# Account Password Helper（账号密码管理助手）

> Free, open-source password manager Chrome extension for developers & QA engineers. Per-field AES-256-GCM local encryption, no account registration, no subscription, and password data stored only on your machine — the only outbound requests are anonymous version checks (a Chrome Web Store reachability probe with a GitHub Releases fallback) that carry no user data. One-click login (fill + tick consent + click login), multi-environment account isolation with optional cross-subdomain matching, built-in TOTP 2FA authenticator, and an independently encrypted personal info vault.

## Quick Facts

- **Price**: Completely free, open-source (GPL-3.0)
- **Data storage**: browser-local only — persistent ciphertext in `chrome.storage.local`, in-memory key material in `chrome.storage.session`; the `chrome.storage.sync` store that follows your browser account is never used
- **Encryption**: PBKDF2 (600,000 iterations) + AES-256-GCM via Web Crypto API
- **Performance**: side panel returns data in about 20–50ms on the warm cache path; sub-second open across cold start, an expired session and a quick browser restart is an explicit tuning target of this project
- **Languages**: Chinese + English bilingual UI, instant switching
- **Themes**: 6 color themes (Sky Blue, Bamboo Green, Peach Pink, Blossom Mauve, Sunset Orange, Misty Slate)
- **Browser support**: Manifest V3; the side panel needs Chrome 114+ (Side Panel API) — no `minimum_chrome_version` is declared, so older Chrome simply loses side panel features
- **Account required**: No
- **Subscription**: No
- **Last updated**: 2026-10-27 · **Latest release**: v3.20.0 (2026-10-27) · CI uploaded v3.20.0 to the Chrome Web Store on 2026-10-27 and it is pending Chrome review — re-verify the served version before restating this line
- **Quality**: 4654 automated test cases across 320 test files

## Key Features

- **One-click login**: "Fill and sign in" in the side panel autofills credentials → ticks the consent checkbox → clicks the login button. `Ctrl+Shift+F` fills and ticks by default, and submits the form only after you turn on "Auto-submit login" in the preferences (off by default) — so it never clicks sign-in behind your back.
- **Multi-environment isolation**: two orthogonal axes, both set in the header of the management page and honoured by every fill entry point. Host axis — three cross-subdomain matching tiers: "Exact match only" (the default) surfaces an entry only when its normalized hostname equals the current page; "exact + wildcard entries" additionally admits entries saved as `*.qq.com`, which then work on every subdomain of that site; "same main domain" additionally falls back to the apex (`qq.com`) and sibling subdomains (`music.qq.com`) when the current host has no entry of its own, badging each widened row as cross-subdomain. Port axis — by default only loopback hosts (`localhost`, `127.0.0.1`, `[::1]`, which count as one machine) are separated by port, so two local projects on `:3000` and `:5173` stay apart regardless of tier; switching on "isolate by port" applies one rule to every host, public or private: an entry that declares a port appears only on that port, and an entry without one is treated as the domain's default endpoint and appears only on the scheme's default port (80 for http, 443 for https), with the side panel offering a per-tab, unsaved override that reveals other ports' entries as non-fillable. Widening the host axis never changes which entry a save overwrites; the port axis does, precisely so a password captured on one port cannot overwrite the same username on another
- **Built-in TOTP 2FA authenticator**: RFC 6238 codes generated locally, GitHub-style two-step login auto-anchors a live code capsule — no phone authenticator app needed
- **Per-field AES-256-GCM encryption**: PBKDF2 (600,000 iterations) + AES-256-GCM via Web Crypto API; username, password, URL, remark and TOTP secret are encrypted field by field before touching disk, and password data is never uploaded
- **Personal info vault**: a separate, independently encrypted store for personal info data (ID numbers, bank cards, passports, custom fields) with two-level format validation (checksum errors block, everything else warns), whole-card copy, save-time duplicate detection, encrypted `.aphid` backup and optional re-importable plaintext `.json` export — opened from the header button on the Options page, or summoned straight from a web page: right-click any editable field and pick "Pick from Personal Info Vault". That menu entry only navigates — it reads neither the field under the cursor nor any page content, prefills nothing and never writes back into the page; the vault dialog then offers a "Back to the page" strip that returns you to the tab you came from (the tab number is the one Chrome stamped on the sender and is re-checked against the original origin before switching, and it is never persisted), after which you copy each field out through the same timed clipboard path. Values are never surfaced in the side panel
- **Offline security audit**: one-click 0–100 score weighted across four dimensions (reused 35 / weak 25 / commonly leaked 20 / stale 20), with missing-2FA reported separately but unscored — all computed on-device
- **Live password strength check**: length / letters / numbers / symbols rated weak-medium-strong, shown as a real-time bar with a rule-by-rule checklist in the add, edit and master-password forms; the checklist carries a fifth item that forces weak when the value matches a built-in list of nearly a thousand commonly leaked passwords. The same weak-password verdict appears as a non-blocking heads-up in the save-on-login prompt.
- **Password generator**: random mode (configurable length/charset/ambiguous-character exclusion) + passphrase mode drawing from a bundled 3,080-word list, Web Crypto CSPRNG
- **Quadruple fill strategy**: inline fill (key icon in input, sharing the side panel's ordering and multi-field pinyin search), side panel one-click fill, right-click context menu fill, shortcut quick-fill
- **Auto-save credentials**: Chrome-style login capture with smart dedup, domain allow/block lists; the save prompt flags weak and reused passwords inline (a heads-up only — it never blocks saving)
- **Import / export**: CSV & JSON; auto-detects Chrome, LastPass, Bitwarden, 1Password exports
- **Backup reminders**: a desktop notification on a 1 / 3 / 7 / 14 / 30-day schedule nudges you to export a backup; the encrypted `.aph` tier is preselected and switching to plaintext asks for a risk confirmation first. The extension has no mailing capability of its own — the file downloads to your machine and, if you choose the email tier, a prefilled draft is handed to your own mail client.
- **Site rules for stubborn login pages**: pin custom CSS selectors for the username and password fields of a given domain, and optionally reach fields nested inside shadow DOM — for self-built login pages and component-library forms that heuristic detection gets wrong. Rules export to a plain-text JSON file (domains and selectors only, never credentials) and merge-import by domain with an added / updated / skipped report, capped at 500 rules and 2 MiB per file
- **Command palette**: `Ctrl/Cmd + K` on the management page filters its 30 commands — add entry, health check, import / export, encrypted backup, trash, site rules, cross-subdomain matching, change master password, preferences — by Chinese, pinyin or initials; it opens only once you are unlocked, and destructive commands keep their confirmations
- **Spotlight guided tour**: the first time you open the manager page a spotlight tour plays on its own, ringing the real buttons as it walks through adding an entry, importing, backing up, security settings and the health check. The "leave a way out" step carries a button that opens the offline recovery key settings right there, so a kit can be enrolled during setup instead of postponed (the copy reads "Manage" once one is already registered, and you can still enrol later); clicking it ends the tour first so the dialog is not hidden behind the spotlight curtain. Steps are trimmed to what the current screen actually offers, so an empty vault and a populated one get their own script; arrow keys change steps, `Esc` leaves at any time, and the "Tour" button in the header replays it later. Finishing or skipping records one local flag, after which it never auto-plays again
- **Personal info field hints on web pages**: when you click into an editable field the classifier recognises as personal info (17 roles — name, ID number, phone, email, address, region, postcode, birth date, gender, employer, card number, card holder, issuing bank, and so on), a small bubble appears beside the field saying what it wants and offering "Pick from Personal Info Vault", which takes you to the vault dialog under the same master-password reverify gate. Detection falls back in order through `autocomplete` tokens, field name / id, adjacent label, sibling label blocks, then the placeholder's own words, and only checks the shape of an already-typed value as a last resort; read-only fields never participate. Exactly one thing crosses from the page to the dialog: one optional search term, read once at the moment you click (your own name from the same form, or the field's own label for certificate-number roles that have no slot in the vault) — the value you typed is not read, nothing is logged or stored, no network request is made, and no vault value is ever written back into the page. Top frame only, login fields and card expiry / CVV never participate, and an organisation's own registration number is never offered as your personal ID. Turn it off in the floating button's gear → Preferences
- **Share card**: one click on a side panel row or in the read-only details drawer composes "username / password / URL" into a single plain-text clipboard payload, subject to the same timed clipboard wipe as every other copy
- **6 color themes + bilingual UI** (中文 / English), instant switching without refresh
- **Password visibility toggle**: injects show/hide button into page password fields, verify filled content with one click
- **Trash bin & password history**: 30-day soft delete, encrypted snapshots per entry (default 3, configurable 1-10), one-click rollback
- **Smart search**: pinyin/initials search with match highlighting, side panel "This site / All entries" scope toggle (off-site hits stay copyable and open in a new tab), tags, favorites with LRU eviction
- **Side panel quick add**: the "+" in the panel header saves an account in place with the current domain prefilled; the empty state offers the same shortcut when the site has no saved account
- **Read-only entry details**: a per-row drawer shows the full remark, 2FA code, password history and timestamps without entering edit mode; copied passwords auto-clear per the clipboard setting
- **Caps Lock warning**: live uppercase-lock detection on every master password field, so a typo is never mistaken for a wrong password
- **Flexible session control**: 1 hour to 7 days validity, auto idle lock, lock on browser restart

## Who It's For

- **Developers**: manage dev / staging / prod accounts for the same site with exact-domain isolation by default, and switch to wildcard or same-main-domain tiers when one account legitimately serves a whole subdomain family
- **QA engineers**: quickly switch test accounts, one-click login across environments
- **Privacy-conscious users**: per-field local encryption, passwords never uploaded, no account registration
- **Everyday users**: stop memorizing passwords, built-in TOTP two-factor authentication
- **Migrating users**: one-click import from Chrome, LastPass, Bitwarden, 1Password — CSV & JSON, done in 30 seconds

## FAQ

**Will my passwords be uploaded to the cloud?**
No. All data stays in your browser's local storage. Sensitive fields (username, password, URL, remark, TOTP secret) are encrypted with AES-256-GCM before they touch disk, and vault content never travels over the network. There is no server, no account and no sync. The only outbound requests are anonymous version checks — a reachability probe of chromewebstore.google.com (cached 24h) and, when the store is unreachable, a read-only call to api.github.com — which carry no vault content and no personal identifier.

**What happens if I forget the master password?**
The master password itself cannot be retrieved. Offline recovery is off by default with no automatic migration. Set it up beforehand in Security Settings → Offline Recovery Key using the current master password to create, replace or disable it; save and re-enter the .aphrecovery kit for verification before activation. The kit contains only the recovery key, kit ID, version and time, not the vault. With recovery enabled and its matching key saved, enter the key or import the kit on the lock screen, set a new master password, then save and verify a replacement kit. Recovery covers all five current local domains (passwords, password trash, password history, personal info and personal info trash); By default, any undecryptable data blocks in-place recovery and nothing is changed. Only after such an abort, and only with explicit informed consent, can the rest be recovered; those records stay in the vault as-is, remain unreadable under the new master password, and are omitted from lists and backups. The vault remains locked afterward; unlock with the new master password.

Without a usable recovery key, verify .aph / .aphid files read-only in the forgot-password wizard using each file's export-time master password. A new recovery key does not open old backups; if the export-time password is the same one now forgotten, they remain unreadable. Verify first, then import on another device or in a separate browser profile to check the result before considering a wipe — never wipe first and test later. Plaintext CSV / JSON exports are another data source. With no usable key or decryptable backup, data cannot be recovered; resetting erases the local vault irreversibly. Hints only aid memory, not security-question unlocking. A recovery key cannot replace lost data/profile contents (a matching data backup is still needed) or be added after lockout.

**What happens when the session expires?**
Nothing is lost and nothing needs re-encrypting — the vault is ciphertext at rest. Expiry or locking destroys the session key material and the decrypted cache, marks the session locked, and clears the in-memory mirrors. Re-enter the master password to derive the key again and every entry is back.

**Can I import from other password managers?**
Yes. CSV & JSON import auto-detects Chrome, LastPass, Bitwarden and 1Password export formats, with Chinese/English column-name mapping. Typical migration takes about 30 seconds.

**How do I move my vault to another browser or computer?**
One encrypted backup file does it. Export "Data Management → Export Encrypted Backup" on the source machine and carry the resulting `.aph` anywhere — a cloud drive, a USB stick, an email to yourself. The file is browser-agnostic and opaque to whoever hosts it (salt + IV + AES-256-GCM ciphertext, key derived from the master password through 600,000 PBKDF2 rounds), which is exactly why this product ships no sync service and asks for no third-party authorization. On the new machine: install the extension, set a master password (it does not have to match the old one), then "Import Encrypted Backup" with the master password used at export — entries are re-encrypted field by field with that machine's key. The import appends rather than merges and shares the 2,000-entry cap, so an empty vault is the cleanest target. Only the nine vault fields travel in the `.aph`: the personal info vault has its own `.aphid` export, site rules their own plain JSON export, while preferences, security settings, per-entry reminders, Trash and password history do not move.

**Can one account serve a whole subdomain family?**
Yes, on request. The default tier matches hosts exactly; "exact + wildcard entries" admits entries saved as `*.qq.com` on every subdomain of that site, and "same main domain" adds the apex and sibling subdomains as a fallback, badged as cross-subdomain. Widening is display-and-fill only: the auto-save duplicate rule is deliberately tier-independent, so a wider tier never changes which entry a save overwrites, and loopback hosts (`localhost` / `127.0.0.1` / `[::1]`, counted as one machine) stay separated by port.

**What if the login page confirms the field detection?**
Add a site rule for that domain: your own CSS selectors for the username and password fields, plus an optional shadow DOM penetration switch for forms rendered inside custom elements. Rules travel as plain-text JSON (domains and selectors, never credentials) and merge-import by domain with an added / updated / skipped report, so a team can share one working set instead of configuring browser by browser.

## How It Compares

| Feature | Account Password Helper | Bitwarden | 1Password | Chrome Built-in |
|---------|:---:|:---:|:---:|:---:|
| Price | Completely free | Free / Paid | $2.99/mo | Free |
| Data storage | Pure local | Cloud | Cloud | Local |
| Account required | No | Yes | Yes | No |
| One-click login (fill + tick + click) | Yes | Fill only | Fill only | Fill only |
| Multi-environment isolation | Yes (exact host by default) | No | No | No |
| Site rules: per-domain custom CSS selectors, shadow DOM reach | Yes | No | No | No |
| Command palette with pinyin search (`Ctrl/Cmd + K`) | Yes | No | No | No |
| Built-in TOTP authenticator | Yes | Paid tier | Paid tier | No |
| Offline security audit | Yes | No | No | No |
| Open source (GPL-3.0) | Yes | Yes | No | No |

> Competitor cells describe behaviour documented publicly as observed in 2026-09; vendors change features frequently, so check their sites before relying on a row.

## Security Architecture

- Master password → PBKDF2 (600,000 iterations) → 256-bit key
- Plaintext + key + random IV → AES-256-GCM → Base64(IV + ciphertext)
- Sensitive fields encrypted: username, password, URL, remark, TOTP
- Session data key: PBKDF2-SHA256 (600,000 iterations) derived from the master password; while the session is valid it is cached in Service Worker memory and `chrome.storage.session` (memory only) and kept in `chrome.storage.local` wrapped by a random wrap key, so the master password itself is never written to disk
- Session expiry / lock: the session key material and decrypted cache are destroyed; ciphertext at rest is left untouched
- Auto-lock triggers: idle timeout, system lock, browser restart (optional)
- Clipboard auto-wipe after copying passwords (default 30s, configurable)
- Offline recovery: 32-random-byte key R → domain-separated HKDF-SHA256 → non-exportable AES-GCM wrapping key KEK. The current master-password configuration is AAD binding the wrapped data key DK. Recovery persists only wrapped DK and non-sensitive metadata, not R or KEK; the master password remains unstored as plaintext or reversible ciphertext. Locking/expiry does not disable the separate recovery envelope.
- With recovery enabled, ordinary master-password changes require saving and verifying a replacement kit before committing; the old R no longer works at the current local entry point afterward. Disabled recovery keeps the original interaction. Creating/replacing/disabling is not a backup and cannot revoke copied old R + old envelope/ciphertext; suspected exposure calls for a master-password change to rotate DK, without recalling historical copies.
- Same-origin Web Locks shared mutation leases exclude exclusive key transitions and fail busy without waiting; this does not serialize all ordinary CRUD. New session keys publish only after matching local commits, and recovery leaves the vault locked. `storage.local.set()` is not a general ACID transaction or a complete power-loss guarantee.
- The separate legacy `session_master_password` migration also uses HKDF with public salt; it is not the high-entropy recovery path and is not used in the current session flow
- Everything is computed locally; the only network activity is the anonymous version check described in the FAQ

## Technical Stack

- **Framework**: WXT + Vue 3 + TypeScript
- **UI**: Element Plus (on-demand import)
- **Build**: Vite
- **Crypto**: Web Crypto API (native browser implementation)
- **Manifest**: V3 (latest Chrome extension standard)
- **Testing**: Vitest

## Installation

- **Chrome Web Store**: https://chromewebstore.google.com/detail/account-password-helper/fgimkdodpjfkddmildjieojpfakpanli?ref=llms
- **GitHub Releases** (offline install): https://github.com/liaolongdong/account-password-helper/releases/latest
- **From source**: `pnpm install && pnpm build` → load `.output/chrome-mv3/` as unpacked extension

## Links

- [Chrome Web Store](https://chromewebstore.google.com/detail/account-password-helper/fgimkdodpjfkddmildjieojpfakpanli?ref=llms)
- [GitHub Repository](https://github.com/liaolongdong/account-password-helper)
- [Live Demo & Docs](https://liaolongdong.github.io/account-password-helper/)
- [English Version](https://liaolongdong.github.io/account-password-helper/en.html)
- [Tech Blog (中文)](https://liaolongdong.github.io/account-password-helper/blog/) — 5 篇技术文：本地优先产品故事、MV3 侧边栏秒开、Web Crypto 加密实战、四个新功能的实现笔记、跨子域名匹配三档的判据与踩坑
- [Tech Blog (English)](https://liaolongdong.github.io/account-password-helper/blog/index.en.html) — the same five posts in English, including how the three cross-subdomain tiers decide which accounts appear
- [Pricing](https://liaolongdong.github.io/account-password-helper/pricing.html) — 100% free, no paid tier, no subscription
- [Pricing (machine-readable)](https://liaolongdong.github.io/account-password-helper/pricing.md)
- [Alternatives Comparison (中文)](https://liaolongdong.github.io/account-password-helper/compare.html) — Bitwarden / 1Password / Chrome 自带替代方案十维度事实对比
- [Alternatives Comparison (English)](https://liaolongdong.github.io/account-password-helper/compare.en.html) — Bitwarden alternative, 1Password alternative and Chrome built-in compared across 10 dimensions
- [Privacy Policy (中文)](https://liaolongdong.github.io/account-password-helper/privacy.html) — 逐条列明存什么、存在哪、哪些字段加密、以及仅有的两类外联请求（商店可达性探测 + 每 6 小时匿名版本检查），不含任何用户数据
- [Privacy Policy (English)](https://liaolongdong.github.io/account-password-helper/privacy.en.html) — the same policy in English: what is stored, where, which fields are encrypted per field, and the only two outbound requests the extension ever makes
- [Architecture & Implementation Details](https://github.com/liaolongdong/account-password-helper/blob/main/docs/ARCHITECTURE.md)
- [Contributing Guide](https://github.com/liaolongdong/account-password-helper/blob/main/docs/CONTRIBUTING.md)
- [Changelog](https://github.com/liaolongdong/account-password-helper/blob/main/CHANGELOG.md)

## Optional

Deep-dive pages — skip them for a summary, read them when a question needs the mechanism, the numbers or the trade-offs behind a claim above.

- [Full content (llms-full.txt)](https://liaolongdong.github.io/account-password-helper/llms-full.txt) — this summary followed by every blog post in full, in Chinese and English, for agents that need the complete source text
- [RSS feed (中文)](https://liaolongdong.github.io/account-password-helper/blog/feed.xml) · [RSS feed (English)](https://liaolongdong.github.io/account-password-helper/blog/feed.en.xml) — subscribe to new engineering posts
- [Blog 01 · Why a local-first password manager](https://liaolongdong.github.io/account-password-helper/blog/01-local-first-password-manager.html) — 产品立场：为什么不做云端同步、不接第三方服务，开源与可审计在这里意味着什么
- [Blog 02 · Sub-second MV3 side panel](https://liaolongdong.github.io/account-password-helper/blog/02-mv3-sidepanel-sub-second-open.html) — Service Worker 保活（20s 心跳 + 0.5min 复活闹钟）、资源预热与三路竞速取数的完整实现笔记，含冷启动白屏的排查路径
- [Blog 03 · Web Crypto in practice](https://liaolongdong.github.io/account-password-helper/blog/03-webcrypto-encryption-in-practice.html) — PBKDF2 600,000 次迭代 + AES-256-GCM 逐字段加密的落地细节：密钥包装、会话密钥材料销毁、`.aph` 加密备份格式
- [Blog 04 · Four features, four notes](https://liaolongdong.github.io/account-password-helper/blog/04-login-flow-details.html) — 右键填充、全站搜索、快速添加与只读详情抽屉四段实现笔记
- [Blog 05 · Cross-subdomain matching tiers](https://liaolongdong.github.io/account-password-helper/blog/05-cross-subdomain-matching.html) — 三档匹配判据（精确主机名 / 通配条目 / 同主域回退）如何实现，以及 `localhost` 端口为何恒隔离
- [Blog 06 · Chrome password manager guide](https://liaolongdong.github.io/account-password-helper/blog/06-chrome-password-manager-guide.html) — Chrome 自带、云端管理器与本地优先工具的选择清单：数据位置、多环境隔离、迁移成本与离线可用
- [Blog 07 · Multi-environment account management](https://liaolongdong.github.io/account-password-helper/blog/07-multi-environment-accounts.html) — 开发者与测试如何用精确 host、命名标签、自动提交边界和保存判重，避免 test 账号填进 prod
- [Blog 08 · TOTP two-factor guide](https://liaolongdong.github.io/account-password-helper/blog/08-totp-two-factor-guide.html) — TOTP 的时间窗口与 HMAC 原理、与短信/Passkey 的差异、迁移步骤，以及把密钥放进密码管理器的风险边界
- [Tech Blog index](https://liaolongdong.github.io/account-password-helper/blog/) — all eight posts in Chinese; the English set is at `blog/index.en.html`
- [Architecture (English)](https://github.com/liaolongdong/account-password-helper/blob/main/docs/ARCHITECTURE.en.md) — module breakdown, message protocol, storage and crypto boundaries, cross-entry data flow
- [README (English)](https://github.com/liaolongdong/account-password-helper/blob/main/README.en.md) — install, usage, feature table and screenshots for the English-speaking reader

## More by this author

The same author builds open-source, offline-first Chrome extensions where data stays on your machine.

- [Transfer Any File](https://github.com/liaolongdong/transfer-any-file) — 14 file formats converted to each other entirely in the browser, without uploading a byte: Markdown, Word, PDF, Excel, CSV, JSON, HTML and images, with mixed-format batches, automatic multi-step chains, preview and inline editing, and ZIP packaging. No account, no upload, no network request. [Product page](https://liaolongdong.github.io/transfer-any-file/) · [Chrome Web Store](https://chromewebstore.google.com/detail/blkdmpkcaceicinkhindniepbbbaekkb)
- [Cross-origin Proxy](https://github.com/liaolongdong/cross-origin-proxy) — proxies a page's API requests to another backend environment: rewrite URLs, headers and responses, mock conditionally, inject delays, block requests, retry failures and forward WebSocket, all configured in the browser. This extension covers "who am I in this environment", that one covers "where this environment's requests go". [Product page](https://liaolongdong.github.io/cross-origin-proxy/en.html) · [Chrome Web Store](https://chromewebstore.google.com/detail/dednngakllblfilbndkaggphohmpgcbg)
- [Author page (中文)](https://liaolongdong.github.io/account-password-helper/author.html) · [English](https://liaolongdong.github.io/account-password-helper/author.en.html) — background, principles and every open-source project by the same author
- [Personal blog](https://liaolongdong.github.io/better-blog/) — the author's own writing beyond this project's engineering blog
- [GitHub profile](https://github.com/liaolongdong)

## License

GPL-3.0-only. Free to use, modify and distribute (including commercially). Derivative works must be open-sourced under GPL-3.0.