Guides / On-device, end-to-end and zero-knowledge

On-device, end-to-end and zero-knowledge encryption: what's the difference?

Updated 3 November 2026 · By the FirstHour team

Short answerThey answer different questions. On-device is about where the scrambling happens. End-to-end is about who holds the key when data travels or sits in a company's cloud. Zero-knowledge is a looser phrase, meaning a company has no way to read your data. Any of them can be said honestly or loosely, so look at the details.

First, what encryption is

Encryption scrambles data so it can only be read with a key. Whether it protects you depends on one thing: who has the key. A locked box is no help if the person you're worried about holds a copy of the key.

On-device encryption

The scrambling happens on your own phone, and the scrambled data stays there. It says nothing about the cloud, because there may not be one. iPhone does this for its own storage: Apple calls it Data Protection, and says its keys are rooted in the Secure Enclave, a protected part of the chip.

End-to-end encryption

Data is scrambled on your device and only unscrambled on devices you trust, so the company in the middle only ever carries or stores scrambled data. Picture a sealed envelope that the post office handles but can't open. The "ends" are the devices.

Apple gives a clear example. Some iCloud data, such as your saved passwords and Health data, is end-to-end encrypted by default. Photos, iCloud Backup and Notes are end-to-end encrypted only if you turn on Advanced Data Protection. Without it, Apple holds the keys for those. Mail, Contacts and Calendars aren't end-to-end encrypted either way. The details are here.

Zero-knowledge

There's no official definition. Companies usually use it to mean that they store your data but are built so they can't read it, often including not knowing your password. That sounds like end-to-end, and sometimes it is the same thing. Check what is meant:

In cryptography the same words also name something narrower, a "zero-knowledge proof", where you prove you know a secret without revealing it. That's a different thing from a storage app's promise.

Side by side

On-deviceEnd-to-endZero-knowledge
SaysScrambled on your phone, kept thereOnly your trusted devices can unscrambleThe company can't read it
Needs a company server?NoYes, to sync or storeYes, to store
Who holds the key?You, on your phoneYou, on trusted devicesShould be you. Ask
Meaning isFairly clearFairly clearLoose

How FirstHour fits

FirstHour's Vault is on-device. It's scrambled with AES-256-GCM on your iPhone, the key stays on your iPhone, and the Vault isn't stored on any FirstHour server. Here's what that means in detail.

It isn't "end-to-end", because there's no cloud copy to be at the other end of. A backup file you save yourself is encrypted with your recovery phrase, and goes wherever you put it.

We don't call it "zero-knowledge". That phrase usually describes a stored service, which FirstHour's Vault isn't, and the word has no fixed meaning. What we can say is that we never receive your pictures, your pattern, your PIN or your recovery phrase. Theft Lock, which isn't in the app today, would store an account, your iPhone's model and security events on our server, and places if you turn on Recovery location. And there's no outside audit yet.

Questions

Which is best?

None on its own. What matters is who can read your data and what happens if you lose the key. Ask the company that.

Does encryption stop a thief who knows my passcode?

No. Anything unlocked by your passcode is open to them. Here's what to do.

Sources

All guides