Artificial intelligence has a bad reputation whenever sensitive data comes up — and rightly so: most AI use cases rely on analyzing content, which implies having access to it. So how can a tool like Encryvault detect weak or reused passwords without ever seeing those passwords?
The computation that detects a weak or duplicate password runs entirely client-side, in your browser, on entries already decrypted locally for your own use. No decrypted data is ever sent back to a server for analysis — the result (a "weak" badge, a "reused" badge) stays a local computation, never a network round-trip.
None of this requires a remotely hosted AI model to "see" your password in plain text.
A more sophisticated server-side model could, in theory, detect subtler patterns (a predictable variant of a previous password, for example). But that would mean giving it access to decrypted content — a direct break of the Zero-Knowledge principle that is the foundation of Encryvault's security. That trade-off is not, as of today, on the table: the promise that "no one but you can read your vault" takes priority over analysis sophistication.
Any future evolution involving deeper analysis will have to respect the same constraint: either it runs locally (as it does today), or it operates on non-sensitive metadata (such as an entry's last modification date), never on decrypted content sent to a third party.
AI can be useful for security without ever becoming an excuse to weaken privacy. That's what, for now, guides every technical decision of this kind at Encryvault.