What's New in Passary

We refreshed the Passary site and setup guidance so it is easier to choose an app, understand the preview, and make a recoverable vault.

• A better first step: The homepage and getting-started guide now explain the Windows and browser paths, creating or importing an encrypted vault, and making a backup you have actually tested.
• Clearer Windows preview details: The download page brings the unsigned-build warning, installation steps, release information, and SHA-256 verification into one place.
• More precise security guidance: The security, zero-knowledge, encryption, recovery, how-it-works, and FAQ pages now explain local storage, optional integrations, device risks, and recovery responsibilities in more detail.
• Easier ways to reach us: Contact and responsible-disclosure pages now separate product help, feedback, privacy requests, and private vulnerability reports.
• Updated policy information: Privacy, terms, cookies, AI use, and legal notices have been reviewed, including a fuller account of third-party software.

This is a site and guidance update, not a newly signed app release. The Windows build remains an unsigned preview; Chrome installation and updates are manual, and Firefox availability still depends on Mozilla signing.

Passary for Windows 0.1.0 brings the encrypted vault into a native desktop workspace. It keeps the vault as a file you choose and can use offline, without a Passary account or provider-hosted vault.

• Your vault, on your PC: Create a vault or open an existing .passaryvault file, with an optional keyfile. Save it where you choose and keep separate encrypted recovery copies.
• A complete native workspace: Organize and edit logins, notes, payment cards, identities, and the other supported record types, including custom fields, multiple website rules, TOTP, and encrypted attachments.
• Bring your data with you: Import supported Google, Bitwarden, and KeePass exports. Web-created V3 vaults can be opened on Windows; older vault formats require an explicit migration and a separately saved V3 copy.
• Review and recover: The native Security Center helps review local vault risks. Item history, encrypted Trash, snapshots, and recovery-kit tools give you more ways to restore data when needed.
• Optional device convenience: You can enroll Windows Hello or a device PIN for quick unlock on that PC. Your master password and any keyfile remain the fallback.
• Connections only when chosen: The core vault works offline. Encrypted sync to a selected folder, WebDAV, S3-compatible storage, or a relay is optional.

This x64 installer is an unsigned preview for Windows 10 version 2004 and later. Installation is per-user, updates are manual, and Windows SmartScreen may show an unknown-publisher warning. Check the published SHA-256 checksum before installing; signed public distribution remains a separate release gate.

Passary Extension 0.3.0 expands local autofill while keeping the unlocked Passary tab as the only place that can decrypt vault data.

• Broader form support: Choose between multiple forms and fill split sign-in steps, supported embedded payment frames, open shadow roots, and segmented one-time-code fields.
• Rich item filling: Compatible payment-card, identity, address, and explicitly named autofill custom fields can be selected from the popup.
• Safer credential workflows: Save a generated password before sign-up, add an exact site to matching credentials, or exclude a hostname from lookup and capture.
• Transport safeguards: HTTP fills require confirmation, and a credential saved for HTTPS cannot be filled through an HTTP downgrade.
• Clear outcomes: The popup reports which individual fields were filled, skipped, blocked, or unavailable.

Existing vaults, login items, pairings, and 0.2.2 HTTPS fill/save/update flows remain compatible. Upgrade the extension for rich targets and the new HTTP safeguards. The versioned Chrome package is available for manual installation; Chrome Web Store and Mozilla Add-ons distribution remain pending external signing and review.

Passary now stores richer records without requiring an account or replacing the login format used by existing vaults and extensions.

• Nine item types: Logins, secure notes, payment cards, identities, software licenses, API credentials, SSH keys, Wi-Fi credentials, and custom records.
• Richer records: Multiple website rules, multiple TOTP generators, custom fields, related items, expiry and reminders, plus encrypted file attachments.
• Higher-fidelity imports: Bitwarden rich records and KeePass custom fields, history, tags, expiry, TOTP, and supported current or historical attachments are preserved locally.
• Security Center v2: Local checks cover password risks, HTTP, known TOTP/passkey opportunities, expiry, duplicates, fragmented accounts, stale items, and advisory breached-domain dates.
• Optional exposure check: A compromised-password range request runs only after explicit acknowledgement and never stores its results in the vault.

Existing single-URL and single-TOTP items remain compatible. The first rich URL and TOTP value continue to serve as the legacy aliases used by current browser extensions.

This release makes Passary more careful about where it offers credentials, how it handles imported data, and what happens when a vault locks.

• Safer autofill: Passary matches the exact website by default. You can choose to allow the same login on subdomains when needed.
• More careful imports: Vault files, password-manager imports, and QR-based setup are checked before Passary processes them.
• Stronger lock behavior: A browser fill stops if the vault locks or its browser pairing is removed. Copied passwords are also cleared more reliably.
• Updated packages: App and development dependencies were updated to resolve reported security issues.

Existing vault files remain compatible, and the update passed Passary's app, PWA, and browser-extension checks.

Extension 0.2.1 fixes a state mismatch where context-menu or shortcut autofill worked but the popup still displayed Pairing required and hid matching credentials.

• Authenticated refresh: Opening the popup now verifies the current browser installation against the unlocked vault before rendering.
• Consistent matches: The popup loads the same exact and parent-domain matches used by context-menu autofill after pairing is confirmed.
• No repeated pairing: Existing saved pairings remain valid; update or reload the extension and reopen the popup.

Extension 0.2.0 adds a Firefox 153+ build and lets one encrypted vault remember several browser installations without one pairing replacing another.

• Firefox parity: Popup fill, shortcut fill, right-click actions, and save or update prompts share the Chrome implementation.
• Independent revocation: Settings lists every paired browser profile so one can be removed without disconnecting the others.
• Protocol v2: Encrypted requests identify their browser installation while 0.1.7 Chrome pairings remain compatible.
• Mozilla-ready package: The Firefox build has a stable add-on ID, no-data-collection declaration, exact icons, and a zero-warning validator result. Mozilla signing is still pending.

Extension 0.1.7 makes it clear that pairing is saved for each vault and Chrome profile and does not need to be repeated after routine locks and unlocks.

• Paired State: The popup replaces the secure code with a clear paired confirmation after setup.
• Settings Shortcut: Open the correct Browser Extension Pairing screen directly from the popup or download guide.
• One-Time Setup: Locking and unlocking preserves pairing; reinstalling, clearing extension storage, another profile, or another vault requires pairing again.

Extension 0.1.6 requires a one-time pairing code from the extension popup before credential requests can reach an unlocked vault.

• Explicit Pairing: A random 256-bit code connects the installed extension to the selected encrypted vault.
• Authenticated Requests: Signed requests expire quickly and reused nonces are rejected.
• Encrypted Bridge: Hostnames, submitted credentials, passwords, and TOTP values remain encrypted on page-visible bridge channels.
• Clear Setup: The popup displays the code to copy into the Browser Extension Pairing section in Passary Settings.

Passary now starts more reliably without an internet connection after the vault app has been opened online once. Moving between the unlock, create, and vault screens is also smoother and no longer requires a page reload.

• Dependable Offline Start: Reopen Passary and reach the unlock screen even when your device is offline.
• Smoother Vault Navigation: Unlocking, creating, locking, and returning to your vault now happen within the same app session.
• Offline Vault Workflows: Saved local vaults remain available for viewing, editing, saving, exporting, locking, and reopening without a connection.
• Local-Only Privacy Preserved: Vault contents, passwords, keys, and unlocked sessions remain on your device and are never added to the files used to start Passary offline.

Extension 0.1.5 fixes the connection regression that could leave the popup disconnected even when the Passary vault was open and unlocked.

• Reliable Tab Discovery: The extension can find the unlocked Passary tab again after navigation or a background-worker restart.
• Web Bridge Repair: The unlocked vault now answers extension status checks reliably after the user moves from the unlock screen into the vault.
• Clear Connection Diagnostics: The popup now distinguishes a missing vault tab, blocked page access, an unanswered bridge, and rejected document identity.
• Security Boundary Preserved: Credential access remains limited to the approved vault route, top-level tab, verified document, origin, unlocked session, and matching destination.

We completed a full security review of the Passary web app and browser extension. The update closes a critical extension bridge issue, strengthens secret handling, and adds automated checks to help prevent the same classes of problems from returning.

• Extension Trust Boundary: Version 0.1.2 verifies the Passary vault tab, document, route, and session before accepting bridge messages or releasing credentials. Captured submissions now use expiring permission leases and a 60-second in-memory limit.
• Destination-Bound Autofill: Credentials are released only when the selected vault item matches the current site, and fills are cancelled when navigation replaces the target document.
• Web and Vault Hardening: Vault pages now use per-request script nonces, safer external links and structured data, stronger auto-lock checks, stricter vault-header validation, and bounded import processing.
• Verified Releases: Extension archives are reproducible across platforms and published with a SHA-256 checksum. Dependency audits, package signatures, secret scanning, CodeQL, and regression tests are now automated.

If you installed extension 0.1.5 or an earlier unpacked build, remove it and install the latest release. Version 0.1.6 adds encrypted pairing while retaining the earlier security and connection fixes.