Glossary · Cryptography & authentication
Zero-knowledge authentication
Authentication in which the server verifies you know your password without ever receiving it — during signup or login, in any form. The standard construction today is an aPAKE such as OPAQUE (RFC 9807).
Almost every login form on the web sends the password to the server inside TLS. The server is trusted to hash it and forget it — and that trust is exactly what phishing infrastructure, compromised servers, and malicious insiders exploit. Zero-knowledge authentication removes the transmission entirely: the client proves knowledge of the password through a cryptographic exchange, and the server ends up with a yes/no.
Beyond keeping the password private, the approach yields a second prize: a client-only secret (OPAQUE’s export key) that can seal user data. Login and end-to-end encryption then share one root secret the user already has — their password — without the server ever being able to derive it.
Ciphera ID authenticates every account this way. The password never reaches Ciphera’s servers; what is stored is an OPAQUE registration record plus a vault key wrapped under the client-side export key.