Understanding the Difference

The distinction between client-side and server-side encryption comes down to where the encryption happens and who controls the keys.

Server-Side Encryption (SSE): The server encrypts your data after receiving it. The server holds the encryption keys, meaning the provider can decrypt your data at any time. Think of it as handing your diary to a friend who puts it in their safe — they promise not to read it, but they have the key.

Client-Side Encryption (CSE): Your data is encrypted on your device before being sent to the server. You control the encryption key. The server never sees your unencrypted data. Think of it as locking your diary in your own safe and then handing the safe to your friend for storage — they can't open it even if they wanted to.

Security Comparison

Server-Side Encryption (SSE) — Limitations: • Provider can access your data • Vulnerable to insider threats • Data exposed if server is compromised (attacker gets data AND keys) • Government subpoenas can compel the provider to decrypt • Trust is required in the provider's security practices

Client-Side Encryption (CSE) — Advantages: • Provider has zero knowledge of your data • Insider threats are neutralized • Server compromise exposes only encrypted blobs • Cannot be compelled to produce data in readable form • Trust is placed in mathematics, not promises

Client-Side Encryption (CSE) — Tradeoffs: • Server cannot perform operations on encrypted data (no search, no thumbnails) • Password loss means permanent data loss • More complex implementation • Encryption/decryption uses client device resources

Best Practices

For maximum security, use client-side encryption whenever the data is sensitive enough to warrant it:

• Financial documents, legal contracts, medical records → Client-side encryption • Cryptocurrency keys, passwords, access credentials → Client-side encryption • Personal photos for easy sharing → Server-side may suffice • Streaming media, public content → Encryption unnecessary

ZeroLatch exclusively uses client-side encryption (AES-256-GCM in the browser), ensuring true zero-knowledge architecture. Your files are encrypted before they leave your device and remain encrypted on our servers until a recipient decrypts them on their device.