On-Device Encryption, Explained Without the Jargon
Every app promises your data is "encrypted." Almost none of them explain the one detail that decides whether that promise means anything: where the key lives.
"Your data is encrypted." You have read that sentence a hundred times, on privacy pages and in app store listings, and it sounds reassuring. The trouble is that it can mean two completely different things, and the difference is the whole ballgame. One version genuinely keeps your data yours. The other quietly leaves a copy of the key with the company.
You do not need a computer science degree to tell them apart. You just need to ask one question: who holds the key? This guide answers it in plain English, and shows why "encrypted on our servers" is a weaker promise than "encrypted on your device."
Key takeaways
- Encryption scrambles readable data (plaintext) into unreadable ciphertext using a key.
- On-device encryption generates and keeps that key on your phone, so only ciphertext ever leaves.
- If the company holds a key, a breach of the company can expose your readable data.
- On-device encryption means the maker cannot read your data, even in principle.
Encryption in one plain paragraph
Encryption takes something readable, your passport scan, a password, a photo, and scrambles it into gibberish using a key. Readable data is called plaintext. The scrambled version is ciphertext. Without the right key, ciphertext is just noise. With the key, it turns back into the original in an instant. That is the entire idea. Everything else is a question of who has the key and where it is kept.
The two very different meanings of "encrypted"
Here is where the same word splits in two:
- Encrypted on their servers. The company receives your readable file, then encrypts it on its side. It stores ciphertext, which is better than nothing, but it also holds a key that can turn that ciphertext back into your file. If someone breaks into the company, or an insider goes rogue, or a court compels it, the readable data can be produced.
- Encrypted on your device. Your file is scrambled on your own phone or computer before anything is sent, with a key that never leaves the device. The company only ever receives ciphertext, and it has no key. Even if its servers were wide open, there would be nothing readable to take.
If the company can decrypt your data, so can anyone who compromises the company. On-device encryption removes the company from the list entirely.
The guard-with-a-spare-key analogy
Picture a storage locker. In the "encrypted on their servers" model, you hand your belongings to the front desk, they lock them in the locker, and they keep a spare key at reception "for safekeeping." Your things are locked, yes. But there is a spare key in a building full of strangers, and a break-in at reception reaches everything.
On-device encryption is the model where you bring your own lock, you keep the only key in your pocket, and the storage company never touches it. They can guard the building all they like. Without your key, the locker stays shut, for them and for anyone who breaks in.
Why this is what "zero-knowledge" means
When the key only ever exists on your device, the company literally cannot read your content. It has zero knowledge of what you stored. That is not a policy it promises to follow, it is a fact of the architecture. There is no server holding your data in openable form, and there is no master password on the company's side to reset, because there was never a key on their side to begin with.
This is also why a strong on-device vault leans on the phone's security hardware. The key is not just kept on the device, it is sealed inside a dedicated chip (the Secure Enclave on Apple, the Keystore on Android) so it cannot be lifted off even if someone copies the storage. That hardware is what makes "the key stays on your device" trustworthy rather than just hopeful.
How Kinship Vault uses it
Kinship Vault is built on on-device encryption from the ground up. Your master key is generated on your device and sealed in its secure hardware, every document, photo, and password gets its own key, and only encrypted bytes ever leave. There is no Kinship Vault server that holds your vault, no account, and no master password we could reset, because we hold no key. When backup is turned on, the file is encrypted on the device first, so your own iCloud or Google Drive stores only ciphertext. You can read the full model in the security documentation.
Frequently asked questions
What is on-device encryption?
On-device encryption, sometimes called client-side encryption, means your data is scrambled into unreadable ciphertext on your own phone or computer, using a key that is generated and kept on that device. Only the encrypted version ever leaves. Because the key stays with you, the company that makes the app never has what it would need to read your content.
Is on-device encryption safer than cloud encryption?
For sensitive personal data, yes, and the reason is who holds the key. With typical cloud encryption, the provider encrypts your files on its servers but also holds keys that can decrypt them, so a breach or a rogue insider can expose readable data. With on-device encryption, the key never leaves your device, so anything a server or cloud account exposes is only ciphertext. Both rely on strong math. The difference is key custody, and that difference is what protects you.
Encryption where the key never leaves your hands.
Kinship Vault seals documents, photos, and passwords on your device, each with its own key, on iPhone, iPad, Mac, and Android. Even we can't open it.
See how Kinship Vault works