What does KeyNesta sync actually upload?
Sync & devices · Help center · Current as of 2026-10-10
Short answer
Ciphertext, and nothing else. Your vault is encrypted on your device with AES-256-GCM under a key derived from your passphrase before anything is uploaded. The server stores an opaque blob it has no key for, so it cannot read your issuers, account names or secrets.
Where the encryption happens
On your device, before the upload. The passphrase never leaves it, and no key derived from the passphrase is ever transmitted. That is what "zero-knowledge" means here, and it is a structural property rather than a policy promise: there is no key on the server to misuse, subpoena or leak.
What the server unavoidably knows
Being honest about the edges, because a claim of "we know nothing" is never quite true:
- Your account identifier, since something has to address the data.
- The approximate size of the encrypted blob and when it last changed.
- Connection metadata of the kind any web server logs.
It does not know how many codes you have, what they are for, or what any of them generate. The encryption architecture sets out exactly what is stored and the sync protocol in full.
The trade you are making
Because we hold no key, we cannot help you back in if you forget your passphrase. That is the same property working against you, and it is not recoverable by anyone. What happens if you forget your passphrase is worth reading before you rely on sync.
Try KeyNesta free. The web app needs no sign-up.
Open the web app All platforms