Your account and master password
Can a forgotten master password be recovered?
Yes. Use “Forgot password”, receive a code on your linked email or phone, and set a new one. Nothing in your account is affected. The Secret Key is yours to keep: it is the only key that opens your cloud ciphertext, we neither store nor reissue it, and backing it up once lets you restore on any new device.
What is the difference between the master password and the Secret Key?
Your master password is what you sign in with, and it can be reset with a verification code. Your Secret Key is a 44-character recovery key bound to your account that opens cloud ciphertext. It cannot be replaced or reissued. A password can be reset; a Secret Key can only be backed up in advance.
How do I get back in after changing phones or reinstalling?
Install the app, sign in with your account and master password, then import the Secret Key when prompted, either by scanning the QR code in your backup kit or typing it in. The ciphertext syncs to the new device and is decrypted there.
Can I stay signed in on more than one device?
Yes. A new device has to pass device verification the first time. Devices that are already signed in can be reviewed and removed under Security → Device management.
Your data and sync
Where is my data stored?
Passwords and similar content are encrypted on your device, and the cloud only holds ciphertext. Our servers do not decrypt them. Some older items and some helper data are still being migrated; the exact scope is set out on the Security page.
Does it work without a connection?
Yes. You can read and edit offline; changes are saved on your device first and sync once you are back online. The current sync state is always shown in the app.
Can I get back something I deleted by accident?
Yes. Deleted items go to the recycle bin, where you can restore them or remove them for good. Earlier versions of an item are also kept for 7 days by default, or 90 days for members, and can be compared and restored.
Can I import from another password manager?
Yes. Generic CSV, Chrome CSV, Bitwarden CSV, KeePass CSV, 1Password `.1pux`, and our own encrypted `.wljbak` package are all supported. Importing happens entirely on your device and never passes through our servers.
How do I move everything to a new device?
Two ways: export an encrypted `.wljbak` package, or simply sign in on the new device with your account, master password and Secret Key.
Platforms and installation
Which platforms are supported?
The iOS app is live on the App Store — search for “wljpassmgr” (微零密码箱) to install it. Android ships as an APK, the web app runs in any browser, and the Chrome and Firefox extensions handle autofill. The Windows and Linux desktop installers are still being built in the release pipeline and are not public yet; the macOS desktop app has not started.
Why can't I download the APK inside WeChat?
WeChat blocks direct APK links. Open the “…” menu in the top-right corner, choose “Open in browser”, then download the installer from our website.
Which browsers are supported?
Chrome and other Chromium-based browsers, plus Firefox 115 ESR and newer. A Safari extension has not been released.
What does the “unknown sources” warning mean when installing the APK?
It is an Android system warning about installers that do not come from an app store, not an error from the app. Allow “install unknown apps” for your browser or file manager in system settings, and turn it back off after installing. The install guide has the step-by-step version.
Cost and membership
Is the free plan enough?
Encryption is not gated by payment. The free plan includes full on-device encryption, cross-device sync and the browser extensions. Membership mainly relaxes quota-type limits, such as how long earlier versions of an item are kept: 7 days free, 90 days for members.
How much does it cost?
Whatever the membership page on this site and the in-app purchase screen show.
Privacy and security
Will there be ads?
No. This website uses no tracking cookies, and the apps include no third-party analytics, advertising or tracking SDKs. There is no behavioural profiling and no personalised push.
Does “zero knowledge” mean the server can see nothing at all?
Not quite. Our servers cannot read your passwords or secret notes; those are encrypted on your device. But your account and item names are not covered by end-to-end encryption. See the Security page.
What information do you collect?
Only the minimum needed for registration, sign-in, device verification and sync, plus account security notices. No contacts, location or clipboard contents, and no third-party analytics or advertising SDKs. See the Privacy Policy for the full text.