All four are zero-knowledge vaults, and on that they broadly agree. They diverge on three things: how much of the system you can read, whether you can run it yourself, and what a stolen master password gets somebody who has one.
| CypherKey | 1Password | LastPass | Proton Pass | |
|---|---|---|---|---|
| Zero-knowledge vault | Yes | Yes | Yes | Yes |
| Second factor needing no phone, code or dongle | Yes — your typing rhythm, on every unlock | No | No | No |
| Client source published | Yes — MIT | No — proprietary | No — proprietary | Yes — GPLv3 |
| Server source published | Yes — AGPL-3.0 | No | No | No |
| Self-host the whole stack | Yes — docker compose up |
No | No | No |
| A stolen master password, on its own | Refused — the rhythm does not match, so the server share is never released | Also needs the account's Secret Key | Opens the vault unless a second factor is enrolled | Opens the vault unless a second factor is enrolled |
| Publicly disclosed compromise of stored vault data | None — pre-launch, and audit is scheduled for M3 | None disclosed | Yes — backups exfiltrated, disclosed December 2022 | None disclosed |
Compiled from each vendor's own security documentation and public disclosures, and accurate as of September 2026. Products change; if something here has gone stale, tell us at hello@cypherkey.io and it gets corrected. Where a competitor is strong, the table says so — 1Password's Secret Key genuinely defeats a password-only attack, and Proton Pass genuinely publishes its clients.
TOTP needs a phone. A passkey needs the device it lives on. A hardware key needs to be in your pocket and charged. Your hands are already on the keyboard, which is why the rhythm factor is on every unlock rather than the ones you remembered to arm.
Roughly 39% of breaches start with a stolen credential. A leaked password works from anywhere for anyone — unless the login also has to be typed the way its owner types it. That is the whole product in one sentence.
MIT client, AGPL server, and the demo runs the same scoring code the extension unlocks with. Nobody has to take the zero-knowledge claim on trust: the vault format, the KDF parameters and the scoring maths are on the technology page and in the repository.
CypherKey imports Bitwarden JSON and Chrome CSV today, which between them cover the export formats 1Password, LastPass and Proton Pass all offer. Import happens entirely in the browser: the file is parsed, encrypted and only then does anything reach the server. Nothing in your old vault crosses the network in plaintext, including on the way in.