Orbit

Domain command

No vault

Live orbit

Everything you own, by time left

Closer to the core means closer to lapsing

Lapsed Under 15d Under 45d Clear

Renewal load

What is due, month by month

Spread

By registrar

⌕ /

	Left	Domain	Registrar	Expiry	Renewal	Login ID	Password	Action

Nothing matches that filter

Clear the search or pick another registrar to see your domains again.

Acquisition fund

What the shortlist costs

Total asking

Set aside

Still to raise

⌕

No targets yet

Add a domain you want, what the seller is asking, and how much you have set aside.

Connecting\u2026

Saved in your Cloudflare D1 database, so every device you sign in on sees the same portfolio. Passwords are still encrypted in your browser before they leave it.

Add domain

Fill in what you know. You can finish the rest later.

Domain

Registrar

Expiry date

Auto renew is on at the registrar

Leave this off and the domain carries a Manual tag, because those are the ones that bite.

Note

Registrar login page

Filled in automatically for known registrars. Renew opens this link.

Password lives in my password manager, not here

The safest setting. The row shows a Manager tag and no password is stored.

Password is locked. Unlock the vault to view or change it. Everything else here is still editable.

Encrypted with your vault passphrase before it is stored. Never written as readable text.

Add target

A domain you want, what it costs, and what you have put aside so far.

Domain

Asking price (₹)

Set aside so far (₹)

Why you want it

Where to buy

Paste the listing link if you have one. Otherwise Buy runs a lookup for the name.

How your logins are protected

Four layers, strongest first.

The password screen on open

The password is checked on the server against the APP_PASSWORD secret in your Cloudflare project. A signed, HttpOnly session cookie is issued on success, and every data request is refused without it. Change the password in Pages settings and every device is locked out until it is entered again.

Two factor at every registrar

Even a stolen password fails without your second factor. Turn it on at Cloudflare, Namecheap, Hostinger and GoDaddy, and switch on registrar lock so a transfer cannot start quietly.

Keep passwords in a password manager

The strongest option for the password itself. Store only the login ID here, tick the manager toggle, and let your manager fill the registrar login when Renew opens it. Nothing sensitive ever sits in this file.

The vault, for anything you do store

Passwords are encrypted with AES 256 using a key derived from your passphrase through 210,000 rounds of PBKDF2. The passphrase is never saved anywhere. The vault relocks after five minutes idle and when you leave the tab, and copied passwords are wiped from the clipboard after 45 seconds.

Where the limits now sit: the gate is real, because the data lives behind the API rather than inside the page, and developer tools cannot conjure a valid session cookie. What still matters is the strength of APP_PASSWORD and the secrecy of SESSION_SECRET. Anyone holding both could sign in from anywhere, so make the password long, and rotate both if you ever paste them somewhere you should not have.

Orbit

Enter your password to manage your domains.

Password

Confirm password

Use the password stored as APP_PASSWORD in your Cloudflare Pages settings. The same one works on every device, and your portfolio lives in the D1 database rather than in this browser.