If you store the keys, sure, that's less secure for sure. But just because you encrypt server side doesn't mean you store keys. What's the difference between:

If you store the keys, sure, that's less secure for sure. But just because you encrypt server side doesn't mean you store keys. What's the difference between: 1. Get key from user on client 2. Encrypt on client 3. Discard key 4. Discard unencrypted data 5. Send encrypted data to server 6. Store encrypted data and: 1. Get key from user on client 2. Send key and data to server over SSL 3. Encrypt on server in response handler 4. Discard key 5. Discard unencrypted data 6. Store encrypted data There are some differences, but I don't think it's clear which one is "better". I think it would depend on the details. Big picture: either way the developer sees the key and the unencrypted data. Either way, you are completely trusting the competence of the developer at implementing this scheme, and their trustworthiness with the key and unencrypted data. There is no such thing as "host-proof" encryption as long as the client is provided by the host.