"Zero-knowledge" gets thrown around a lot in privacy marketing, but it has a precise, testable meaning: the server operator has no ability to read your data — not as a policy promise, but as a mathematical fact. Let's build the mental model from primitives, using nothing but the browser's native window.crypto.subtle (the Web Crypto API). No third-party crypto libraries.
1. The threat model
Assume the server is hostile, or will be subpoenaed, or will be breached. A note-taking app that "encrypts at rest" and promises not to peek doesn't survive this model — the operator holds the keys. Zero-knowledge flips it: the key never exists on the server in the first place.
2. Deriving a key from a password (PBKDF2)
Passwords are low-entropy, so you never use them directly as keys. You stretch them with a slow KDF. A production-safe configuration in 2026:
