Short answer: yes, for most everyday documents. WPS Office isn't malware, and nothing about opening a spreadsheet or writing a resume in it puts your device at risk on its own. But two real security incidents happened in the past two years, the free version is ad-supported with third-party tracking built in, and the company behind it is Chinese-owned. All three are worth a few seconds of your attention before you decide whether WPS Office fits how you work.
The real question is whether you know what you're agreeing to, not whether WPS Office earns a single safe-or-dangerous label. Below is what happened, what it means, and where WPS Office holds up against Microsoft Office, LibreOffice, and Google Docs, plus where it falls short.
Who owns WPS Office, and does that matter?
WPS Office is developed by Kingsoft, specifically its subsidiary Zhuhai Kingsoft Office Software Co., Ltd., headquartered in Zhuhai, China. Kingsoft has built office software since the 1980s, and WPS Office (the name stands for Writer, Presentation, Spreadsheet) is its flagship product, with hundreds of millions of installs across Windows, Mac, Android, iOS, and Linux.
The ownership matters for one practical reason: user data processed by a China-based company can fall under Chinese data law, which gives state authorities broader access than most Western privacy frameworks allow. That's a real jurisdictional difference, not a reason on its own to assume bad intent. If you're handling regulated, classified, or client-confidential material, jurisdiction is a legitimate factor in your decision. If you're writing a grocery list or a school essay, it's a footnote.
Is WPS Office itself malware? No, here's what people get wrong
A recurring claim on Reddit threads and forum posts is that WPS Office "is malware" or installs a virus by default. That's not accurate, and it conflates two different things.
What happened, in 2024, was a supply-chain attack: a threat group tracked as APT-C-60 exploited a real vulnerability in WPS Office's update mechanism to push a backdoor called SpyGlace to a narrow set of targeted users, primarily in East Asia. That's a serious flaw, covered in detail below, but it's an exploited vulnerability that Kingsoft patched, not a permanent, built-in feature of the software. Millions of people ran WPS Office through 2024 and 2025 without ever encountering it, because the attack targeted specific victims rather than every installation.
The distinction matters because "the app is malware" and "a patched vulnerability was exploited against some users" call for very different responses. The second one calls for keeping the app updated. The first one, if it were true, would call for uninstalling it entirely.
What actually happened in 2023 and 2024?
Here's what's actually on record, in order:
- November 2023, AI training and privacy backlash: users discovered wording in WPS Office's privacy policy that appeared to grant Kingsoft broad rights to use uploaded document content for AI training. The backlash was significant enough that Kingsoft issued a public apology and revised the policy language. No confirmed evidence emerged that document content had already been used to train models, but the episode showed the company writing overly broad terms first and clarifying only after users pushed back. That's worth remembering if you're the type who skims privacy policies rather than reading them.
- November 2023, a censorship incident: separately, a user reported being locked out of a 1.3-million-character document mid-edit, with WPS Office's software flagging the content as containing "sensitive" material. The incident was widely reported by outlets covering Chinese tech. It's a reasonable data point if content moderation on your own writing, even unpublished drafts, matters to you.
- August 2024, CVE-2024-7262 and CVE-2024-7263: ESET's research team publicly disclosed two zero-day vulnerabilities in WPS Office for Windows, both exploited in the wild by the espionage group APT-C-60 to deploy the SpyGlace backdoor described above. Kingsoft had already patched both by the time of disclosure. This is the most concrete security event on WPS Office's record to date, and it's the one the software's own "Is WPS Office Safe" page describes only as "a 2023 zero-day, patched quickly," without naming it. If you're weighing this on facts rather than vibes, those are the two CVE numbers to know.
None of this means WPS Office is currently compromised. It means the software has a real, documented incident history, the same as most software companies its size. The difference is how specifically each incident maps onto the "should I trust a document I wrote in this?" question.
What data does WPS Office actually collect?
The free tier is ad-supported, and WPS Office's own privacy policy names third-party analytics SDKs, including Google Analytics and Facebook Analytics, bundled into the app to support that ad model. That's a normal trade-off for free software, not a hidden one, but it does mean usage data leaves the app for ad-targeting purposes even before you touch the AI-training question above.
The paid tiers remove ads and reduce (though don't eliminate) the number of third-party SDKs bundled in. If you're on the free version specifically to avoid a Microsoft 365 subscription, know that "free" here means ad-supported and lightly tracked, not "no data collected."
How does WPS Office compare to Microsoft Office, LibreOffice, and Google Docs?
| WPS Office | Microsoft Office | LibreOffice | Google Docs | |
|---|---|---|---|---|
| Company / jurisdiction | Kingsoft (China) | Microsoft (US) | The Document Foundation (community, no single jurisdiction) | Google (US) |
| Open source | No | No | Yes (GPL) | No |
| Free tier includes ads | Free (ads) | No free perpetual tier with ads | Free, no ads | Free, no ads |
| Third-party tracking SDKs disclosed | Yes (Google Analytics, Facebook Analytics on the free tier) | Microsoft's own diagnostic telemetry | None by default (opt-in reporting only) | Google's own account-linked analytics |
| Notable 2024 security disclosures | CVE-2024-7262, CVE-2024-7263 (patched) | Multiple CVEs, patched via routine monthly updates | Occasional CVEs, patched via community releases | No public zero-day disclosures (browser-delivered, different attack surface) |
Every product in that table has a data-collection and vulnerability-disclosure history, because that's what happens to widely used software. WPS Office's record is thinner than Microsoft's mainly because it's a smaller, newer target, not because the engineering is inherently better.
Should you use WPS Office? A quick way to decide
Skip the abstract pros-and-cons list and ask two questions instead.
What kind of documents are you creating? If it's personal writing, coursework, or anything you'd be comfortable emailing to a stranger, none of the above changes much for you. If it's client contracts, health records, financial statements, or anything with a legal confidentiality requirement, the jurisdictional and ad-SDK points above stop being footnotes. They become compliance questions your employer or industry regulator may already have an answer for.
Are you on the free tier for cost reasons, or because you don't have Microsoft 365? If it's cost, the paid WPS tier removes the ad SDKs and is usually cheaper than a Microsoft 365 subscription. If you specifically need Office-file compatibility without a subscription, LibreOffice does the same job with no telemetry and no ads, at the cost of occasional formatting quirks on complex Office-native files.
How do you make WPS Office safer to use?
If you've decided WPS Office fits your use case, four habits reduce your exposure without changing how you work:
- Turn off cloud sync for anything you wouldn't want stored on a third-party server, and keep sensitive files local.
- Opt out of the AI-training data-sharing toggle in Settings > Privacy. It exists specifically because of the 2023 backlash.
- Download WPS Office only from the official site or your device's app store, never from a third-party mirror.
- Keep the app updated. Both 2024 CVEs were exploited before patches reached everyone; the update itself is the fix.
Does a VPN make WPS Office safer?
Not directly. A VPN doesn't change what WPS Office does with your document content once it's on Kingsoft's servers, and no legitimate VPN provider claims otherwise.
Where it does help is the connection your files travel over before they get there. If you're editing and syncing WPS documents on hotel or airport Wi-Fi, that connection is often unencrypted, and anyone else on the network can see what you're sending. VPN Super encrypts that traffic between your device and its servers, which keeps your document uploads private from whoever else is on the same network, and from your ISP logging what you sync and when. It's also useful if you travel a lot and want to keep access to your own accounts and subscriptions the way you'd use them at home, rather than a security feature for the documents themselves.
For that kind of everyday privacy layer, Premium servers and a straightforward setup matter more than any exotic feature list. If you'd rather keep your document syncing and general browsing off your ISP's radar entirely while traveling, you can stream privately and browse the same way, and download VPN Super to get started in a few minutes.
Frequently asked questions
Is WPS Office safe to use?
Yes, for typical personal and business documents. It isn't malware, and normal use doesn't put your device at risk. Two 2024 zero-day vulnerabilities were exploited in targeted attacks and have since been patched, and the free tier includes ad-tracking SDKs. Both facts matter, but neither is a reason to avoid the app for routine work.
Is WPS a Chinese app?
Yes. WPS Office is developed by Zhuhai Kingsoft Office Software Co., Ltd., a subsidiary of Kingsoft, headquartered in Zhuhai, China. That means user data can fall under Chinese data law, which is a relevant factor for regulated or confidential documents, though not automatically a problem for everyday use.
Can I trust WPS Office?
For most everyday writing and spreadsheets, yes. For documents with legal confidentiality requirements or regulatory data-residency rules, weigh the jurisdiction and third-party-SDK facts above against your specific obligations before choosing it.
Why is WPS Office considered a security risk?
Mainly because of two 2024 zero-day vulnerabilities (CVE-2024-7262 and CVE-2024-7263) that a threat group exploited to install a backdoor on a narrow set of targeted machines, plus a 2023 privacy-policy dispute over AI training rights. Both CVEs are patched; keeping the app updated closes that specific door.
What are the disadvantages of WPS Office?
The free tier is ad-supported with third-party tracking SDKs, formatting can shift slightly on complex Microsoft Office files, and the company is subject to Chinese data law. Its security-incident history, while real, is shorter than Microsoft's largely because it's a smaller target, not because it's better engineered.
Is WPS Office the same as Microsoft Office?
No, but it's built to be compatible with Microsoft's file formats (.docx, .xlsx, .pptx). It's a separate product from a separate company, with its own privacy policy, data practices, and incident history.
Is WPS Office's free version safe, or is it the ads that are risky?
The free version itself isn't malicious, but it bundles third-party ad-analytics SDKs (including Google Analytics and Facebook Analytics, per WPS's own privacy policy) to support the ad model. That's a data-sharing trade-off, not a security flaw. Upgrading to a paid tier removes the ads and most of that tracking.
Is WPS Office safe on Android?
The Android app functions the same as the desktop version and hasn't been tied to the 2024 CVEs, which affected the Windows build specifically. The same free-tier ad-SDK and Chinese-jurisdiction considerations apply regardless of platform.
