What's New in Passary
Track our journey as we build the most secure, zero-knowledge password manager. See what's live and what's coming next.
Extension 0.2.2 Security Update
Chrome and Firefox 0.2.2 use stricter website matching and stop pending fills if the vault locks or a browser pairing changes.
Latest Updates
Security Audit Remediation
This release makes Passary more careful about where it offers credentials, how it handles imported data, and what happens when a vault locks.
- Safer autofill: Passary matches the exact website by default. You can choose to allow the same login on subdomains when needed.
- More careful imports: Vault files, password-manager imports, and QR-based setup are checked before Passary processes them.
- Stronger lock behavior: A browser fill stops if the vault locks or its browser pairing is removed. Copied passwords are also cleared more reliably.
- Updated packages: App and development dependencies were updated to resolve reported security issues.
Existing vault files remain compatible, and the update passed Passary's app, PWA, and browser-extension checks.
Popup Status Now Matches Working Autofill
Extension 0.2.1 fixes a state mismatch where context-menu or shortcut autofill worked but the popup still displayed Pairing required and hid matching credentials.
- Authenticated refresh: Opening the popup now verifies the current browser installation against the unlocked vault before rendering.
- Consistent matches: The popup loads the same exact and parent-domain matches used by context-menu autofill after pairing is confirmed.
- No repeated pairing: Existing saved pairings remain valid; update or reload the extension and reopen the popup.
Firefox Support and Separate Browser Pairings
Extension 0.2.0 adds a Firefox 153+ build and lets one encrypted vault remember several browser installations without one pairing replacing another.
- Firefox parity: Popup fill, shortcut fill, right-click actions, and save or update prompts share the Chrome implementation.
- Independent revocation: Settings lists every paired browser profile so one can be removed without disconnecting the others.
- Protocol v2: Encrypted requests identify their browser installation while 0.1.7 Chrome pairings remain compatible.
- Mozilla-ready package: The Firefox build has a stable add-on ID, no-data-collection declaration, exact icons, and a zero-warning validator result. Mozilla signing is still pending.
Clear One-Time Pairing Status
Extension 0.1.7 makes it clear that pairing is saved for each vault and Chrome profile and does not need to be repeated after routine locks and unlocks.
- Paired State: The popup replaces the secure code with a clear paired confirmation after setup.
- Settings Shortcut: Open the correct Browser Extension Pairing screen directly from the popup or download guide.
- One-Time Setup: Locking and unlocking preserves pairing; reinstalling, clearing extension storage, another profile, or another vault requires pairing again.
Authenticated and Encrypted Vault Pairing
Extension 0.1.6 requires a one-time pairing code from the extension popup before credential requests can reach an unlocked vault.
- Explicit Pairing: A random 256-bit code connects the installed extension to the selected encrypted vault.
- Authenticated Requests: Signed requests expire quickly and reused nonces are rejected.
- Encrypted Bridge: Hostnames, submitted credentials, passwords, and TOTP values remain encrypted on page-visible bridge channels.
- Clear Setup: The popup displays the code to copy into the Browser Extension Pairing section in Passary Settings.
Security and Settings Screens Improved on Mobile
The Security Center and vault Settings now fit smaller screens more naturally, with clearer information, readable controls, improved spacing, and larger buttons that are easier to use on touch devices.
Tag Icons Now Stay Consistent
Your chosen tag icons now appear consistently in the desktop vault, mobile layout, and installed Passary app. Changing an icon also refreshes correctly throughout the currently opened vault.
More Reliable Offline Vault Access
Passary now starts more reliably without an internet connection after the vault app has been opened online once. Moving between the unlock, create, and vault screens is also smoother and no longer requires a page reload.
- Dependable Offline Start: Reopen Passary and reach the unlock screen even when your device is offline.
- Smoother Vault Navigation: Unlocking, creating, locking, and returning to your vault now happen within the same app session.
- Offline Vault Workflows: Saved local vaults remain available for viewing, editing, saving, exporting, locking, and reopening without a connection.
- Local-Only Privacy Preserved: Vault contents, passwords, keys, and unlocked sessions remain on your device and are never added to the files used to start Passary offline.
Reliable Vault Connection Restored
Extension 0.1.5 fixes the connection regression that could leave the popup disconnected even when the Passary vault was open and unlocked.
- Reliable Tab Discovery: The extension can find the unlocked Passary tab again after navigation or a background-worker restart.
- Web Bridge Repair: The unlocked vault now answers extension status checks reliably after the user moves from the unlock screen into the vault.
- Clear Connection Diagnostics: The popup now distinguishes a missing vault tab, blocked page access, an unanswered bridge, and rejected document identity.
- Security Boundary Preserved: Credential access remains limited to the approved vault route, top-level tab, verified document, origin, unlocked session, and matching destination.
Full Security Remediation and Extension 0.1.2
We completed a full security review of the Passary web app and browser extension. The update closes a critical extension bridge issue, strengthens secret handling, and adds automated checks to help prevent the same classes of problems from returning.
- Extension Trust Boundary: Version 0.1.2 verifies the Passary vault tab, document, route, and session before accepting bridge messages or releasing credentials. Captured submissions now use expiring permission leases and a 60-second in-memory limit.
- Destination-Bound Autofill: Credentials are released only when the selected vault item matches the current site, and fills are cancelled when navigation replaces the target document.
- Web and Vault Hardening: Vault pages now use per-request script nonces, safer external links and structured data, stronger auto-lock checks, stricter vault-header validation, and bounded import processing.
- Verified Releases: Extension archives are reproducible across platforms and published with a SHA-256 checksum. Dependency audits, package signatures, secret scanning, CodeQL, and regression tests are now automated.
If you installed extension 0.1.5 or an earlier unpacked build, remove it and install the latest release. Version 0.1.6 adds encrypted pairing while retaining the earlier security and connection fixes.
Vault Security Hardening
We shipped a focused hardening update for vault links, legacy vault unlocks, import parsing, and secret copy behavior.
- Safer Vault Links: Stored entry URLs now render as clickable links only when they use a safe web scheme.
- Legacy Vault Guardrails: Older V1 vault headers now get stricter key-derivation parameter checks before unlock work begins.
- Import & Clipboard Safety: Google CSV imports now have tighter field-count limits, and copied passwords use the same timed clipboard clearing as one-time codes.
Security Maintenance Update
We completed a routine dependency and release-maintenance pass to keep Passary’s web app and extension distribution healthier over time.
- Dependency Refresh: Updated package resolution to reduce known dependency advisories without changing how your vault works.
- Cleaner Extension Packaging: Tightened the downloadable browser extension package so public builds ship only the files needed for installation.
- Release Hygiene: Continued refining the safety checks around build and distribution so future updates are easier to verify before rollout.
Passary Extension Early Access
We now have the first browser autofill milestone in place. This is still an early access release, but Passary can already connect to an unlocked vault tab and help with real login flows without changing our offline-first, zero-knowledge model.
- Popup Autofill: Look up matching accounts, choose the one you want, and fill username, password, and TOTP from the extension.
- Save & Update Prompts: Passary can detect submitted logins and offer to save a new credential or update an existing one.
- Right-Click Autotype: For faster use, the extension now supports browser context-menu actions for full login fill, username only, password only, and TOTP only, including multi-account selection on supported sites.
Core Stability & Reliability Hardening
This update is focused on reliability rather than a headline feature. We completed a broad core-app hardening pass to make Passary safer to maintain and easier to verify without changing the fundamentals of how your vault works.
- Safer Core Architecture: The vault interface and internal session logic were broken into smaller, more testable modules so future updates are less likely to introduce regressions.
- Stronger Regression Coverage: We expanded automated tests around crypto, storage, persistence, imports, tag and folder workflows, and other high-risk vault behavior.
- Release Hardening: We added stricter release verification, architecture docs, and manual smoke procedures so core changes are easier to validate before shipping.
Experimental PWA Support
We've introduced experimental Progressive Web App (PWA) support, allowing you to install Passary directly to your device for a native-like experience.
- Offline Access: Fully functional without an internet connection. Your vault is always available, wherever you are.
- Native Integration: Installs to your home screen or desktop, running in a dedicated window without browser distractions.
- Smart Context Switching: Intelligent navigation ensures your secure vault session remains isolated while allowing easy access to external resources.
Visual Polish & Mobile Refinements
We've continued to refine the user interface based on your feedback, with a strong focus on mobile usability and visual consistency across the entire app.
- Mobile Layout Unified: The mobile navigation now features a seamless "All Entries" row that perfectly matches the styling of Favorites and Recent items, removing visual clutter.
- Folder Actions: You can now create and manage folders directly from the "All Entries" list on mobile, bringing full feature parity with the desktop sidebar.
- Desktop Icons: We've updated the desktop sidebar with cleaner, unified iconography and polished active states for a more modern look.
- Compact Mode Polish: Fine-tuned the spacing and sizing in Compact Mode to ensure every element aligns perfectly, regardless of your density settings.
Performance Boost & Import Improvements
We've focused on optimizing the core vault experience, making it faster and smoother for users with large collections, alongside refining the import process.
- Vault Performance: Significant rendering improvements for vaults with 1000+ items. Navigation and scrolling are now buttery smooth thanks to advanced virtualization.
- Better Imports: Fixed an issue where importing from KeePass or Google Password Manager would trigger an unnecessary file download. Imports now seamlessly save to your local browser storage.
- Search Improvements: Added a quick clear button to the search bar for faster interactions.
Tags Management, Compact Layout & UI Improvements
We've kicked off 2026 with a comprehensive update focused on refining the core user interface and organization tools, ensuring a consistent and powerful experience across all devices.
- Improved Tags Management: We've completely overhauled how you handle tags on mobile. A new floating selection bar allows for rapid bulk actions, and we've added smart tools to identify and clean up unused tags, keeping your vault organized.
- Compact Layout: For power users who prefer high information density, the "Compact View" setting now applies universally. Whether you're on the desktop sidebar or the mobile navigation drawer, the interface respects your preference for tighter spacing and smaller text.
- UI Improvements: The mobile experience has received significant polish. The folder navigation now supports full hierarchy with visual indentation, ensuring deep folder structures are easy to navigate. We've also refined action buttons to be more accessible on touch screens.
Integrated 2FA Authenticator
You can now generate 2FA codes directly within Passary, keeping your login flow fast and completely local.
- Built-in Authenticator: Replace your phone app for desktop logins. Everything stays offline.
- QR Code Support: Upload a QR code image to instantly set up your TOTP secrets.
- Auto-Clear Clipboard: Copied codes are automatically wiped from your clipboard after 30 seconds.
Keyfiles & V2 Vaults
We've introduced Keyfile support and a new V2 vault format, strengthening Passary's local-only security model.
- Password + Keyfile Protection: Vaults can now require both your master password and a keyfile stored separately. Without the exact keyfile, the vault cannot be unlocked.
- V2 Vault Cryptography: New vaults use Argon2id + HKDF-SHA256, with vault-specific binding and authenticated headers for stronger offline attack resistance.
- Risk-Aware Settings Layout: Settings are now organized by security impact, clearly separating everyday preferences from irreversible cryptographic operations.
Google Password Manager Import
We've added a highly requested feature to make switching to Passary even easier. You can now securely import your passwords directly from Google Password Manager (Chrome).
- Local-Only Processing: Your CSV export is parsed and encrypted entirely within your browser—no data is ever sent to our servers.
- Intelligent Merge: Passary automatically handles duplicates and conflicts to ensure a clean vault.
- Step-by-Step Guide: We've published a detailed guide to help you migrate safely and securely delete your unencrypted export file.
Documentation & Transparency Updates
We've added comprehensive resources to help you get the most out of Passary while maintaining our commitment to transparency.
- Complete KeePass Import Guide: Published a detailed step-by-step tutorial covering the entire migration process, from finding your .kdbx file to verifying imported data. Includes troubleshooting tips for common issues and answers to frequently asked questions.
- AI Usage Policy: Added a transparent policy defining how AI systems can interact with Passary's content. We've clarified what's permitted (indexing, transient processing) and what's strictly prohibited (training, embeddings, datasets) to protect both intellectual property and user privacy.
Seamless KeePass Import
migrating from KeePass has never been easier. You can now import your existing .kdbx vault files directly into Passary, entirely client-side.
- Zero-Knowledge Processing: Your database is decrypted locally in your browser, ensuring no sensitive data ever touches our servers.
- Full Support: Compatible with both KDBX v3 and v4 file formats.
- Structure Preservation: Option to maintain your existing folder hierarchy or flatten the structure during import.
- Data Integrity: Automatically imports titles, usernames, passwords, URLs, notes, and custom fields.
Mobile Experience Optimized
The mobile experience has been significantly tweaked and optimized. Accessing your vault on the go is now smoother and more user-friendly than ever.
- Responsive Layout: Optimized views for all screen sizes, eliminating horizontal scrolling.
- Mobile Navigation: New slide-out drawer for easy access to folders and filters.
- Touch-Friendly Controls: Larger buttons and improved spacing for better usability on touch devices.
Domain Migration Completed
We have successfully moved from passary.hu to passary.com. The service is back to normal and fully operational.
Keyboard Shortcuts Update
We've refined the keyboard shortcut system for better compatibility and ease of use.
- Improved Handling: Tweaked shortcuts to function better across different operating systems.
- Conflict Resolution: Resolved conflicts with browser defaults for a smoother experience.
Official Launch
We are thrilled to announce the initial release of Passary! This version brings the core functionality of our zero-knowledge password manager to your browser.
- Zero-Knowledge Vault: Your data is encrypted locally before it ever leaves your device.
- Secure Encryption: Industry-standard AES-256 and Argon2id hashing.
- Local-First Architecture: Designed for speed and privacy.
- Responsive Design: Access your vault seamlessly on desktop and mobile.
In the Works
Firefox on Mozilla Add-ons
Firefox 0.2.2 is packaged and validated. Public installation and automatic updates will open after Mozilla reviews and signs the add-on and the signed build passes final checks.
View Firefox release status