Montara PassMontara Pass
An end-to-end encrypted password manager you can run yourself.
Montara Pass stores logins and secure notes in a vault that only its owner can open. Everything is encrypted in the browser before it leaves the device, so the server holds ciphertext and wrapped keys and cannot read, search or sort what it stores.
What is in the repository
| Path | What it is |
|---|---|
apps/server | The API: Go, Fiber v3, PostgreSQL 18, sign-in by Authula |
apps/app | The vault web app: a Vite single-page app with TanStack Router and React 19, served by the API |
apps/extension | The browser extension for Chrome and Firefox (Manifest V3) |
apps/web | The marketing site, deployed to Cloudflare Workers |
apps/docs | This documentation: Next.js and Fumadocs |
deploy | A Docker Compose stack for Dokploy |
Where to start
Installation
Run the API, the database and the web app on your machine.
Encryption
The keys, what each one protects and what the server can see.
API reference
Every route of the API, with its request and response.
Browser extension
Build it, load it and fill logins from the vault.
Docker and Dokploy
One image for the API and the web app, and a stack to deploy it.
Development
Lint, format, commit hooks and the checks to run before a change.
What the server never receives
- The master password, and the master key derived from it.
- The vault key, the private key and any item key in the clear.
- Item content: names, usernames, passwords, URLs and notes.
- Folder names.
The item type (login, secure_note) is the one thing stored in the
clear, so clients can filter by it.