Why we left zero-knowledge behind
We launched Killswitch as a zero-knowledge product. In 2026 we moved away from it — on purpose. Here's the honest reasoning, what changed, and exactly what we trade off.
For most of Killswitch's life, we described it as zero-knowledge. In 2026 we stopped. This is the honest story of why — what zero-knowledge actually gave you, why it quietly worked against the one promise this product exists to keep, and what protects your data now.
What "zero-knowledge" really means
In a true zero-knowledge system, your data is encrypted in your browser with a key derived from your password, and that key never leaves your device. The server stores nothing but ciphertext. We — the people who built Killswitch — literally cannot read your files. Not with a subpoena, not with a database dump, not if we wanted to.
It sounds like the strongest possible promise. For a lot of products, it is.
The problem it created for us
Killswitch isn't a place to hide files. It's a promise that your things reach your people — that if you stop checking in, the documents, notes, and messages you chose are delivered to the family and beneficiaries you named.
Zero-knowledge and that promise are in direct tension.
If only you hold the key, then the moment you're gone, so is the only thing that can decrypt your vault. Your beneficiary receives a pile of encrypted noise and no way to open it. The single most important day in this product's life — the handoff — is exactly the day zero-knowledge fails the people it was supposed to protect.
And it wasn't only the edge case. Zero-knowledge's everyday trade-off — forget your password and everything is gone, forever, with no recovery — turned out to be the biggest real-world risk in the whole system. Not hackers. Not us. A forgotten password. For non-technical beneficiaries the fragility was worse: any hiccup in the key handoff meant they got nothing, at the worst possible moment.
Zero-knowledge also made the product noticeably worse to use. Because the server only ever saw ciphertext, we couldn't offer:
- Password reset — a lockout was permanent.
- Real search across your library.
- Instant previews — PDFs, images, and documents opening inline.
- Reliable delivery to beneficiaries who aren't cryptographers.
- The AI connector and other features that need to work with your content.
We were shipping a weaker, more fragile product and calling the weakness a feature.
What protects your data now
Killswitch encrypts everything at rest — content and metadata — with AES-256 in a dedicated encryption vault, and everything in transit with TLS. The keys are held server-side. This is the same model your email provider and your cloud storage already use, and we chose it deliberately.
That one change is what makes the rest possible: you can reset your password, search your whole library, preview files instantly, connect the AI features, and — most importantly — know that the people you named will actually receive what you left them.
The honest boundary
We're not going to dress this up, because the whole point of this post is to be straight with you.
What we gave up: in a true zero-knowledge system, a full compromise of our infrastructure — or a court order compelling us — could not reach your content, because we didn't hold the keys. Under the new model, in that specific scenario, it could.
What you keep: a database breach alone does not expose your data. Content and metadata are encrypted at rest, so stolen database tables are ciphertext. Sharing is still always explicit and revocable. And nothing you store is ever one forgotten password away from being lost.
For the threat most people actually face — a breach, a leak, a lost laptop, a grieving family that needs access — this model is stronger, not weaker. For the narrow threat of a fully compromised provider or a subpoena, zero-knowledge was stronger, and we won't pretend otherwise.
If you were here for the zero-knowledge era
Your existing content is still yours and still encrypted. When you next unlock your vault, Killswitch converts your old zero-knowledge items in your browser — decrypting them with your password and re-protecting them under the new model — through the "upgrade your vault" flow. Until you convert, those legacy items are listed but can't be read server-side.
The promise underneath is the same
We didn't change what Killswitch is for. We changed the machinery so it can actually keep its promise: your digital life, protected and organized while you're here, and delivered to the right people when you're not — without a forgotten password standing between your family and the things you left them.
That's the trade we made, in the open. We think it's the right one.