Key points
- Encryption occurs before upload, not after the server receives plaintext.
- Key custody matters as much as the location of the encryption operation.
- Browser cryptography can use WebCrypto and carefully isolated WebAssembly modules.
- A compromised endpoint can still read content available to that endpoint.
A typical client-side encryption flow
The client obtains or unlocks a data key, derives a purpose-specific content key, serializes the data, and applies authenticated encryption. It uploads ciphertext plus the non-secret parameters needed for decryption. Another authorized client downloads the ciphertext, obtains the appropriate key, verifies integrity, and decrypts locally. [2]
Good designs separate keys by workspace, record type, or purpose. Domain separation limits the chance that one key or message format is accidentally reused in another protocol context.
Client-side does not automatically mean zero knowledge
A client can encrypt locally while also uploading the key to the provider or accepting a provider-controlled recovery key. In that design the operation is client-side, but the provider may still decrypt. Ask how keys are generated, wrapped, shared, recovered, and revoked.
Web applications also load code from a server on every visit. Published source code helps review, but it does not by itself prove that every delivered build is identical or uncompromised.
What remains outside the encryption boundary
Client-side encryption cannot hide information that the protocol sends in plaintext, such as account identity or some timestamps and relationships. It also cannot protect decrypted content from malware, browser extensions, screenshots, or an authorized recipient.
Common questions.
Is client-side encryption the same as E2EE?
Not always. Client-side describes where encryption occurs. E2EE additionally requires that only the intended endpoints can decrypt.
Can a web app provide client-side encryption?
Yes. Browsers provide cryptographic APIs and can run audited cryptographic code through WebAssembly, but secure delivery of the web client remains part of the threat model.
Does client-side encryption hide file size?
Usually not. Ciphertext length commonly reveals an approximation of plaintext size unless the application adds padding.
Primary sources
Definitions prefer standards bodies, government guidance, and the first-party SealTask architecture. Links open the complete source.
- 01 Google Cloud Storage: Client-side encryption keys First-party cloud documentation defining encryption before upload and customer-controlled client-side keys.
- 02 RFC 8439: ChaCha20 and Poly1305 for IETF Protocols The ChaCha20-Poly1305 AEAD construction and nonce requirements.
- 03 SealTask security architecture Product-specific encryption boundary, server visibility, protocols, and current limitations.