Master key
argon2id · 16-byte salt · 32-byte key
Your master password becomes a key on your device. It is derived on unlock, takes about a second, and is stored nowhere.
Latest releasev2.7.0A password manager
A password manager
your server can’t read.
Montara Pass is a secure, open-source password manager that encrypts every login in the browser. The server you run stores ciphertext and wrapped keys. Nothing else.
Built by Montara Projectargon2id · aes-256-gcm · rsa-oaep 3072
What it runs on.
Go · Fiber v3
PostgreSQL 18
React 19
Authula
Docker
Encrypted in the browser. Stored as ciphertext.
Three layers of keys. The server keeps the wrapped ones and can open none of them.
Item keys
aes-256-gcm · one key per item
Every item is sealed with its own random key. Name, username, password, URL and notes are all inside the ciphertext.
Wrapped per member
rsa-oaep · 3072-bit · sha-256
Sharing wraps the item key with the recipient's public key. The content is not re-encrypted and the server never holds the key.
9 features in v2.7.0. filter by where they run.
Logins and secure notes
Two item types. The type is the only field stored in the clear, so clients can filter by it.
- web app
- extension
- api
Fill on click
A badge in login fields lists the logins saved for that site. Nothing is filled until you pick one.
- extension
Host matching
A login is offered on its saved host and that host's subdomains. example.com.evil.net gets nothing.
- extension
Password generator
Saving a login from the popup generates a password for it. 20 characters by default.
- extension
Sharing with roles
Share one item with another user as editor or viewer. Every item has exactly one owner.
- web app
- api
Key rotation on revoke
Removing a member re-encrypts the item under a new key, wrapped for whoever is left.
- web app
- api
Folders, favorites, trash
Folder names are encrypted. Folder and favorite stay personal, even on a shared item.
- web app
- api
Auto-lock
The web app locks on reload. The extension locks after 15 minutes without use, or when the browser closes.
- web app
- extension
Conflict-safe edits
Every write names the revision it read. A stale one gets 409 Conflict instead of overwriting.
- web app
- api
the stack
Your vault. Your server. Your Postgres.
One image holds the API and the web app. Add PostgreSQL 18 and a domain, and the ciphertext never leaves your infrastructure.
What runs where
Top to bottom: what you install, what we ship in the image, and where your data lands.
your devicesclient side
- Web appreact 19
- Browser extensionchrome · firefox
- API clientsrest
your docker hostone image
- Montara Pass imageapi + web app
- Go · Fiber v3port 8080
your data & servicesstays yours
- PostgreSQL 18ciphertext, wrapped keys
- Authulapassword, magic link, google
- Resendsign-in emails
ghcr.io/montara-project/montara-pass/community:v2.7.0one Compose service · nothing phones home
How you get there
Four steps from a fresh server to your first encrypted item.
- 01
Create a Compose service
deploy/docker-compose.yml
- 02
Set the secrets
POSTGRES_PASSWORD · APP_SECRET · AUTH_BASE_URL · EDITION=community · SEED_ON_BOOT=true · SUPER_USER
- 03
Point a domain at :8080
Caddy · Traefik · Dokploy
- 04
Deploy
docker compose up -d · migrations run on boot
terminal
$ docker compose -f deploy/docker-compose.yml up -d api listening on :8080 migrations applied vault ready · open your domain
Needs Docker, PostgreSQL 18 and a domain. Resend is optional in the Community Edition.
Read the Docker guide
docker · dokploy · configuration · migrations
Three steps from deploy to first fill.
Deploy
Run the Compose stack. The server waits for PostgreSQL, applies its migrations and answers on /api/health.
Create your vault
Sign up in the web app and choose a master password of 12 characters or more. The keys are made in your browser.
Fill
Build the extension, point it at your server's origin, unlock, and click Fill on a login page.
pricing
Free to run. Or let us host it.
Self-hosting costs you a server and nothing to us. Cloud runs it for you, cancel anytime.
Self-hosted
available now$0forever
Run it on your own hardware. Nothing to us, nothing to renew.
- Web app, browser extension and API
- Sharing with roles and key rotation
- Your server, your PostgreSQL, your backups
- No tiers. Every feature is in the image
Docker · PostgreSQL 18 · domain · Resend API key
Cloud
most popularWe run the server and PostgreSQL for you. The same zero-knowledge encryption.
Paid through Lemon Squeezy · cancel anytime
Need a business plan or an invoice? Contact us
Questions people ask before trusting a vault.
How secure is Montara Pass?
Your master password is stretched into a key with Argon2id on your device. Every item is encrypted with AES-256-GCM under its own key, and those keys are wrapped with RSA-OAEP 3072. The server only ever holds the encrypted forms, so someone who copies its database gets ciphertext and nothing to open it with.
Is Montara Pass open source?
Yes. The server, web app and browser extension are MIT-licensed and on GitHub, so you can read exactly how your vault is encrypted and run the whole stack yourself.
What can the server see?
Ciphertext, wrapped keys, and one field in the clear: the item type, login or secure_note, so clients can filter. It also knows your account email and which users an item is shared with. It never receives the master password, any unwrapped key, item content or folder names.
What happens if I forget my master password?
The vault cannot be read by anyone. The server holds nothing that can open the vault key, so there is no reset and no recovery.
Is the master password my sign-in password?
No. You sign in with a password, a magic link or Google. The master password is separate, unlocks the vault on your device and never reaches the server.
What do I need to self-host?
A server with Docker, PostgreSQL 18 (the schema uses uuidv7()), a domain with HTTPS and a Resend API key for sign-in emails. The repository ships a Compose stack for Dokploy.
Which browsers does the extension support?
Chrome, other Chromium browsers and Firefox 140 or newer. You build it with pnpm build:extension and load it from disk, then point it at your server's origin.
Is there a mobile app?
No. There is the web app and the browser extension.
Can a removed member still read a shared item?
Not future versions. Removing a member rotates the item key. Anything they already read, they have read, so change the password itself if that matters.
Why is search done in the browser?
The server cannot search or sort encrypted content. The web app decrypts the page it received and filters there. Folder, type and trash are filtered on the server.
Run your own vault. Keep your own keys.
One Compose file, one PostgreSQL database, one domain.
Self-host