Answers to the questions we hear most — installing Walilock, billing and trials, how zero-knowledge really works, and getting sync set up across your devices.
Install Walilock and bring your data across.
Head to the download page and grab the build for your operating system. The installer sets up the desktop app and, on first launch, walks you through creating your master password and local vault. Mobile builds are available from the App Store and Google Play, also linked from the download page.
Walilock runs on Windows, macOS, and Linux on the desktop, plus iOS and Android on mobile. There's also a browser extension for autofill in Chrome, Firefox, and Edge. Your encrypted vault syncs across all of them once you're on a plan that includes sync. See Download for the current list of builds.
Open Walilock and go to Settings → Import. We support CSV exports from most major managers (1Password, Bitwarden, LastPass, Chrome, and others). Export your data from the old tool, select the matching format in Walilock, and choose the file. Everything is encrypted the moment it lands in your vault. Delete the plaintext export file afterward — it's the one unprotected copy of your logins.
No. The free Personal tier runs entirely on your device — no account, no email, no cloud. You create an account only when you want a plan with sync, sharing, or team features. Even then the account authenticates you to our relay; it never gives us access to your vault contents. See Pricing for what each tier includes.
Trials, plan changes, payments, and refunds.
Family includes a 14-day free trial and Business a 30-day trial. Both ask for a card at checkout through Stripe, but you're not charged until the trial ends — cancel any time before then and you won't be billed a cent. Trials are tracked server-side, so reinstalling won't reset the clock. Personal+ has no trial because the free Personal tier already lets you try the core vault. Full details on Pricing.
Open Settings → Billing in the app to upgrade, downgrade, or cancel — changes take effect immediately for upgrades and at the end of the current period for downgrades. Business admins manage seats and cancellation from the admin console. If you cancel, your vault becomes read-only rather than deleted: every item stays visible and exportable, and you can re-subscribe any time to restore editing and sync.
Billing runs through Stripe, so we accept all major credit and debit cards (Visa, Mastercard, American Express, Discover) and, where Stripe supports them, wallets like Apple Pay and Google Pay. Enterprise customers can arrange invoicing and annual purchase orders — reach out via Contact Sales.
Because Family and Business start with a free trial, you can evaluate them fully before any charge. If you're billed and something isn't right, email support@walilock.com within 30 days of the charge and we'll make it right, typically with a full refund of the most recent payment. Refunds return to your original payment method through Stripe.
What zero-knowledge means for your data.
Zero-knowledge means your data is encrypted and decrypted only on your devices, using keys derived from your master password — which never leaves your machine. Our servers only ever hold ciphertext. We have no way to read, hand over, or sell your vault, because we simply don't possess the keys. Read the full model on our Security page.
No. Everything in your vault is encrypted on your device before it's ever stored or synced. What reaches our relay is an opaque blob of ciphertext with no accompanying key. Nobody at Walilock — and no attacker who compromised our servers — can turn that back into your passwords. That guarantee is the whole point of the architecture, not a policy we could quietly change.
No — and this is the honest, important tradeoff of zero-knowledge design. Your master password is the key that encrypts your vault, and we never receive it or store anything derived from it, so we cannot reset or recover it. What you can do: save an emergency recovery kit the day you sign up — it restores access if your device is lost, wiped or replaced, though it cannot replace a forgotten password. Data encrypted with a forgotten master password cannot be recovered by anyone, including us. We strongly recommend saving your recovery kit somewhere safe the day you sign up. More on Security.
OPAQUE is the asymmetric password-authenticated key exchange (aPAKE) protocol Walilock uses to log you in. Unlike a traditional login, your password — and even a hash of it — is never sent to the server. OPAQUE lets the relay verify it's really you without ever learning your password, which is what makes the whole zero-knowledge chain possible. There's a deeper explanation on the Security page.
If our relay were breached, an attacker would find only encrypted vault blobs and OPAQUE verifier data — no master passwords, no decryption keys, no plaintext. Without your master password (which we never hold) that ciphertext is useless. That's the resilience zero-knowledge is designed for: a server compromise does not become a vault compromise. We'd still notify affected users and rotate credentials as a precaution.
Keeping devices, family, and teams in sync.
Walilock syncs through a blind relay. Each change is encrypted on your device first, then the ciphertext is uploaded and mirrored to your other devices, where it's decrypted locally. The relay stores and forwards encrypted blobs without ever seeing their contents — it's a courier, not a reader. Sync is included on Personal+, Family, Business, and Enterprise plans.
Yes. Data is encrypted on the sending device and only decrypted on your other authorized devices — the relay in between never has the keys. Shared and family vault items are encrypted to each recipient too, so sharing an item never means handing plaintext to our servers.
On a Family plan, the organizer invites members by email from the app. Each member sets up their own master password and keeps a private vault only they can open, while shared items live in a family vault that's encrypted to every member's key. Members can be added or removed at any time (up to five), and removing someone revokes their access to shared items. See plan details on Pricing.
Single sign-on is an Enterprise feature. Walilock supports OIDC identity providers. Access is managed by your administrators; automatic directory sync (SCIM) is on the roadmap and deprovisioning, so employees sign in with your existing IdP and access is managed centrally. Setup is handled with our team during onboarding — start at Enterprise or reach out through Contact Sales.
Didn't find your answer above? Our support team typically replies within one business day.
support@walilock.com