ZeyroVault FAQ
Straightforward answers about how our free encryption tools work and how we protect your privacy.
What does zero-knowledge encryption mean?
Zero-knowledge means we never have access to your unencrypted data or your encryption keys. All encryption happens in your browser using AES-256-GCM before any output exists. Your 256-bit key is derived from your passphrase and never sent over the network. Nothing is uploaded, so a server breach cannot expose your plaintext or key; without the key, any AES-256-GCM ciphertext you keep is indistinguishable from random data. A brute-force attack against a 256-bit key would require checking 2^256 (about 1.1 × 10^77) possible combinations — far more than the number of seconds in the age of the universe.
Is AES-256 encryption actually secure?
Yes. AES-256 is standardized by NIST in FIPS 197 and approved for protecting U.S. government classified information up to TOP SECRET. The "256" refers to the key size in bits — there are 2^256 possible keys, about 1.1 × 10^77. Even a computer checking one trillion keys per second would need roughly 10^47 times the 13.8-billion-year age of the universe to work through them. We use AES in GCM mode (standardized in NIST SP 800-38D), which provides both confidentiality and integrity verification. No known quantum algorithm breaks AES-256. Grover's algorithm cuts the effective key strength to 128 bits, and those operations must run one after another, so it offers little practical speed-up.
Does any of my data go to your servers?
No. Your original plaintext, passphrase and encryption key never leave your device. Encryption happens locally via the Web Crypto API before any output exists. There is no storage feature and no server-side copy: the AES-256-GCM ciphertext stays on your device until you download, copy or share it yourself. Without the 256-bit key, it is indistinguishable from random data.
Do I need an account to use the tools?
No account needed — you can start encrypting in under 10 seconds. Visit the tools page, type or upload your data, and encrypt immediately. We believe privacy tools should be available without barriers: no signup, no email, no personal information collected. The encryption runs entirely in your browser, so there's nothing to log into — your device does all the work.
Can I use these tools without internet?
Yes. Once the page loads, you can disconnect from the internet and keep using the tools. All encryption operations use the Web Crypto API — a W3C standard built into every modern browser since 2014 — and run entirely on your processor. Nothing you type or upload is sent to us while you work. The encrypted output stays on your device until you download, copy or share it yourself. You only need internet to load the page initially.
What if I forget my encryption key?
We cannot recover your key — and we designed it that way. Keys are derived locally with PBKDF2 (RFC 8018 / PKCS #5) and 100,000 iterations of HMAC-SHA-256, and are never transmitted. If you lose your key, the AES-256-GCM encrypted data becomes permanently inaccessible to everyone, including us. This is a feature of zero-knowledge architecture, not a bug. With 2^256 possible keys, a computer checking one trillion keys per second would need about 10^47 times the age of the universe to find yours. We recommend storing keys in a password manager.
How do you make money if the tools are free?
This website (zeyrovault.com) is currently ad-free. We plan to display non-intrusive, clearly labeled advertisements (for example via EthicalAds) once the site reaches sufficient traffic, to cover hosting and development costs. The tools at tools.zeyrovault.com are — and will remain — completely ad-free. We do not sell data, charge for features, or require accounts. Your privacy isn't the product.
What makes this different from other encryption services?
Encryption happens on your device, not on our servers. Most services encrypt data on their servers using keys they manage — which means they could potentially access your plaintext. ZeyroVault encrypts using AES-256-GCM entirely on your device via the Web Crypto API before any data is transmitted. We never see your original content, your password, or your 256-bit encryption key. Even if compelled by a court order, we have no plaintext data or keys to hand over. This is a fundamental architectural difference, not a policy choice.
Which browsers work with the tools?
Any browser that supports the Web Crypto API — including Chrome, Firefox, Safari, Edge, Opera, and Brave, on desktop and mobile. The Web Crypto API is a W3C Recommendation, so it is a formal web standard tested across implementations. A browser that no longer receives security updates cannot run the tools.
Can I verify how the encryption works?
Yes. Our How It Works page documents the full encryption process in detail. We use only publicly reviewed standards: AES-256-GCM (NIST FIPS 197 + NIST SP 800-38D) for encryption and PBKDF2 (RFC 8018 / PKCS #5) with 100,000 iterations of HMAC-SHA-256 for key derivation. We do not use proprietary or custom algorithms. For technical verification, open your browser's developer tools (F12) and go to the Network tab — you will see that no readable data is transmitted during encryption. The entire process is client-side, and the Web Crypto calls can be inspected in your browser.
Ready to Try the Tools?
No account, no setup — just open and start encrypting.