Your team's passwords, behind your Face ID
Strong Pass is a password manager for companies and the public sector. You sign in with Strong ID, and the vault opens with a passkey or Face ID, with no master password every day. Encryption happens on your device: neither we nor a database leak can reveal a single password.
Beta: the web vault runs at pass.strong.ee — sign-in through Strong ID, a passkey with PRF or a master password, organization vaults, 2-of-N recovery, TOTP, breach check, import and an offline copy. Planned: the browser extension, iOS/macOS and Android apps, Strong Pass as a passkey provider, emergency access; general availability after an external audit.
- 1 gesture
- Face ID or a passkey opens the vault; the passkey is set up once per device
- 0 passwords
- visible to the server: encryption happens on the device only
- 90 days
- of trash and version history for every item
- 2 of N
- admins approve an access recovery
Convenient, fast and no “your data is gone”
Strong Pass is built around the usual mishaps: a forgotten master password, a deleted item, an employee who left. Before general availability the cryptography goes through an external audit.
The vault opens with one Face ID
A passkey of pass.strong.ee provides the secret for the vault key through the WebAuthn PRF extension. It is registered once per device (synced through iCloud or Google, on all of them at once) and kept apart from your sign-in passkey: no other *.strong.ee site can ask for the secret.
Zero-knowledge
Items are encrypted and decrypted only in the browser or app. The server stores ciphertext and never receives the keys.
Web first
Open the vault from any computer in a browser, with no app to install. Extensions and apps come later.
Trash and version history
A deleted item stays in the trash for 90 days, and every item keeps a version history with previous passwords visible to its owner.
Recovery by the organization
An employee forgot everything? Two of N admins grant new access, logged and with a notification. The admins never see the passwords.
Shared vaults
Organization vaults are tied to Strong ID organizations: member roles, an access log without contents, access revoked from Console.
Generator, TOTP and breach check
Password and passphrase generator, two-factor codes (TOTP), breach check with k-anonymity: the password itself never leaves.
Import and export
Move from 1Password (1PUX/CSV), iCloud and Chrome (CSV), Bitwarden (JSON). Export your data at any time.
Need a password? Open a browser
The main Strong Pass screen is on the web, at pass.strong.ee. Someone else's computer, a new laptop, a desk at the city office: a browser, a Strong ID sign-in and a passkey or the recovery code are enough.
- The vault in a browser, no app to install
- Sign-in through Strong ID; the vault — a passkey or Face ID, once per device
- An encrypted cache on the device keeps items available offline
- Auto-lock, lock on minimize, clipboard clearing
- Interface in Estonian, Russian and English
Losing a password will be harder than keeping it
Zero-knowledge and recovery are compatible when recovery keys are set up in advance. Strong Pass prepares several ways back ahead of time, and explains honestly during setup when data can no longer be recovered.
- 90-day trash and version history for every item
- Lost your phone: sign in with another passkey, the master password or the Recovery Kit
- Organization recovery: two of N admins, logged and with a notification to the employee; the admins never see the passwords
- A printable Recovery Kit with a recovery key, as in Strong ID
- Emergency access for individuals: a trusted contact with a delay, for example 48 hours (in a later version)
Suggests the password when you sign in, phase by phase
A website alone cannot fill passwords into other websites: that needs a component on the device. The web vault ships first, then autofill platform by platform.
- Phase 1 — web vault: copy the username, password and code in one click
- Phase 2 — extension for Chrome, Edge, Firefox and Safari: finds sign-in forms, suggests and saves items
- Phase 3 — iOS and macOS: Strong Pass in the system “Passwords” menu (AutoFill Credential Provider)
- Phase 4 — Android: Credential Manager provider and autofill service
- Later — storing passkeys: Strong Pass as a passkey manager
Generator, 2FA codes and breach check
Everything you need to stop reusing one password on ten sites, and to move from your current manager in an evening.
- Password and memorable passphrase generator with adjustable length
- TOTP two-factor codes right in the item
- Breach check via Have I Been Pwned with k-anonymity: only the first characters of the hash are sent
- Weak and reused passwords highlighted
- Import from 1Password, iCloud, Chrome and Bitwarden; export at any time
You hold the keys, we hold ciphertext
A short map of the Strong Pass keys. The server sees only encrypted data and wrapped keys; they can be decrypted only on the user's device.
What opens it
- Passkey (WebAuthn PRF)
The main path: Face ID, Touch ID, Windows Hello, one key per device
- Master password
The fallback, Argon2id, where the browser does not support PRF yet
- Recovery key
A printable Recovery Kit; in an organization, also the organization recovery key
Random 256 bits. Each sign-in method stores its own wrapped copy of this key
- X25519 key pair
The private key sits under the account key. It enables sharing without revealing anything to the server
- Vault key
Personal or shared; wrapped with each member's public key
- Items
Login, password, TOTP, note, card: AES-256-GCM with the vault key
- Only WebCrypto and proven libraries (libsodium); the format is versioned
- Losing every passkey, the master password and the Recovery Kit means losing the data; this is explained during setup
- Before launch: an external cryptography audit and a penetration test
- The Strong Disk link: keys of password-protected Disk files could be kept in the vault, so the file opens with the same Face ID
Strong Pass and well-known password managers
Based on the vendors' official pages. For Strong Pass, “Planned” means designed but not released yet.
Scroll the table sideways →
| Feature | In developmentStrong Pass | 1Password | Bitwarden | Apple Passwords | Google Password Manager |
|---|---|---|---|---|---|
| Zero-knowledge encryption | Yes: on-device only | Yes: password + Secret Key | Yes | Yes, end-to-end by default | On-device encryption is opt-in |
| Unlock the vault with a passkey | Yes: WebAuthn PRF | Beta for new Individual accounts | Yes, with a PRF-capable passkey | — | Google password or screen lock |
| Self-hosting | Planned | No | Yes (Families and Enterprise) | No | No |
| Organization recovery | Yes: two of N admins | Yes, by admins | Yes, in Enterprise | No: devices, contact or key | — |
| Estonian eID | Planned: ID-card, Mobile-ID, Smart-ID | Only via an SSO identity provider | Only via SSO (Enterprise) | — | — |
| Data location | Planned: Estonia/EU or your server | US, Canada or EU | US or EU, or your server | iCloud | Google Account |
| Web access without an app | Yes: pass.strong.ee | Yes, 1Password.com | Yes, web vault | Not on iCloud.com | Yes, passwords.google.com |
| Shared vaults for teams | Yes: Strong ID organizations | Yes, shared vaults | Yes, collections | Shared password groups | Single passwords, with family |
| Open source | To be decided | No | Yes, clients and server | — | Chromium code is open |
| Price for teams | At launch | $24.95/mo up to 10 people or $8.99/user/mo | $4 or $6 /user/mo | Free | Built into Chrome and Android |
Other products as described on their official websites and documentation on 22 October 2026; vendors' features and prices may change. Sources are listed in docs/18-password-comparison.md. “—” means we could not confirm it from official sources.
Pricing at launch
Plans are not decided yet. Strong Pass will be sold through Strong Console, in the cloud and on your own server, and bundled with Strong Disk. Leave a request and you will hear first and join early access.
- Strong Cloud
- On request at launch
- Your own server
- On request at launch
Built to pass a city office procurement
The requirements we are designing Strong Pass around for the public sector and large organizations. Items marked “planned” arrive in phases after the first version.
- Your own server (on-prem) or a cloud with data in Estonia and the EU; works without outbound internet
- Planned: sign-in with Estonian eID — ID-card, Mobile-ID, Smart-ID — via Strong ID
- Planned: the organization's corporate SSO — Entra ID and AD FS
- An E-ITS document package: audit log, separation of roles, password policy, backups
- Organization policies: required passkey or 2FA, password length, export ban, session lifetime
- Activity log without item contents, with export to a SIEM
- Estonian interface and WCAG 2.1 AA accessibility
- A data processing agreement (GDPR DPA), external audit and pentest before general availability
Frequently asked questions
When will it launch?
Strong Pass is in beta at pass.strong.ee for organizations on Strong ID. Next come browser extensions, iOS/macOS and Android apps, eID and the public-sector package. General availability follows an external audit and pentest. Leave a request and we will bring your team in.
Can I import from 1Password?
Yes: Settings → Import takes 1Password (1PUX or CSV), iCloud and Chrome (CSV) and Bitwarden (JSON or CSV). The file is parsed and encrypted in the browser. Export your data at any time.
What if I lose my phone?
The vault opens with another passkey (for example one synced through iCloud or Google), the master password or the printable Recovery Kit. For an organization's employee, two admins can restore access. If everything is lost at once, the data cannot be recovered, and we say so clearly during setup.
Can the organization's admin read my passwords?
No. Admins manage access and can restore it for an employee — two of them, logged and with a notification — but items are decrypted only on the user's device. Neither the admins nor we can see the passwords.
Can it run on our own server?
Yes, that is part of the design: for the public sector and large organizations Strong Pass will run on your server, including without internet access, with your own Strong ID domain. In Strong Cloud, data will be stored in Estonia and the EU.
How is it related to Strong Disk?
Strong Pass uses the same encryption format as password-protected files in Strong Disk, which already works. Later, the keys of such files could be kept in the password vault, so a protected file opens with the same Face ID without typing the file password.
Bring your team to Strong Pass
Tell us how many people you have and what you are moving from: we will bring your organization into the beta and take your requirements into account, including for public procurement.