). That is easier to build, and it is why a server breach at such a company can expose everyone's vault.
How it works in five steps
- You choose a master password. It is never sent to us and never saved to disk.
- Your device turns it into a key. NettForge uses Argon2id, a deliberately slow, memory-hungry method (64 MiB, 3 passes, 4 lanes) over a random salt. That makes guessing a password very expensive for an attacker.
- Each item is locked on its own. Every login, card or note is encrypted with AES-256-GCM and a fresh random value, on your device.
- Only locked boxes leave. Syncing sends the locked boxes. Signing in uses a separate one-way proof made from your key, which cannot open anything.
- Unlocking happens in memory. The key exists only while the vault is unlocked, and is dropped when you lock or close the app.
What our servers can and cannot see
| Can NettForge see it? | |
|---|---|
| Your master password | No. It never leaves your device. |
| Your encryption key | No. It is made on your device and kept in memory. |
| Item names, usernames, passwords, website addresses, notes, 2FA secrets | No. They are inside the locked box. |
| That an item exists, what kind it is (for example a login or a card) and when it last changed | Yes. It is needed to keep your devices in sync. |
| Your email address and your plan | Yes. We need them to run your account and billing. |
We think you should know both columns. Nothing here is hidden in the small print: it is the same design our security page describes.
What happens if a server is breached
An attacker who got into our servers would find locked boxes and sign-in proofs that cannot open them. There are no keys on our side to steal, sell or hand over. They could try to guess a master password against a stolen box, which is why Argon2id is slow on purpose and why a long, unique master password matters.
What zero-knowledge does not protect you from
- Malware on your own device. If something is watching your screen or keyboard while the vault is unlocked, encryption cannot help.
- A weak or reused master password. The strength of your master password is the lock on everything. Use a long passphrase. See how to make a strong password.
- Phishing. A fake website can ask you to type your password. NettForge's extension only offers a login on the website it was saved for, and warns about lookalike sites.
- Forgetting your master password. There is no reset, by design. Keep your Recovery Kit and an encrypted backup somewhere safe.
How to judge any password manager's claim
Do not take the words "zero-knowledge" on trust. Look for: the exact key-derivation method and settings, the encryption used and whether each item gets a fresh random value, whether the company explains what it can still see, how it handles sharing and recovery, and whether independent reviews exist. Ask hard questions, and ask us: we would rather you check. When you are ready to compare, see how NettForge compares.
Questions people ask
They are close relatives. End-to-end encryption describes how data travels so only the two ends can read it. Zero-knowledge describes what the service provider can and cannot know. A zero-knowledge password manager encrypts everything on your device first, so the provider only ever stores data it cannot read.
No, and that is the point. We never receive your master password or the key made from it, so we have nothing to recover it from. That is why we give you a Recovery Kit at sign-up. Read what to do if you forget your master password.
No. It means a breach of the provider's servers does not expose your passwords. It does not protect you from malware on your own device, a weak master password or a phishing page that tricks you into typing it. The Security score and the extension's lookalike warning exist for those cases.