Zero-knowledge photo storage explained: why it matters for personal privacy
What zero-knowledge means for a photo library specifically — the guarantees it provides, the features it removes, and how to decide whether you need it.
Try it in one click.
Three private surfaces. Same zero-knowledge architecture.
A definition that survives scrutiny Zero-knowledge, applied to a photo service, means the provider has **no technical ability** to view your images. Not "does not", not "will not without a warrant" — cannot. The keys are derived on your device and never leave it in a form the server can use.
It is an architectural claim, which means it can be tested rather than trusted.
Why photos raise the stakes Documents are usually about work. Photos are usually about life. A library accumulated over a decade contains, without anyone intending it:
- the interior of your home and the faces of your family
- location history, embedded in EXIF, precise to the street
- images of documents, cards and prescriptions taken for convenience
- private albums shared inside a relationship
- pictures of children
The library is also permanent. Whatever protections exist today apply to images you took years ago and forgot about.
The three guarantees **Confidentiality against the provider.** No support tool, no admin console, no internal classifier can open an item.
Breach containment. An attacker who obtains the storage layer obtains ciphertext. Without your passphrase-derived key, there is no shortcut.
Truthful legal posture. A provider can only disclose what it can decrypt. Zero-knowledge makes that set empty for content.
The three costs **No server-side intelligence.** Face grouping and "search by what is in the photo" must run locally or not at all.
Recovery is on you. A recovery kit replaces password reset. Lose both and the library is unrecoverable — the same property that protects it.
Device work. Encryption, thumbnails and previews consume battery and CPU on your device rather than in a datacenter.
Who genuinely needs it - anyone storing private personal albums or intimate media - people photographing identity, medical or financial documents - journalists, activists and their families - professionals whose camera roll captures client premises, patients or protected material - anyone who has had an account suspended by an automated system and lost access to years of memories
How to verify a claim instead of believing it - Read the security documentation and look for the exact KDF and cipher names. - Ask whether file names and EXIF are encrypted, not just pixels. - Check whether a share link puts key material in the URL fragment. - Ask what happens if you forget your password. Any answer involving provider-side restoration disqualifies the zero-knowledge claim. - Look for published integrity information about the client code that performs the encryption.
What DRIVUNO publishes Argon2id for key derivation on the device, X25519 for key wrapping, XChaCha20-Poly1305 for payloads, encrypted file names, on-device thumbnails, blind-index search, passphrase-gated links that expire within 24 hours maximum, and an offline recovery kit instead of a provider-side reset.
If any of that stopped being true, the product would stop being what it says it is — which is exactly why it is written down.
Try it in one click.
Three private surfaces. Same zero-knowledge architecture.