Preliminary research

Zero Knowledge (About) Encryption: A Comparative Security Analysis of Three Cloud-based Password Managers

Matteo Scarlata, Giovanni Torrisi, Matilda Backendal and Kenneth G. Paterson · IACR Cryptology ePrint Archive · 14 January 2026

AI-collected research leads through 6 October 2026, including bounded month-by-month reviews of selected social and community sources from January through September. Unranked, incomplete, not community-vetted, and subject to change.

"Zero knowledge encryption" is a vendor term with no technical meaning, conveying that a server holding an encrypted vault learns nothing about it even when fully malicious. Comparing that claim against Bitwarden, LastPass, Dashlane and 1Password - together over 60 million users - shows where a malicious server can still observe or influence vault contents.

Record

Researcher

Matteo Scarlata, Giovanni Torrisi, Matilda Backendal and Kenneth G. Paterson

Published by

IACR Cryptology ePrint Archive

Date

14 January 2026

In the archive

• Collected in the 2026 preliminary research sweep

Related sources

• Authors’ project and vendor responses

Tags

• password-manager
• crypto
• identity
• data-breach
• case-study
• owasp-a02-2021
• owasp-a07-2021

This page is the archive's own catalogue record. The research is the work of Matteo Scarlata, Giovanni Torrisi, Matilda Backendal and Kenneth G. Paterson, first published at the original source. Preserved copies are kept so the citation survives its host.