Explainer
What zero-knowledge encryption actually means
It is a claim about what a company is capable of, not about what it intends. That is the whole distinction, and it is worth ten minutes of your attention because almost every privacy promise you will read reduces to it.
A promise you can break, and one you cannot
"We will not look at your files" is a policy. It is made by people, enforced by other people, and it can be changed by a new owner, a new executive, a new jurisdiction or a court order. Policies are not worthless, and most companies keep them, but they are the kind of promise that can be broken without anyone rewriting a line of code.
"We cannot look at your files" is a property of a system. It holds because the key that would open the data was never sent to the company. Nobody there can be persuaded, bribed, hacked or ordered into producing something they do not have.
Zero-knowledge encryption is the engineering that turns the first sentence into the second. Everything else on this page is detail.
How it is built
Your device generates a key. The key stays there. Content is encrypted with it before anything is transmitted, so what arrives at the server is ciphertext. The server stores the ciphertext and, typically, a copy of your key that has itself been encrypted with something only you can undo.
Sharing works by wrapping: a symmetric key encrypts the content once, and a copy of that symmetric key is encrypted separately for each recipient using their public key. The server holds several wrapped copies and can open none of them. This is how a shared space stays as encrypted as a private one, and it is the part most implementations get wrong or quietly skip.
On ImageTome that is an RSA-4096 keypair per person, generated in the browser and never transmitted, and an AES-256-GCM key per tome, wrapped once for each member.
The tell: features that require reading
You can identify a zero-knowledge service without reading a whitepaper, by noticing what it cannot do. It cannot search inside your files. It cannot make you a thumbnail. It cannot moderate what you upload. It cannot restore a file you deleted last week. It usually cannot reset your password.
A service offering all of those is not zero-knowledge, whatever its marketing page says, because every one of them requires the plaintext. This test is more reliable than any claim, because features are visible and architectures are not.
It also explains why zero-knowledge services feel more austere. The missing features are not neglect. They are the shape of the guarantee.
What it does not protect you from
Your own device. A key on an unlocked laptop is a key anyone holding that laptop has.
The people you share with. Encryption decides who can read, not what a reader does next.
Metadata. Sizes, timestamps and the existence of an account remain visible to the provider even when everything else is encrypted. Some providers encrypt filenames and folder structure; many do not.
The delivery of the code itself. In a browser-based service the encrypting code arrives from the provider's servers each time you load the page, so a compromised or coerced provider could serve modified code to a chosen user. This applies to every web-based encrypted service, ours included, and it is why watching your own network traffic is a better habit than trusting a badge.
Why the term is worth defending
Regulation keeps circling this exact point. The EU's CSA Regulation, widely known as Chat Control, has spent years working through proposals for client-side scanning: analysing content on your device before encryption is applied. The European Data Protection Board has objected repeatedly, warning that it breaks the security model of end-to-end encryption. The interim scanning regulation lapsed in April 2026 and was revived in July; the permanent regulation remains unresolved, with talks resuming in September 2026.
In the United Kingdom, the Investigatory Powers Act was used in January 2025 to serve Apple with a technical capability notice, and rather than build a backdoor Apple withdrew Advanced Data Protection from UK users entirely in February 2025. It filed a further challenge in August 2026.
Both cases make the same point from opposite directions. Encryption you control is durable. Encryption a company grants you is a feature, and features can be withdrawn.
See it applied
vs iCloud Photos
Apple's end-to-end encryption is opt-in, platform-locked and withdrawn in the UK. Ours is the only mode we have.
End-to-end encrypted storagevs MEGA
Both encrypt in the browser. The question a 2022 research paper asked of MEGA is the question you should ask of us too: what happens if the server turns hostile?
End-to-end encrypted storagevs Tresorit
Tresorit and ImageTome use the same primitives. Tresorit sells them to a compliance officer; we give them to a person who wants to share holiday photos.
Zero-knowledge encryption, asked and answered
An arrangement in which the service storing your data holds no key capable of decrypting it. Encryption and decryption happen on your device, the key never leaves it, and the provider stores ciphertext it cannot open. The provider knows nothing about the content, hence the name.
In practice the terms are used interchangeably for storage. End-to-end encryption describes content protected from sender to recipient; zero-knowledge describes the provider in the middle knowing nothing. A service can be end-to-end encrypted for private files and still fall out of it when you share, which is why the second term is a useful check on the first.
No. It removes one category of risk, that the provider can read your data, and leaves others intact: a compromised device, a member you shared with, and in browser-based services the code the server delivers. The 2022 ETH Zurich research on MEGA showed an end-to-end encrypted service whose design still did not defend against its own server.
On design, ImageTome, Proton Drive, Ente, Tresorit, MEGA, and iCloud Photos with Advanced Data Protection switched on, though Apple withdrew that feature in the United Kingdom in February 2025. Google Photos, Dropbox, OneDrive, WeTransfer and Imgur do not.
Because search, previews, transcoding, moderation, undelete and password reset all require reading your files. A provider that gives up the key gives up all of them, and most companies would rather have the features.
It changes what a request can produce. A provider can still be compelled to hand over what it holds, and it will. What it holds is ciphertext, with no key alongside it. Apple's withdrawal of Advanced Data Protection in the UK is the instructive case: the pressure fell on the feature rather than on the mathematics.
The version of this you can check yourself.
Sign up with a username, upload a photo, and read your own network tab.
Create an account