The short version
Need cross-device cloud sync, mobile apps or team sharing — pick Bitwarden or 1Password. Want no sign-up, password data that stays on your machine, and one-keystroke login as a developer / QA or privacy-conscious user — pick Account Password Helper.
| Dimension | Account Password Helper | Bitwarden | 1Password | Chrome built-in |
|---|---|---|---|---|
| Price | Completely free | Free / paid from ~$10 | $2.99/mo subscription | Free |
| Data storage | Fully local | Cloud | Cloud | Local / cloud sync |
| Account required | No | Yes | Yes | No |
| One-keystroke login (fill + tick + click) | Yes | Fill only | Fill only | Fill only |
| Multi-environment isolation (exact domain) | Yes, relaxable across 3 subdomain tiers | No | No | No |
| Site rules: custom username / password field selectors | Yes | No | No | No |
| Built-in TOTP authenticator | Yes | Paid tier | Paid tier | No |
| Offline security audit (0–100 score) | Yes | No | No | No |
| Personal info vault (ID / bank card, encrypted locally) | Yes | Identity / card items (cloud) | Identity / bank cards (cloud) | Address / payment card autofill |
| Open source | Yes (GPL-3.0) | Yes | No | No |
| Cross-device sync / mobile apps | No (local-first trade-off) | Yes | Yes | Yes |
Feature comparison based on publicly available information (pricing subject to change by each vendor; competitor feature claims as of 2026-09 — please confirm on their official sites too), intended to help users choose — not to disparage any product. Competitor trademarks belong to their owners.
Four capabilities shipped in recent releases
- Cross-subdomain matching, three tiers: the default stays "Exact match only". "Exact + wildcard entries" makes an entry saved as *.qq.com usable on every subdomain of that site; "Same main domain" adds a fallback to the apex domain and sibling subdomains when the current host has no entry, badged as cross-subdomain. Widening only decides which entries are offered — the auto-save duplicate rule is deliberately tier-independent, and localhost / 127.0.0.1 always stay separated by port.
- Site rules: per-domain custom CSS selectors for the username and password fields, for login pages heuristic detection gets wrong (typically Web Components sites). The domain must equal the login page domain exactly (no wildcards inside rules); each rule's "Shadow DOM penetration" switch is on by default and reaches open shadow roots only — no extension can read a mode of closed root. Rules export as a plain-text JSON file (domains and selectors only, never credentials) and merge-import by domain, reporting added / updated / skipped.
- Command palette: press Ctrl+K / Cmd+K on the manager page (not on web pages, not in the side panel) and filter 30 commands by Chinese, pinyin or initials, Enter to open. It requires an unlocked session, destructive commands keep their confirmations, and because it is not a manifest command it does not appear in chrome://extensions/shortcuts.
- Personal info vault: an independently encrypted store (whole-blob AES-256-GCM) for name, ID number, phone, email, address, bank card details and custom fields. The vault itself opens on the manager page, but you no longer have to find that page yourself — right-click any editable field on a web page and pick "Pick from Personal Info Vault", then use the "Back to the page" strip to land back on the field you were filling (that menu item only navigates: it reads no field content and never writes back into the page). Secret fields are masked by default, opening it re-checks the master password, per-field or whole-card copy runs under the timed clipboard wipe, search understands pinyin, and the cap is 100 records. Encrypted .aphid backup export / import is provided, plus an optional plaintext .json export and re-import gated by a master-password re-check and a risk confirmation, merged by id; it is not covered by automatic backups, so export encrypted backups regularly.
Like everything else here, all four are free — nothing is locked behind a paid tier.
vs Bitwarden
Bitwarden is strong at
- Cross-platform cloud sync (desktop / mobile / browser)
- Open source with self-hosting and a huge community
- Mature autofill and vault ecosystem
Where Account Password Helper differs
- No sign-up, no cloud storage: password data stays on your machine
- One-keystroke login: fill + tick consent + click login, not just fill
- Exact-domain multi-environment isolation: dev / test / staging / prod — and when one account really is shared across subdomains of a site, you can widen it explicitly to the wildcard or same-main-domain tier
- Site rules: name the input fields per domain when detection gets it wrong, with open shadow-root penetration on by default
- Built-in TOTP and offline security audit, all free
vs 1Password
1Password is strong at
- Polished cross-platform experience and mature family / team plans
- Vendor support, audits and compliance backing
- Managed security features like Watchdog
Where Account Password Helper differs
- Completely free, no subscription
- No account, no need to trust any cloud
- Per-field AES-256-GCM local encryption, no password uploads
- One-keystroke login and multi-environment isolation for devs / QA (3 tiers when you need subdomains)
vs Chrome's built-in password manager
Chrome built-in is strong at
- Zero install, works out of the box
- Seamless sync with your Google account
Where Account Password Helper adds
- One-keystroke login (tick consent + click login, not just fill)
- Exact-domain multi-environment isolation, widenable to wildcard / same-main-domain tiers
- Site rules: custom field selectors per domain for pages detection gets wrong
- Command palette: Ctrl+K / Cmd+K to filter and run 30 commands on the manager page
- Built-in TOTP generation and offline security audit
- Encrypted backup (.aph), trash bin and password history
- Personal info vault: ID numbers and bank cards encrypted separately, opened from the manager page or summoned from a field's right-click menu
- 6 themes + bilingual (中文 / English) UI
Migration: move in from these tools
CSV / JSON import auto-detects exports from Chrome, LastPass, Bitwarden and 1Password and maps column names, typically finishing in about 30 seconds. Export works the same way — your data is never locked in.
Frequently asked questions
Is there a free password manager better than Bitwarden?
If you value zero-cloud, no sign-up and fully local storage, Account Password Helper is a Bitwarden alternative: free and open source (GPL-3.0), no account, no sync, data encrypted locally by PBKDF2 + AES-256-GCM. For cross-device sync and mobile, Bitwarden is still the better fit.
Is there a free alternative to 1Password?
Yes. Account Password Helper is subscription-free and account-free, with local encryption, one-keystroke login, built-in TOTP and a security audit all free. 1Password's strengths are cross-platform polish and team / family collaboration.
Difference between Chrome's built-in manager and an extension?
Chrome's built-in manager is free and needs no install, but only fills forms — no multi-environment isolation, no TOTP generation, no offline audit, no encrypted backup. This extension adds those and supports one-keystroke login.
Is a local password manager safe?
It uses the browser-native Web Crypto API: the master password is derived via PBKDF2 (600,000 iterations) and fields are authenticated-encrypted with AES-256-GCM, while credentials are never uploaded to any server; the only outbound request is an anonymous version check every 6 hours that carries no vault content and no personal identifier. A forgotten master password cannot be recovered by default — an offline recovery key enrolled in advance is the exception — so keep encrypted backups; as with any extension, avoid banking / payment credentials.
Can subdomains of one site share the same credentials?
They can, and by default they don't. The cross-subdomain matching setting in the manager page header offers three tiers and defaults to "Exact match only". "Exact + wildcard entries" makes an entry saved as *.qq.com selectable on every subdomain of that site; "Same main domain" adds one more fallback — when the current host has no entry, entries of the apex domain and of sibling subdomains are offered and labelled "cross-subdomain". Widening only decides which entries are shown: the auto-save duplicate rule is deliberately tier-independent, and localhost / 127.0.0.1 always stay separated by port.
What if a login page is not filled correctly?
When the form lives inside a custom component (typically Web Components pages), open "Site rules" on the manager page and set the CSS selectors of the username and password fields for that login page's domain — the domain must equal the login page domain exactly, and wildcards are not supported inside rules. Each rule has a "Shadow DOM penetration" switch, on by default, that reaches open shadow roots only; no extension can read a closed (mode: 'closed') root, and neither can we. Rules export as a plain-text JSON file for backup or team sharing (domains and selectors only, never credentials) and merge-import by domain, reporting the added / updated / skipped counts.
Try it free, migrate in 30 seconds
Open source, no sign-up, password data that stays on your machine.