“End-to-end encrypted” and “zero-knowledge” get used as synonyms in secrets management, but they answer different questions. E2EE asks whether the data is encrypted between two endpoints. Zero-knowledge asks something stricter: can the server decrypt your secrets at all — ever, under any feature you might enable?
Phase is a well-built, open-source secrets platform with genuine end-to-end encryption. It’s a credit to the team that you can verify all of this in their public source — which is exactly what makes a precise answer possible. And the precise answer is: Phase’s encryption is end-to-end until you turn on a feature that needs the server to read the value — at which point the server holds a key that can decrypt it.
Is Phase zero-knowledge?
Not universally — it’s zero-knowledge only in the configuration where server-side secret rendering is off. Phase’s backend derives its own keypair from a SERVER_SECRET environment variable, and it has a first-class decryption path used whenever a feature needs the plaintext server-side. When an app enables “server-side encryption” (SSE), Phase stores that environment’s key wrapped to the server’s key, and the server can then re-derive the environment’s private key and decrypt secret values on its own.
This is not hidden — it’s in the models and the request handlers in their public repo (the ServerEnvironmentKey model, the sse_enabled flag, and the decrypt path in the secrets views). It’s a deliberate, documented capability. But it means the honest answer to “can Phase’s server decrypt my secrets?” is: it depends which features you use.
When does Phase’s server decrypt your secrets?
The server-side decryption path is not an edge case — a large part of the platform’s value depends on it. Based on Phase’s public source, the server can decrypt when you use:
- The public REST API for reading secrets (requires SSE).
- Any cloud integration / sync — GitHub, AWS, Cloudflare, and the rest run through the server-decrypt path.
- Dynamic secrets and secret rotation.
- Machine / service-account identities — a service account’s keyring can be wrapped to the server key (server-side key management, required for team-owned service accounts), which lets the server unwrap it and read on the account’s behalf.
If your workflow is purely interactive, client-to-client, with SSE off, Phase’s E2EE holds and the server genuinely can’t read your values. Turn on the automation that makes a secrets platform useful day-to-day, and the server can.
Does Phase have an MCP server for AI agents?
As of its public source, no. A search of Phase’s console, cli, and ai repositories turns up no Model Context Protocol server — the ai repo contains deployment guides, not an MCP integration. Agent access is via the CLI plus a skill document that instructs the agent, and a phase run-style injection. That’s a reasonable approach, but it is not an MCP-native design, and it relies on the agent following instructions rather than on the protocol structurally withholding values.
How is OpaqueVault’s model different?
OpaqueVault is built so the server cannot decrypt, in every configuration, with no opt-out:
- The server holds no key that can decrypt your secrets, and no decryption path. It stores ciphertext only — no
SERVER_SECRET, no server-wrapped environment key, no SSE flag. Your Key Encryption Key is derived from your master password with Argon2id and never leaves your machine. - MCP-native, with no value-returning tool. The agent calls
vault_run, which injects secrets into a subprocess and returns only the exit code and injection metadata — subprocess output is not returned to the model at all, so the model never receives the plaintext value in an MCP response. - Post-quantum transport. Phase uses classical libsodium (X25519 + XChaCha20-Poly1305); OpaqueVault adds an ML-KEM-768 + X25519 hybrid to resist “harvest-now, decrypt-later” attacks.
To be clear about the trade: Phase is more feature-broad today (integrations, dynamic secrets, a mature dashboard), and its E2EE-off path is genuinely private. The difference is that OpaqueVault treats “the server can never decrypt” as a fixed invariant rather than a mode you can leave enabled or disabled — and it puts the AI-agent boundary in the protocol itself.
The takeaway
If “zero-knowledge” is a hard requirement — regulatory, contractual, or just principle — then the question to ask any secrets manager is not “is it end-to-end encrypted?” but “under which of your features can your server read my plaintext?” With Phase, the honest answer is “several of them, by design.” With OpaqueVault, the answer is “none, ever” — because the server was never given a key.
OpaqueVault is a zero-knowledge secret manager for AI coding agents: the server stores only ciphertext, no MCP tool returns a secret value to the model, and transport uses an ML-KEM-768 + X25519 hybrid. See how it works. Claims about Phase above are drawn from its public source as of August 2026.