Five checks that narrow the field to two
Feature lists, interfaces and prices can all be made to look good. None of the five items below require reading an architecture diagram.
- Where encryption happens — can you unlock and read entries with the network off?
- Who holds the keys — it is not zero-knowledge unless the server lacks them.
- Whether you can leave — generic CSV export, or only the vendor's own encrypted bundle?
- What happens after a forgotten master password or a lost recovery key — stated plainly, and with the two cases kept apart?
- How autofill ships — a native browser extension or injected scripts?
Check 1: where encryption happens
The baseline: content is encrypted on your device with a key derived from your master password, and only ciphertext is uploaded.
- Turn off the network and open the app: if entries decrypt, decryption is local.
- Registration forces a master password separate from the login credential: the key is not handed down by the server.
- Inspect the sync request in developer tools: no readable credentials in the body means it is not relying on HTTPS alone.
Check 2: who holds the keys
Zero-knowledge means the server stores ciphertext without the key. You can verify it indirectly: does the product require you to keep a recovery secret?
- It requires a backup recovery code or Secret Key and states clearly that losing it locks you out: the key really is yours.
- If support can reset your password and restore data, the server can decrypt.
- Read what the privacy policy says about metadata: entry counts, devices and login times are usually still visible.
Check 3: whether you can take your data with you
Exit cost is the most overlooked item. Export support and format decide whether you own the data or are locked into it.
- Demand generic CSV, not only the vendor's encrypted bundle. Own-format-only means the migration cost is yours.
- Import and export should run locally, without uploading plaintext for conversion.
- Check version history too: after a bad edit, can you go back a few days?
Check 4: after a forgotten password, which one is actually lost
Two different things get confused here: the login credential and the recovery key that unlocks data. The first can be reset; if the second is hosted by the vendor, it is not zero-knowledge.
- Check whether both are separate: can only the login credential be reset, or can the vendor also restore the encryption key?
- If the master password can be reset while existing data still opens, the encryption key is independent of the login credential and sits with you.
- If the vendor can reissue your recovery key, it can also use it to decrypt.
- The recovery docs should cover both cases: what happens when the login credential is lost, and what remains when the recovery key is lost.
Check 5: how autofill ships
Autofill decides whether you actually use the thing. Check the implementation and the coverage.
- Native browser extensions are more reliable than injected scripts and follow browser updates.
- Fill should only trigger on a matching domain, never on a lookalike host.
- Mobile needs biometric unlock, or you will type the master password every time.
- The supported browsers and platforms should be stated exactly, not as "all platforms".
One table: four common approaches under the same checks
Categories differ a lot internally; these are typical patterns. Verify any specific product against the five checks rather than trusting the category.
| Browser built-in | Commercial cloud | Open source + self-hosted | wljpassmgr | |
|---|---|---|---|---|
| Where encryption happens | Inside the browser, tied to the OS account | Client-side before upload; most claim zero-knowledge | Client-side; you run the sync server | Encrypted on device before upload; cloud holds ciphertext only |
| Who holds the keys | Bound to the browser and OS account | Depends on whether a recovery secret is required | You hold the config and keys | Master password and Secret Key are split; server holds neither |
| Forgotten master password / lost recovery key | Usually recoverable via the OS account or a reinstall | Master password is usually resettable; data recovery depends on who holds the recovery key | Depends on setup; the key usually needs your own backup | Master password resettable via code; the Secret Key is never reissued, so losing it means the data stays locked |
| Export and exit | Limited browser export | Usually supported; check whether own-format only | Data files stay with you | Generic CSV, Chrome / Bitwarden / KeePass CSV, 1Password .1pux, .wljbak |
| Free tier | Free with the browser | Usually capped by quota or features | No cap; you pay in servers and upkeep | Free covers 15 entries and 5 devices; Pro is unlimited |
| Autofill | Native to the browser | Native extension | Community extensions | Chrome and Firefox extensions; Safari not released |
| Platforms | Only the browser you use | Usually mainstream desktop and mobile | Depends on the clients | Android, iOS (App Store), web app, Chrome / Firefox; Windows / Linux desktop in the pipeline |
Four products, the same parameters, side by side
Every cell below is something the vendor publishes and you can check yourself. No “more secure” or “faster” — those cannot be verified. Read down the one row that matters to you.
| Bitwarden | 1Password | KeePassXC | wljpassmgr | |
|---|---|---|---|---|
| Where data is stored | US or EU, chosen at sign-up | US, Canada or EU | Not applicable: the database file stays on your own device | Mainland China |
| How you pay | Priced in USD; needs an overseas payment method | Priced in USD; needs an overseas payment method | No subscription, entirely free | Priced in CNY; WeChat Pay or Alipay |
| After a forgotten master password | Cannot be reset. The docs state the master password is unrecoverable, so the vault has to be deleted and rebuilt | Needs both the account password and the Secret Key; lose the Secret Key and the data cannot be decrypted | No account layer: lose the database or key file and it is gone | Resettable with a code sent to your bound email or phone, with existing entries unaffected; the Secret Key is never reissued |
| Chinese interface and support | Chinese UI available; no in-country support or invoice | Chinese UI available; no in-country support or invoice | Interface translated by the community; no official support | Chinese UI and Chinese support; invoices from your order; ICP filing in place |
| Export formats | JSON, CSV, and encrypted JSON | 1PUX, CSV | KDBX (open format), CSV | Generic CSV, Chrome / Bitwarden / KeePass CSV, 1Password .1pux, .wljbak |
| Free tier | Unlimited items and devices, free indefinitely | No free tier, 14-day trial only | Entirely free | 15 entries and 5 devices, no expiry |
| Platforms | Windows / macOS / Linux / iOS / Android / browser extensions / CLI | Windows / macOS / Linux / iOS / Android / browser extensions | Windows / macOS / Linux desktop; mobile clients are third-party | Android, iOS (App Store), web app, Chrome / Firefox extensions; Windows / Linux desktop in the pipeline |
| Source code | Open | Closed | Open | Closed |
Parameters checked on 2 November 2026 against each vendor's public pages. Subscription products change price and features without notice, so confirm on their site before you buy.
Running the checks on wljpassmgr
Including the parts that are not finished, so you can judge the fit.
- Encryption happens on device: the Android app decrypts with the network off; sync uploads ciphertext only.
- You hold the keys: master password and Secret Key are split, and the server holds neither in plaintext.
- You can leave: imports from generic CSV, Chrome / Bitwarden / KeePass CSV and 1Password .1pux; exports include an encrypted .wljbak bundle.
- Recovery has two layers: a forgotten master password can be reset with a code sent to your bound email or phone, with existing content unaffected. The Secret Key is never reissued; lose it and the cloud ciphertext cannot be decrypted. The first thing to do after signing up is save the backup kit (card / PDF / QR code).
- Verifiable transparency: the site ships no third-party analytics or ad SDK, which you can confirm in developer tools.
- Platform status: iOS is live on the App Store, Android is available, the Windows and Linux desktop installers are built in the release pipeline, the macOS desktop app and the Safari extension are planned, and autofill covers Chromium browsers and Firefox.
Common questions
Is a password manager better than letting the browser remember passwords?
Both encrypt at rest. They differ in who holds the keys, whether they work across browsers, and whether you can take the data with you. Browser storage is tied to the browser account; a standalone manager gives you an independent master password and export. Judge it against the five checks above.
What is the difference between Free and Pro?
Free covers 15 entries and 5 devices with 7 days of version history; Pro removes the entry and device limits and keeps 90 days of history. Prices are listed on the pricing page.
Can I reset a forgotten master password? What about a lost Secret Key?
The master password can be reset yourself: use the password reset flow, receive a code on your bound email or phone, and set a new one. Existing content is unaffected. The Secret Key cannot be restored — it is the only key that decrypts your cloud ciphertext, and the server neither stores nor reissues it.
Do I have to install the browser extension?
No. The extension only handles autofill and the sign-in entry point; the web app and the mobile app work on their own.
Can I import data from another password manager?
Yes: generic CSV, Chrome CSV, Bitwarden CSV, KeePass CSV and 1Password .1pux files. Import runs entirely on your machine.