Zero-knowledge authentication
Authentication in which the server verifies you know your password without ever receiving it — during signup or login, in any form. The usual construction today is an aPAKE such as OPAQUE (RFC 9807).
Encryption and sign-in
Almost every login form on the web sends the password to the server inside TLS. The server is trusted to hash it and forget it — and that trust is exactly what phishing infrastructure, compromised servers, and malicious insiders exploit. Zero-knowledge authentication removes the transmission entirely: the client proves knowledge of the password through a cryptographic exchange, and the server ends up with a yes/no.
Beyond keeping the password private, the approach yields a second prize: a client-only secret (OPAQUE’s export key) that can seal user data. Login and end-to-end encryption then share one root secret the user already has — their password — without the server ever receiving it.
Ciphera’s sign-in works this way for every password sign-in. The password never reaches Ciphera’s servers; what is stored is an OPAQUE registration record plus a vault key wrapped under the client-side export key.