Client-side encryption means data is encrypted before transfer on your device. The server receives encrypted content rather than plaintext. That is an important distinction from protecting data only while it travels across the network.
Transport encryption is not the same thing
HTTPS or TLS protects the connection between your device and the server. The server can still receive readable data afterward. Client-side encryption happens earlier: the content is made unreadable on the client before it is sent.
Who can decrypt the data?
That depends on the key architecture. If only your devices hold the required key or a key derived from your passphrase, the server cannot simply decrypt the content on its own.
Client-side is not automatically end-to-end
The terms are often used interchangeably, but they are not identical. Client-side encryption primarily describes where encryption happens. End-to-end encryption additionally describes which endpoints are able to decrypt the content.
Metadata may remain visible
Even when content is encrypted, the server may still need technical information such as account identifiers, object sizes, modification times, or synchronization state. The exact metadata depends on the protocol.
Passphrases and keys are critical
If the service does not possess the decryption key, it may also be unable to recover it when you lose it. That improves separation between operator and content while increasing user responsibility.
Why key derivation matters
A passphrase should not be used directly as an encryption key. Secure systems derive a key using a suitable key-derivation function with parameters such as salt and sufficient computational cost.
Backups are a separate question
Client-side encrypted synchronization says nothing about how local backups or exports are protected. A complete privacy assessment needs to examine both paths.
Priviot Sync
Priviot describes its optional synchronization as client-side encrypted and uses a separate sync passphrase. Content is encrypted before transfer. Details and limitations should remain documented through Priviot Sync and Security & Transparency.
Conclusion
Client-side encryption moves the trust boundary: the server receives encrypted content instead of plaintext. The model becomes meaningful only when key management, metadata, recovery, and backups are also described clearly.