Product
Password manager focused on privacy
NinjaBiba is a password manager for people who want strong defaults: encrypt on the device, sync ciphertext only, and keep autofill under your control. It is available as a web vault and Chrome extension, with mobile apps in the product roadmap.
What you get
- Encrypted vault for logins and related fields, unlocked with a master password.
- Cloud sync of ciphertext so your devices stay in sync without uploading plaintext.
- Chrome extension that offers matching accounts and fills only after you choose one.
- Auto-lock after inactivity so decrypted data does not linger in memory.
- Import path for LastPass CSV exports.
- Optional account MFA with authenticator apps (TOTP).
Threat model (plain language)
If someone obtains your account password alone, they still need your vault master password to decrypt items. The server is designed to store encrypted vault backups and account metadata — not your master password or decrypted secrets. Protect your master password; recovery of a forgotten master password is not possible from the server.
Read more on the security page and the privacy policy.
Who it is for
- Individuals who want a privacy-first alternative to inject-on-load autofill managers.
- Users migrating from LastPass who need CSV import into an encrypted vault.
- Teams evaluating client-side encryption and ciphertext-only sync (MVP has no family sharing yet).
FAQ
Who is NinjaBiba for?
People who want a password manager that encrypts vault data on the client, stores only ciphertext on the server, and autofills in Chrome after an explicit choice — without advertising SDKs.
What stays on my device?
Master password, derived keys, and decrypted vault items stay in memory until you lock, sign out, or auto-lock. The Chrome extension may keep an opaque encrypted backup locally; it never stores the master password or decrypted items on disk.