What is zero-knowledge encryption in cloud storage?
The short answer
It means your files are encrypted on your device with keys only you hold, before they reach the provider. The provider cannot read your data, pass it on or scan it for advertising and AI training. It also cannot reset your password if you lose it. Sync.com, Proton Drive and Tresorit work this way by default. So do MEGA, Internxt and Filen.
In detail
All serious cloud providers encrypt your files. What sets them apart is who holds the keys. Google and Microsoft use standard server-side encryption by default, and so do Dropbox and Apple. The provider encrypts your data and keeps the keys. Its systems can then decrypt your files for indexing, scanning and legal requests. The same access powers features like search inside documents. That is not sinister in itself. It does mean the provider is able to read your files.
Zero-knowledge encryption moves the encryption to your device. It is also called end-to-end or client-side encryption. Files leave your computer already scrambled. The key comes from a password that never travels to the server. The provider stores data it cannot read. There is no content scanning and nothing useful to hand over on request. Some services also skip thumbnail previews on the server. Password recovery is not possible either. If you lose your password and your recovery keys, nobody can decrypt your data.
Some providers sit in between. pCloud and Icedrive offer client-side encryption as an add-on or a special folder. The rest of your storage stays standard. That works well as long as you remember which folder is which. Apple’s Advanced Data Protection makes most iCloud data end-to-end encrypted, but you have to switch it on. Anything you would not show a stranger belongs in a zero-knowledge service. Keep the password in a password manager and a printed recovery key in a drawer.