Think of an encrypted vault as a box of readable entries that is locked before a copy is uploaded. In the zero-knowledge storage model shown here, the provider stores encrypted data without the usable key needed to read those entries.

Actual password managers differ in key handling, sign-in and configured recovery. A master passphrase may help derive or protect a vault key; it is not necessarily the only supported route. Read the chosen product’s design and recovery instructions rather than treating the diagram as a specification for every manager.