"Zero-knowledge" is one of the most overused terms in security marketing. Some companies use it loosely to mean "we take privacy seriously." Used correctly, though, it describes a specific technical architecture — and it's worth knowing the difference before trusting a service with your passwords.
In a genuine zero-knowledge password manager, all encryption and decryption happens locally on your device before anything is sent to the server. Your master password itself is never transmitted or stored — instead, it's used locally to derive an encryption key that encrypts your vault. The server only ever receives and stores the already-encrypted blob. This means that even if the server were fully compromised, or if the company itself wanted to look, the actual contents of your vault are unreadable without your master password, which never left your device.
Zero-knowledge encryption protects the contents of your vault — your saved logins, notes, and card details. It typically does not extend to account metadata: the operator can usually still see your account email address, login timestamps, and the IP address you connected from, since that data is needed to run the service at all. Any provider claiming "we know absolutely nothing about you" while still offering account recovery or login history is worth a closer look.
A password manager is a single point of failure by design — it's where all your credentials live in one place. That concentration of risk is exactly why the zero-knowledge architecture matters here more than for, say, a note-taking app. If the vault provider is compromised, breached, or served a legal order, a genuine zero-knowledge design means there's nothing readable to hand over.
Bitwarden's open-source clients and Vaultwarden (the self-hosted, compatible server implementation) both follow this model: encryption and decryption happen in the app on your device, and the server — whether Bitwarden's own cloud or a self-hosted Vaultwarden instance — only ever stores encrypted data it can't read.