AChep Release Notes

This release adds S3 storage support for KDBX vaults, and system authentication unlock on Linux.

New

Linux: Added system authentication unlock via polkit (#1550).

Windows: Added auto-lock when the system becomes inactive (#1602).

Windows: Added an ARM64 .msi installer (#727).

Bitwarden: Added DNS server auto-discovery.

KDBX: Added support for S3 storage.

GPG: Added generating and editing of V6 certificates.

Improvements

macOS, Windows: Experimental auto-type is now available from the Quick search window.

Desktop: Application startup is now faster.

Android: Window content is now marked as accessibility data sensitive.

Android: Ecosia and Via browsers are now included in the list of privileged browsers (#1571).

Android: Non-privileged apps are now prompted for authorization when requesting passkeys (#1607).

Android: Installed app icons now render at the requested size.

Bitwarden: FIDO2 two-factor authentication is now supported directly in the app (#1264).

WebDAV: A preference is now available to prefer WebDAV transactions (#1585).

Generator: A recipient ID can now be specified for the addy.io email forwarder (#1628).

Backups: A setup wizard now guides backup configuration.

UI: Switches now display Material Design 3 on and off icons (#1621, thanks @Shimmerfly).

UI: Pressing Esc now exits the item screen (#1588).

Data: Updated translations and the list of browsers allowed to request passkeys.

Security

Desktop: Exports are now saved atomically with owner-only file permissions.

Vault: Secrets in memory are now cleared more thoroughly.

GPG: OpenPGP private operations now avoid RSA factor recovery.

Fixes

Desktop: Fixed changing URI match detection causes crashing (#1617).

Desktop: Fixed data and downloads folders so missing folders are created on a fresh profile.

Desktop: Fixed pressing Esc so it closes popups before popping navigation entries.

Windows: Fixed remember key approval not working on Windows (#1618).

Windows: Fixed the Downloads folder resolution so it resolves when missing or redirected.

Android: Fixed app password reprompt does not work in autofill, duplicates, and vault quick actions (#2).

Android: Fixed a crash when launching autofill authentication.

Android: Fixed Internet connectivity detection so wired connections are detected.

Android: Fixed the SSH socket listener so it is retained until cleanup.

Wear OS: Fixed unable to switch language on the watch version (#1609).

Wear OS: Fixed incorrect formatting of the "Save vault key on disk" pop-up prompt on the watch (#1608).

Autofill: Fixed unable to block loopback autofills (#1620).

Watchtower: Fixed Watchtower configuration not preserved after editing (#1626).

Watchtower: Fixed Watchtower overview shows reused passwords count, but detail page is empty (#1606).

Watchtower: Fixed the website leak screen so it shows a warning on request error instead of an empty state.

Watchtower: Fixed website leak matching so domains are matched correctly.

Watchtower: Fixed folder handling when opening directly into a hidden account.

Send: Fixed max access count so values with leading spaces are not converted to no limit.

Attachments: Fixed "Select all" so it selects only filtered items instead of all items.

Attachments: Fixed downloaded attachments so items with reprompt enabled require authentication.

Attachments: Fixed attachment previews so files exceeding the size limit are not downloaded completely.

Bitwarden: Fixed two-factor authentication email delivery so retrying is immediately allowed upon failure.

Vault: Fixed the folders screen so it respects the hidden accounts setting.

Vault: Fixed the Luhn check so it fails for strings containing non-digit characters.

Unlock: Fixed vault creation so a race condition navigating to the unlock screen is prevented.

Unlock: Fixed hardware key operations so poisoned locks do not block them.

KDBX: Fixed placeholder formatting and XML parsing so maximum depth limits are enforced.

WebDAV: Fixed WebDAV surrogate decoding so characters are decoded correctly.

GPG: Fixed secp256k1 signature verification so signatures are normalized.

GPG: Fixed inline OpenPGP signature compatibility so it is enforced.

Generator: Fixed default email selection so verified emails are prioritized.

UI: Fixed copy username shortcut not working in main screen in landscape mode (#1586).

UI: Fixed the QR code so it fits into the dialog.

UI: Fixed the sort menu so its state remains consistent.

UI: Fixed dismissed notifications so they are removed from the screen.

New

Linux AppImage builds now support zsync delta updates.

Added GPG public certificate validation.

Agents

Improves SSH and GPG agent reliability on Android.

GPG key details now respect configured policies.

SSH and GPG keys are revalidated after an agent request is approved.

Platforms

Improves reliability when running multiple app instances on Windows.

Improves system tray icon reliability on desktop platforms.

Fixes

Syncing local accounts no longer requires an active internet connection.

The 'Mark all as read' action in Watchtower now applies only to the currently filtered items.

Moving an item to the root of a KDBX database is now saved correctly.

Creating a Bitwarden Send now requires selecting a destination account.

Changing backup settings no longer resets the retention policy.

Ensures the latest master password is used for authentication.

Improves WebDAV sync reliability.

The vault item details screen now updates immediately when the Markdown notes preference is changed.

Fixes progress display for cancelled or failed vault exports.

Invalid regular expressions are now rejected in input fields.

The key generator shows an OpenPGP-specific tip for RSA keys.

The color picker selects the nearest available palette color.

New

Keyguard for Linux is now available as an AppImage.

KDBX

Fixes password decryption in KDBXv3 databases that have protected pooled attachments.

KDBXv3 AES padding is now validated.

Correctly handles both compressed and raw KDBX attachments.

Fixes an issue with byte mirroring during database decoding.

Line endings in KDBX XML data are now normalized according to the XML specification.

Preserves UTF-16 surrogate pairs when handling KDBX XML data.

Fixes

On Android, the app now requests the local network access permission when required.

Database schema migrations on desktop platforms are now atomic.

File encryption and decryption operations can now be cancelled.

Fixes handling of large OpenPGP MDC files.

This release introduces several new capabilities for managing GPG keys, improves support for KeePass KDBX vaults, and includes various platform-specific stability fixes.

GPG and SSH

Added an option to export GPG public and private keys as .asc.

Added an option to send the verification email when uploading a GPG public key.

Caches by-email VKS responses during throttle windows.

Key names are now fetched after unlocking if displaying key names is disabled.

Platform improvements and fixes

KDBX databases with a key file set no longer require a password.

Displays a more detailed error message when failing to open a URI on desktop platforms.

Fixed a crash on Android when the file picker reports that no activity was found.

Fixed an issue on Windows where the agent process was not stopped before closing the IPC transport.

Fixed copying on macOS.

This release introduces biometric unlock on Windows with Windows Hello, a major overhaul of the OpenPGP pipeline, and significant improvements to sync conflict resolution for KDBX users.

• e009f2ed - refactor: Fix Detekt violations
• baba1021 - Revert "deps: Bump Compose"
• a2373ed1 - refactor: Move Zip service in a util/zip/ KMP module
• a885d303 - refactor: Move Zxcvbn implementation in a util/zxcvbn/ KMP module
• a69856db - chore: Smaller changelog summary is better
• a98219e7 - tests: Clean-up some of the GPG smoke tests
• 5e1ad797 - Merge pull request #1552 from AChep/localization_action
• 1d475f0e - chore: Bump app version to 3.1.0
• bb293191 - tests: Handle elevated Windows child owner
• a38ec41a - fix: Correct Windows hello credential handling
• 44079329 - [AUTO] Update localization library
• 7b296301 - feat: Windows Hello biometric unlock
• 6edcc818 - fix: Support K-9 signing key selection requests
• f2beb82e - tests: Cache UI Automation instance
• c78d836d - refactor: Fix Detekt violations
• 54b991c4 - chore: Pre-install required Rust components during Rust setup step
• f204d80f - Merge pull request #1557 from AChep/dependabot/github_actions/crowdin/github-action-2.17.1
• 96070065 - Merge pull request #1561 from AChep/gpmpasskeysprivapps_action
• aace6d70 - @sannidhyaroy has signed the CLA in #1563
• 38cb70b0 - improvement(GPG): Confirm signer identities with local certification authorities
• 4b2e5b57 - fix(UI): Align hardware unlock button row on the GPG unlock dialog
• 14a2ef22 - chore: merge Compose Multiplatform 1.12.0 upgrade
• 3d11dcaa - deps: Bump Compose
• e2533faf - fix: Disable pending usage history runner on Wear OS #1558
• 97f97cfc - fix: Run pending usage history on default dispatcher #1559
• 4d337c7b - fix: Explicitly disable HTTP cache on download requests
• 880c719f - fix(Bitwarden): Split GPG keys into multiple fields to avoid 5000 symbols limit
• 3a6f49cf - improvement: GPG certificate user ID replace/revoke UI
• c84611e6 - [AUTO] Update GPM Credential Privileged Apps JSON
• 004bf736 - improvement: GPG certificate reconciliation during normal import
• cad26986 - improvement: Add Titanium browser as privileged #1560
• f24669eb - refactor: Fix Lint complains
• dfdd520c - improvement: Reconcile changes in GPG certificates during a conflict
• 5b173e0e - improvement: 3-way merge for conflict resolution for KDBX
• 68ad89a9 - fix: Encode passkey key value as URL-safe base64, fixes incompatibility with BW #1559
• 0a76d715 - fix: Reject invalid keyserver responses
• 499dfb99 - improvement: Preserve GPG revocation evidence and reassess key status
• 7701a732 - improvement: Get GPG key restoration and revocation status
• 4598912e - chore(deps): bump crowdin/github-action from 2.17.0 to 2.17.1
• b8ed80d1 - fix(GPG): Preserve local key material during keyserver refresh
• dbf7024d - fix(agent): Verify macOS login ancestry for approval reuse #1549
• 547645b3 - docs(llm): Take AGENTS.md a bit more seriously
• a493d04a - fix: Update GPG and SSH agent paths on Linux and macOS
• 247a0b80 - fix: Harden SSH and GPG socket lifecycle & discovery
• 3f2d0479 - fix(macOS): Mark gpg agent binary as executable on release
• b732b696 - improvement: Add user ID management and deterministic certificate reconciliation
• 3a57ecea - feat: Overhaul OpenPGP pipeline
• 2dbe4aca - fix(sync): propagate fatal errors
• 96a0c256 - feat: Type a password from memory and compare it with a stored one #1533
• 4edd59b9 - docs: Remove the mention that Keyguard is largely JVM dependent
• 9673b43c - fix(Desktop): Stop SSH/GPG agent IPC servers on shutdown #1548
• 5f6b22e7 - improvement: Explicitly forbid database downgrade #1547
• 1e5ad1b4 - Merge pull request #1546 from ilkecan/fix/desktop-okhttp-bom
• acd217ce - @ilkecan has signed the CLA in #1546
• 56e21e5c - fix(Desktop): Declare the okhttp BOM in desktopApp
• 24827f50 - docs: Note that we do not have browser extension

This release addresses a critical stability issue for Windows users.

Fixes and Improvements

Resolved an issue that caused the application to crash on startup on Windows.

This release introduces comprehensive GPG key management, extends the SSH/GPG agent to Windows, and delivers a completely reworked synchronization engine for KeePass (KDBX) vaults. It also adds major new integrations for Android, WebDAV support for remote vaults, and numerous security and performance enhancements across all platforms.

GPG Key Management and Agent on Windows

Keyguard now includes first-class support for managing GPG keys and using them through an integrated agent, which is now also available on Windows.

GPG Key Management: You can now import, manage, and use GPG keys directly within Keyguard. It is also now possible to set or modify the expiration date for GPG keys and subkeys.

Agent on Windows: The SSH and GPG agents are now available on Windows, providing seamless integration with development tools, terminals, and Git.

Caller-Scoped Approval: Agent requests can be approved on a per-caller basis, allowing you to grant persistent access for trusted applications without being prompted for every operation.

Platform Support: Added support for GPG key item types on Wear OS and resolved an issue where agent-related items were not displayed correctly on Windows.

Security and Reliability: The GPG and SSH agents have been hardened with stricter key policy enforcement during signing and decryption, public key validation before imports, and more robust connection handling.

Reworked KeePass (KDBX) Sync and Attachments

The engine for handling KeePass (KDBX) vaults has been overhauled for significantly improved reliability, performance, and attachment management.

New Sync Pipeline: The synchronization process is now more robust, performing better conflict resolution and handling unstable network connections more gracefully.

Large File Support: The maximum supported attachment size has been increased to 500 MB. KDBX vaults are now processed using a streaming encoder and decoder to reduce memory usage, especially for vaults with large attachments.

Reliable Attachment Sync: Attachments are now staged locally before upload, preventing data loss and ensuring that file changes are synchronized reliably.

Improved Error Handling: A clear error message is now shown when attempting to add an attachment that exceeds the size limit. The app also better preserves original error details during decoding and avoids unnecessary unlock retries when an incorrect key is used.

New Android Integrations

Keyguard's integration with the Android ecosystem has been expanded with powerful new capabilities for developers and third-party app users.

OpenKeychain Provider: Keyguard can now act as an OpenKeychain-compatible provider, allowing apps like Termux to use your SSH and GPG keys for authentication and signing operations.

Credential Exchange (CXF): Added support for Credential Exchange (CXF), enabling secure credential sharing with other compatible Android applications.

Enhanced Autofill Security: Autofill is now more secure, validating both the package name and the signing identity of the target application before filling credentials.

Storage and Backup Fixes: Introduced a recovery mechanism for certain types of encrypted storage failures and ensured all sensitive application data is correctly excluded from automatic Android backups.

Security Enhancements

This release includes several important security improvements to protect your data.

Clipboard Protection: On macOS and Windows, copying sensitive fields (like passwords) now prevents them from being stored in the system's clipboard history.

Hardened KDBX Parsing: Strengthened the parsing of KDBX files from untrusted sources by enforcing limits on key derivation functions (KDF) and validating internal file structures to guard against malformed databases.

Secure Temporary Files: Temporary files created during sync or other operations are now securely permissioned on Windows.

UI and Usability Improvements

Customizable Navigation: The main navigation bar can now be customized. You can add your own filters for quick access to specific item types and reorder the tabs to suit your workflow.

Link Vault Items: You can now create links between vault items. The "Related Items" section has been promoted to a first-class field for better visibility and ease of use.

Easier Folder Creation: It is now simpler to create nested folder structures.

Smarter Selections: When vault items are trashed or archived, they are now automatically removed from any active selection to prevent unintended actions.

Incognito Fields on Desktop: On desktop platforms, password fields now block input method editors (IMEs) to prevent sensitive text from being captured by third-party keyboard utilities.

Fixes and Improvements

WebDAV Support: You can now connect to and browse WebDAV servers to open and save your vault files. Compatibility has been improved for servers that do not support atomic write operations.

Bitwarden Sync: Improved the reliability of Bitwarden vault synchronization by containing JSON parsing failures to a single item and hardening the underlying connection handling.

Flatpak: Fixed an issue that caused a missing tray icon in the Flatpak distribution on Linux.

Watchtower: Watchtower now correctly flags passwords that have appeared in a data breach even a single time.

Performance: Optimized performance for vault list loading, search, and Watchtower scans.

Data Libraries: Updated internal libraries and data sources for passkeys, two-factor authentication services, and public domain suffix lists.