PBKDF2 key derivation (600,000 iterations), all via your browser's built-in Web Crypto API
Content Security Policy means the browser itself prevents the file from connecting to the internet
Only you can unlock your data. If you lose your master password, your data cannot be recovered
Free, open source, and small enough to read every line of code
No install, no account, just open in your browser
Clears copied passwords after 30 seconds
Every save creates a new timestamped file, previous versions are never overwritten
95%+ line coverage as of the latest release
Auto-detects your browser language, switch anytime
Every saved copy is a complete, self-contained HTML file with your data encrypted inside. To edit entries, open your original safe.html and use Import to load a saved copy.
| safe.html | 1Password | Bitwarden | KeePass | |
|---|---|---|---|---|
| Encryption | AES-256-GCM | AES-256-GCM | AES-256-CBC + HMAC | AES-256 / ChaCha20 |
| Key derivation | PBKDF2, 600k iter* | PBKDF2 + secret key | PBKDF2 or Argon2id | Argon2d |
| Source code | Open source | Proprietary | Open source | Open source |
| Audit effort | Single file, read in full | Closed source (audited) | Large codebase | Large codebase |
| Installation | None | Apps + extensions | Apps + extensions | App install |
| Dependencies | Zero | Cloud service | Cloud or self-host | .NET (Mono on Linux) |
| Account required | No | Yes | Yes | No |
| Cost | Free | Paid subscription | Free / paid tiers | Free |
| Multi-device sync | Manual (copy file) | Built-in | Built-in | Manual or plugins |
| Browser autofill | No | Yes | Yes | Via plugins |
| 2FA / TOTP | No | Yes | Yes (premium) | Via plugins |
| Works offline | Always | Cached locally | Cached locally | Always |
| Works on any PC | Yes, any browser | No, needs app | Web vault (needs internet) | No, needs app |
| Data collection | None — never connects | Account data, telemetry | Account data, telemetry | None |
*PBKDF2 with 600,000 iterations, using the browser's native Web Crypto API — no external dependencies.
All four use industry-standard encryption. safe.html is the only one that needs no install, no account, and no network access.
Every safe.html file is verifiable. Before entering your master password, confirm it has not been modified:
Open verify.html locally in your browser — included in the release download (.zip). Works for both fresh downloads and saved copies with encrypted data. No command-line needed.
Full support in Chrome, Edge, Firefox, and Safari on desktop (Windows, macOS, Linux). All features work offline — clipboard permission may be needed in Firefox.
safe.html is designed for desktop browsers that can open local HTML files. Mobile browsers have limited support for opening local files — Android works via file manager apps, but iOS does not reliably support this workflow.