Client-side encryption
Master password and keys stay in memory on your device until you lock or sign out. The API stores ciphertext for sync — not plaintext vault items.
Privacy-first password manager
Your vault stays encrypted. The server sees ciphertext only.
NinjaBiba encrypts passwords on your devices, syncs an encrypted backup across web and Chrome, and autofills only when you choose an account — not on page load.
Built for people who care about privacy
Explicit Chrome autofill
Fill logins after you pick a match. No silent inject-on-load behavior. See the Chrome extension page for details.
Web, extension, mobile
Use the vault in the browser, autofill with Chrome, and sync to mobile when available — same encrypted backup model.
Import and move on
Bring logins from LastPass CSV and other exports. Start on the import guide.
A password manager you can explain
Account email and a hashed account password handle sign-in. Optional authenticator (TOTP) secrets are encrypted at rest. Your vault master password is separate and never uploaded. Read the full privacy policy and the product overview.
FAQ
Does NinjaBiba store my master password?
No. Your master password and vault encryption keys are derived on your device and are not sent to the server. The server stores an encrypted vault backup (ciphertext only).
How does Chrome autofill work?
The Chrome extension fills a login only after you choose a matching account. It does not inject passwords on page load.
Can I import from LastPass?
Yes. NinjaBiba can import LastPass CSV exports so you can move existing logins into an encrypted vault.