Sealby
Files are encrypted on your device
Photos, videos, notes and documents are encrypted individually, with keys protected by Apple hardware security.
See how Sealby protects your filesEncryption
Zero-knowledge encryption, explained.
"Zero-knowledge cloud storage" is the most reassuring phrase in privacy marketing — and it means something specific and narrower than it sounds. Here's what it protects, what it doesn't, and what's stronger.
Encryption for private files
Device encryption
Protects a locked phone
Excellent baseline protection, but apps can read their own data after the device is unlocked.
End-to-end encrypted cloud
Useful for private remote storage
The provider cannot normally read file contents, though account and recovery design still matter.
Password-protected files
Depends on the format and password
A strong modern format can work well; a weak password or old format can undo the encryption.
The spectrum of who can read your data
Every storage product sits somewhere on one line: who, besides you, could read this? At one end sits ordinary cloud storage — encrypted "in transit and at rest", but with keys held by the provider, so the provider (and anyone who compels or compromises it) can read everything. In the middle sits zero-knowledge: your device encrypts before upload, the provider stores ciphertext it cannot open. At the far end sits local-first: the data never becomes a provider's copy at all.
What zero-knowledge actually promises
In a zero-knowledge design, your password never leaves your device; keys are derived locally, content is encrypted client-side, and the server sees only ciphertext. Done honestly, this is a real and meaningful guarantee: a breach of the provider leaks gibberish, and the provider cannot be forced to produce plaintext it cannot make.
But notice what survives: the provider still knows you — your account, your email, your payment trail — and still knows that you store data, roughly how much, and when it changes. Ciphertext plus identity is not nothing; it is a map of where the secrets are, with your name on it.
The recovery-path test
One question cuts through most marketing: "What happens if I forget my password?" If the answer is "we can help you get back in", then a path to your data exists that doesn't run through you — and whatever that path is, it can be used, breached, or compelled. If the answer is "we can't help; only your recovery phrase can", you're looking at the real thing. Inconvenient answers are how you recognise honest cryptography.
One step further: no provider at all
Sealby's answer to "what can the provider see?" is structural: there is no provider in the loop. No account identifies you, no server stores your ciphertext, and encryption happens on your iPhone with keys in the Secure Enclave. If you enable backup, the blob goes to your iCloud — still unreadable to Apple and to us. Each vault has its own recovery phrase, and losing it means no one can help — which is precisely the property everything else here has been circling.
Quick answers
What does zero-knowledge encryption mean?
It means the service provider stores your data but cannot read it: encryption and decryption happen on your device, and the provider never holds your keys. The provider has "zero knowledge" of your content — though it typically still knows who you are and that the data exists.
Is zero-knowledge encryption safe?
The cryptography is sound when implemented well. The residual risks are around it: the provider still holds your (encrypted) data and account metadata, the client software must be honest, and account recovery paths can quietly reintroduce access. Evaluate those, not just the cipher name.
What is stronger than zero-knowledge?
No knowledge at all: a local-first design with no account and no provider copy. Sealby encrypts on-device and has no server — there is no company that knows you store anything, holds ciphertext, or could be compelled to hand anything over.
What is zero-knowledge cloud storage?
Cloud storage where your files are encrypted on your device before upload and the provider never holds the keys — so it stores your data but cannot read it. Several mainstream providers market this model. It protects the content of your files; it does not hide that you have an account, how much you store, or when it changes. And if a forgotten password can be reset without your recovery phrase, someone other than you can reach the keys.
Your vault is waiting.
Download Sealby and protect what matters. Setup takes under a minute, and there’s no account to create.
Download on the App Store
iPhone & iPad · iOS 17+ · Free