Your team's passwords, behind the same Face ID you sign in with
Strong Password will be a password manager for companies and the public sector. The vault will open with the same passkey or Face ID you use to sign in to Strong ID, with no separate master password every day. Encryption happens on your device: neither we nor a database leak can reveal a single password.
In development: Strong Password is designed but not released yet. The file encryption format it builds on already works in Strong Disk. Everything below describes the plan and design principles, not shipped features.
- 1 gesture
- Face ID or a passkey both signs you in and decrypts the vault
- 0 passwords
- visible to the server: encryption happens on the device only
- 90 days
- of trash and version history for every item
- 2 of N
- admins approve an access recovery
Convenient, fast and no “your data is gone”
We are designing Strong Password around the usual mishaps: a forgotten master password, a deleted item, an employee who left. These are first-version design principles, and they go through an external audit before launch.
Sign in and decrypt with one Face ID
The same passkey you use for Strong ID will, through the WebAuthn PRF extension, provide the secret for the vault key. No second passkey, no re-enrolment.
Zero-knowledge
Items are encrypted and decrypted only in the browser or app. The server stores ciphertext and never receives the keys.
Web first
You will be able to open the vault from any computer in a browser, with no app to install. Extensions and apps come later.
Trash and version history
A deleted item stays in the trash for 90 days, and every item keeps a version history with previous passwords visible to its owner.
Recovery by the organization
An employee forgot everything? Two of N admins grant new access, logged and with a notification. The admins never see the passwords.
Shared vaults
Organization vaults are tied to Strong ID organizations: member roles, an access log without contents, access revoked from Console.
Generator, TOTP and breach check
Password and passphrase generator, two-factor codes (TOTP), breach check with k-anonymity: the password itself never leaves.
Import and export
Move from 1Password (1PUX/CSV), iCloud and Chrome (CSV), Bitwarden (JSON). Export your data at any time.
Need a password? Open a browser
The main Strong Password screen will be on the web, at id.strong.ee under “Passwords” (short address password.strong.ee). Someone else's computer, a new laptop, a desk at the city office: a browser and a passkey are enough.
- The vault in a browser, no app to install
- The same address and passkey as your Strong ID sign-in
- An encrypted cache on the device keeps items available offline
- Auto-lock, lock on minimize, clipboard clearing
- Interface in Estonian, Russian and English
Losing a password will be harder than keeping it
Zero-knowledge and recovery are compatible when recovery keys are set up in advance. Strong Password prepares several ways back ahead of time, and explains honestly during setup when data can no longer be recovered.
- 90-day trash and version history for every item
- Lost your phone: sign in with another passkey, the master password or the Recovery Kit
- Organization recovery: two of N admins, logged and with a notification to the employee; the admins never see the passwords
- A printable Recovery Kit with a recovery key, as in Strong ID
- Emergency access for individuals: a trusted contact with a delay, for example 48 hours (in a later version)
Suggests the password when you sign in, phase by phase
A website alone cannot fill passwords into other websites: that needs a component on the device. The web vault ships first, then autofill platform by platform.
- Phase 1 — web vault: copy the username, password and code in one click
- Phase 2 — extension for Chrome, Edge, Firefox and Safari: finds sign-in forms, suggests and saves items
- Phase 3 — iOS and macOS: Strong Password in the system “Passwords” menu (AutoFill Credential Provider)
- Phase 4 — Android: Credential Manager provider and autofill service
- Later — storing passkeys: Strong Password as a passkey manager
Generator, 2FA codes and breach check
Everything you need to stop reusing one password on ten sites, and to move from your current manager in an evening.
- Password and memorable passphrase generator with adjustable length
- TOTP two-factor codes right in the item
- Breach check via Have I Been Pwned with k-anonymity: only the first characters of the hash are sent
- Weak and reused passwords highlighted
- Import from 1Password, iCloud, Chrome and Bitwarden; export at any time
You hold the keys, we hold ciphertext
A short map of the Strong Password keys. The server sees only encrypted data and wrapped keys; they can be decrypted only on the user's device.
What opens it
- Passkey (WebAuthn PRF)
The main path: Face ID, Touch ID, Windows Hello, one key per device
- Master password
The fallback, Argon2id, where the browser does not support PRF yet
- Recovery key
A printable Recovery Kit; in an organization, also the organization recovery key
Random 256 bits. Each sign-in method stores its own wrapped copy of this key
- X25519 key pair
The private key sits under the account key. It enables sharing without revealing anything to the server
- Vault key
Personal or shared; wrapped with each member's public key
- Items
Login, password, TOTP, note, card: AES-256-GCM with the vault key
- Only WebCrypto and proven libraries (libsodium); the format is versioned
- Losing every passkey, the master password and the Recovery Kit means losing the data; this is explained during setup
- Before launch: an external cryptography audit and a penetration test
- The Strong Disk link: keys of password-protected Disk files could be kept in the vault, so the file opens with the same Face ID
Strong Password and well-known password managers
Based on the vendors' official pages. For Strong Password, “Planned” means designed but not released yet.
Scroll the table sideways →
| Feature | In developmentStrong Password | 1Password | Bitwarden | Apple Passwords | Google Password Manager |
|---|---|---|---|---|---|
| Zero-knowledge encryption | Planned: on-device only | Yes: password + Secret Key | Yes | Yes, end-to-end by default | On-device encryption is opt-in |
| Unlock the vault with a passkey | Planned: WebAuthn PRF | Beta for new Individual accounts | Yes, with a PRF-capable passkey | — | Google password or screen lock |
| Self-hosting | Planned | No | Yes (Families and Enterprise) | No | No |
| Organization recovery | Planned: two of N admins | Yes, by admins | Yes, in Enterprise | No: devices, contact or key | — |
| Estonian eID | Planned: ID-card, Mobile-ID, Smart-ID | Only via an SSO identity provider | Only via SSO (Enterprise) | — | — |
| Data location | Planned: Estonia/EU or your server | US, Canada or EU | US or EU, or your server | iCloud | Google Account |
| Web access without an app | Planned: first priority | Yes, 1Password.com | Yes, web vault | Not on iCloud.com | Yes, passwords.google.com |
| Shared vaults for teams | Planned: Strong ID organizations | Yes, shared vaults | Yes, collections | Shared password groups | Single passwords, with family |
| Open source | To be decided | No | Yes, clients and server | — | Chromium code is open |
| Price for teams | At launch | $24.95/mo up to 10 people or $8.99/user/mo | $4 or $6 /user/mo | Free | Built into Chrome and Android |
Other products as described on their official websites and documentation on 22 October 2026; vendors' features and prices may change. Sources are listed in docs/18-password-comparison.md. “—” means we could not confirm it from official sources.
Pricing at launch
Plans are not decided yet. Strong Password will be sold through Strong Console, in the cloud and on your own server, and bundled with Strong Disk. Leave a request and you will hear first and join early access.
- Strong Cloud
- On request at launch
- Your own server
- On request at launch
Built to pass a city office procurement
The requirements we are designing Strong Password around for the public sector and large organizations. Items marked “planned” arrive in phases after the first version.
- Your own server (on-prem) or a cloud with data in Estonia and the EU; works without outbound internet
- Planned: sign-in with Estonian eID — ID-card, Mobile-ID, Smart-ID — via Strong ID
- Planned: the organization's corporate SSO — Entra ID and AD FS
- An E-ITS document package: audit log, separation of roles, password policy, backups
- Organization policies: required passkey or 2FA, password length, export ban, session lifetime
- Activity log without item contents, with export to a SIEM
- Estonian interface and WCAG 2.1 AA accessibility
- A data processing agreement (GDPR DPA), external audit and pentest before general availability
Frequently asked questions
When will it launch?
There is no date yet. First come passkeys with PRF in the Strong ID sign-in and the web vault, then browser extensions and apps, then eID and the public-sector package. General availability follows an external audit and pentest. Leave a request and we will invite you to early access.
Can I import from 1Password?
Yes, that is the plan: import from 1Password (1PUX or CSV), as well as iCloud and Chrome (CSV) and Bitwarden (JSON). Exporting your data will be there too, with no lock-in.
What if I lose my phone?
The vault opens with another passkey (for example one synced through iCloud or Google), the master password or the printable Recovery Kit. For an organization's employee, two admins can restore access. If everything is lost at once, the data cannot be recovered, and we say so clearly during setup.
Can the organization's admin read my passwords?
No. Admins manage access and can restore it for an employee — two of them, logged and with a notification — but items are decrypted only on the user's device. Neither the admins nor we can see the passwords.
Can it run on our own server?
Yes, that is part of the design: for the public sector and large organizations Strong Password will run on your server, including without internet access, with your own Strong ID domain. In Strong Cloud, data will be stored in Estonia and the EU.
How is it related to Strong Disk?
Strong Password uses the same encryption format as password-protected files in Strong Disk, which already works. Later, the keys of such files could be kept in the password vault, so a protected file opens with the same Face ID without typing the file password.
Be among the first Strong Password users
Tell us how many people you have and what you are moving from: we will invite you to early access and take your requirements into account, including for public procurement.