What Client-Side Encryption Means
Client-side encryption means data is encrypted on your device before upload. The server stores ciphertext, not readable plaintext. If implemented correctly, server compromise is less likely to expose your raw secrets.
Typical Encryption Flow
- User enters a master password or unlock credential
- A key-derivation function produces a strong encryption key
- Each secret is encrypted locally (usually with AEAD such as AES-GCM)
- Only encrypted data and metadata are sent to the server
- Decryption happens locally after authentication
What It Protects Against
- Server-side plaintext exposure
- Many accidental storage leaks
- Unauthorized database reads without keys
What It Does Not Automatically Solve
- Phishing and account takeover
- Malware on an already-infected device
- Weak master passwords
- Unsafe sharing workflows
Key Technical Concepts
Key Derivation
Passwords are low entropy. Derive encryption keys using PBKDF2, scrypt, or Argon2 with unique salts and strong parameters. See AES-256 encryption for cipher context.
Nonce/IV Management
AEAD modes require unique nonces per encryption operation. Reuse can break confidentiality and integrity.
Integrity and Authenticity
Use authenticated encryption (e.g., AES-GCM) so tampered ciphertext fails verification.
Operational Best Practices
- Require MFA for account access
- Use device lock and full-disk encryption
- Never copy secrets into plaintext notes or chat
- Rotate sensitive credentials regularly
- Review sharing access quarterly
Threat Model in One View
- Helps against: server/database plaintext exposure
- Partially helps against: insider misuse (depends on architecture)
- Does not help against: malware on unlocked endpoint
Recovery and Safety Notes
Encryption strength is only useful if account recovery is planned safely. Use MFA, keep device security strong, and maintain documented emergency access procedures.
How LockPulse Fits
In LockPulse, this model is applied in the browser using modern crypto APIs so encrypted data is stored server-side without routine plaintext handling. For the broader model, see zero-knowledge fundamentals.