Fortis

Browser password manager

Autofill the right login. Keep the password off the server.

Fortis is a LastPass-style vault for Chrome and Firefox. When a site asks for a password, the extension offers to save or fill based on that page’s domain. Entries are encrypted on your device with your master password. Signing in also requires an authenticator code, and a session lasts at most 30 days.

Sign in with GoogleInstall extension

Try the seeded demo: demo@fortis.app

What the server stores

  • Ciphertext blobs

    Name, description, domain, username, and password leave the browser only after AES-256-GCM.

  • Auth hash + TOTP secret

    The master password is never uploaded. Login uses a derived hash plus a rotating authenticator code.

  • Opaque 30-day session

    Sessions are hashed at rest and can be revoked. Unlock on this device lasts up to 30 days unless you lock or sign out.

Domain match

github.com fills www.github.com. It will not fill a different site.

Save prompt

When you create a password, Fortis offers to store name, domain, username, and password.

Two-step login

Google sign-in plus Google Authenticator. No SMS. Required every time you sign in.

Zero knowledge

Matching and decrypting happen on the device. The API never sees plaintext.