Changelog
Notable changes to Octa Pass, newest first. Subscribe with the RSS feed.
The browser extension opens in a tab
The toolbar button now opens Octa Pass in a browser tab with the web vault's full layout, and the in-page menu, save prompts and passkey prompt are redesigned.
Faster Rust test builds
Each crate's integration tests now build as one binary, and debug builds carry less debug info, so tests link faster and target/ stays much smaller.
Passkeys answer PRF; fixes for Safes and the Mac app's browser and SSH connections
Octa Pass passkeys now support the WebAuthn PRF extension, so the browser extension's Touch ID unlock passkey can be kept in Octa Pass on a Mac or iPhone; Safes kept on one device stay there, synced ones sync on their own on the Mac, iPhone and Android, and the Mac app connects to Firefox and starts its SSH agent.
The public alpha is open in the web vault
Free accounts are open at vault.octap.app. The website now sends you there, shows which apps are coming to the stores, and links to the source of each one.
Safes gets a tab on phones, and Health one row in the sidebar
On iPhone and Android, Safes takes the Generator's place in the tab bar; on the Mac and iPad, Health is a single sidebar row with its score.
The server's Docker image builds again
apps/server/Dockerfile had fallen behind the workspace; it now copies the relay crate, builds the Tools WASM core and no longer races on the cargo cache.
The autofill list narrows as you type, and can fill when a page opens
In the browser extension, the in-page list now shows only the logins matching what you type in the username field, its text is readable on every site, and an opt-in setting fills the login you used last as soon as a sign-in page opens.
On a Mac, Octa Pass is now the native app
The native SwiftUI Mac app replaces the Tauri desktop app on macOS; the Tauri app stays on Windows and Linux.
The Mac app works with the browser extension, the CLI and SSH
The native Mac app unlocks the browser extension and the octapass CLI with Touch ID, and runs the SSH agent, as the Tauri app did.
Native desktop apps, starting with the Mac
The desktop app is moving from a web view to native apps on the same Rust core, starting with a SwiftUI app for macOS.
An open vault doesn't ask to reveal or copy
While Octa Pass is unlocked, revealing and copying never ask for Face ID or your master password, however it was opened. Exporting, your Secret Key and your account settings still ask every time.
The docs sidebar lists its pages again
The docs sidebar showed its section headings with no pages under them. Every section now lists its pages, in English and Arabic.
Unlocking is enough to reveal and copy
Once you unlock Octa Pass with Face ID, your fingerprint, your device's lock or your master password, revealing and copying a password don't ask again until it locks.
Each website once, and a warning when a password is reused
A login no longer lists the same site two or three times after importing from several apps, and its page now says when its password is also on other logins.
The roadmap now lists what isn't built
The roadmap's status was checked against the code after every November branch merged, and it now has a list of what's still missing before 1.0.
Saving no longer asks you to unlock
Logins, addresses, cards and API keys you save while Octa Pass is locked wait on your device, sealed, and are added to your vault the next time you unlock.
Octa Pass stays unlocked while you're logged in
A new setting, on by default in the desktop and phone apps and the browser extension, opens Octa Pass without a prompt while your device is unlocked. Revealing and copying ask once, and exporting always asks.
Autofill keeps to your part of a site
Octa Pass now suggests the logins for the page's own address, the domains above it and the addresses below it, not those for other parts of the same site. They're one tap away, and filling one offers to add the page to it.
The phone apps are native only
The earlier Tauri phone app, which showed the web vault's screens in a web view, is removed. The native iPhone, iPad and Android apps replace it.
A build command for each app
pnpm build:desktop, build:macos, build:windows, build:linux, build:cli, build:vscode and build:jetbrains join the existing app builds, and every build asks which server the apps offer as "Octa Pass".
The desktop app runs in the background
The desktop app has an icon in the menu bar or system tray and opens when you sign in to the computer, so quick access and the browser extension are ready straight away. Both can be turned off.
The development scripts ask instead of guessing
pnpm start asks where people open the server and who can sign up, and the iPhone, Simulator and Android scripts pick the device, team and server or let you choose.
Touch ID in the Firefox extension goes through the desktop app
In the Firefox extension, Settings → Security no longer offers an Unlock with Touch ID switch that failed with "The operation is insecure". It links to the desktop app instead.
Each Health check opens its own list
Health now shows your score and a tile per check; choosing one opens that check's passwords on a page of their own instead of one long page with every list.
Importing straight from Apple Passwords works on the iPhone
Moving passwords from the Passwords app to Octa Pass with Export Data to Another App failed with "This file can't be imported with the source you chose". It now imports.
iPhone builds for App Store Connect
pnpm build:ios now signs the iPhone app for App Store Connect and can upload it, and the app carries the privacy manifest and permission texts the App Store asks for.
The iPhone app has the Octa Pass icon
The iPhone and iPad app showed the icon of the framework the first phone app was built with. It now has the Octa Pass icon, on the home screen and in App Store Connect.
The Mac app carries the AutoFill entitlement itself
Builds made with pnpm build:macos now give the Mac app its own provisioning profile and the AutoFill entitlement, as the iPhone app has, so that macOS can list Octa Pass under AutoFill from.
Move your passwords to the Mac app straight from Apple Passwords
On macOS 26, the Passwords app's Export Data to Another App can now send your passwords, passkeys and codes to the Octa Pass desktop app, with no file.
Octa Pass on the Mac under AutoFill from and Set up codes in
The Mac app now opens one-time code setup links, which lists it under Set up codes in on macOS 15, and builds made with pnpm build:macos sign the AutoFill extension so macOS lists it under AutoFill from.
The iPhone and Android builds rebuild their Rust library when it changes
pnpm dev:ios, dev:ios:device, build:ios, dev:android and build:android rebuild the app's Rust library after a pull that changes it, and a failed Xcode build now shows its errors.
Importing your own backup no longer makes copies
An Octa Pass export imported into a vault that already has its items updates them or leaves them alone instead of adding every item again, and saving a login you already have asks first.
Pinned, recent and frequently used lists in the sidebar
The sidebar's Vaults section now starts with Recently created, Pinned, Favourites, Frequently used, Recently used and Recently modified, with Nearby coming soon, on the web, the desktop app and both phone apps.
Local builds rebuild the WASM core when its sources change
pnpm start, pnpm build:web, dev:stack, the end-to-end tests and the Safari build now rebuild the WebAssembly core after a pull that changes the Rust crates, instead of reusing an old build.
Eleven features merged into one branch
Health checks, vault features, key rotation, post-quantum sharing and the key log, organisations, Connect and service accounts, CLI and Git, the developer toolkit, local mode and native parity now live together, with the places where they met made consistent.
Turn off or delete a masked email from Octa Pass
Aliases in use now has Turn off, Turn on and Delete for each alias, for every provider with an API for them.
Arabic in the Safari app and the desktop menu bar
The screen that shows where to turn on the Safari extension, and the desktop app's standard Edit and Window menus, now come in Arabic.
The website and docs are in Arabic
Arabic landing page and docs at /ar/, per-page social images, hreflang links, and the setup for community translations through Weblate.
The CLI edits items, and an SSH agent and Git signing arrive
Create, edit and delete items and sign up from the terminal, hide secrets in `octapass run` output, unlock the CLI through the desktop app, serve SSH keys to ssh and Git with per-use approval, and sign commits with keys from your vault.
Counter-based one-time codes work
HOTP codes are now real codes with a Next code button, counter sync and imports, instead of hidden fields.
Confirm before filling a card's security code
A new extension setting asks you to confirm it's you before a card's security code goes into a page.
The developer toolkit
Make and read TLS certificates, keys, JWTs, hashes and encodings on your own device, from the CLI, the web vault and the desktop app, with Certificate and Key items in the vault.
The docs now say what's built
Every page marked planned was checked against the code, and claims about features that don't exist yet were corrected.
The docs as an MCP server
AI tools that speak the Model Context Protocol can now search and read the Octa Pass docs through a small local server.
Opt-in email breach alerts
Health can tell you when your account email or aliases appear in a breach. It's off by default, because this is the one check that sends an address off your device.
Everything planned for after 1.0 is now part of 1.0
The Windows passkey provider, SSH agent, teams, watch apps, post-quantum sharing, the developer toolkit and the file safe all move inside 1.0, and the roadmap now says what's actually built.
Encrypt files, delete them honestly, and keep them in a Safe
Encrypt files in the age format from the CLI, the desktop app or your file manager, and keep them in Octa Pass Safe, an encrypted folder that locks with your vault.
VS Code and JetBrains extensions, and API keys in the browser
Browse references and run with secrets from your IDE, and save pasted API keys or fill bearer tokens from the browser extension.
Items keep their last 10 versions
Open an item's version history to see what it used to say and restore an older version, encrypted like the item itself.
Replace your Secret Key, rotate vault keys, and real emergency takeover
You can now replace your Secret Key and give a vault a new key whenever you want. Emergency takeover works, and family members can opt in to organiser recovery.
Use Octa Pass on this device only, on your computer and phone
Vaults with no account come to the desktop app and the iPhone and Android apps, with encrypted backups, automatic folder backups, several vaults on one device and Turn on sync.
The masked email relay is built, and off by default
Octa Pass now has its own mail forwarder for masked email, for servers that turn it on. It stores no messages, and the hosted service doesn't run it.
Website match rules and your own equivalent domains
Choose how each website on a login matches, and tell Octa Pass which sites share one sign-in.
Import from Zoho Vault, Avira, Norton, McAfee True Key and Kaspersky
Five more password managers can be imported on the device, as best effort, because none of them documents its export.
The phone apps ask before they show a secret
Revealing, copying and exporting in the native apps now ask for your device's lock or master password, and opening the app has its own switch.
SSH keys and environments on iPhone, iPad and Android
The native phone apps can now make, read, edit and save SSH keys, and keep environments with their projects, stages and variables.
Bank accounts, ID documents, crypto wallets and your own item types
Seven new kinds of item in every app, payment QR codes for bank accounts and wallets, and imports that keep these items as what they are.
Octa Pass Connect and live API tokens
A local helper hands approved programs a secret by reference, every hand-out goes in your security log, and API credentials can hold a live OAuth2 token.
Organisations with groups, policies and single sign-on
Teams can now run on Octa Pass with roles, groups, server-enforced policies and OpenID Connect sign-in, with no new key and no path to anyone's vault for admins, the server or an identity provider.
Post-quantum sharing and a key log
Shares are now sealed with hybrid X25519 + ML-KEM-768, and account keys go into an append-only log that clients check. Neither has had the outside cryptographer's review yet.
The security dashboard finishes its list of checks
Health now flags insecure websites, expiring cards and IDs, passkeys you could use, low backup codes and old passwords, and you can dismiss warnings and change a password in one step.
Security questions with random answers
Logins can record security questions in their recovery info, and the generator makes random answers.
Service accounts for CI and servers
A token bound to one shared vault, read-only by default, revocable and logged, that lets a job read secrets without the server ever seeing them.
Generated passwords follow more sites' rules
The login editor's generator and Android's Autofill suggestion now use the site password rules the browser extension already had.
One-time codes on Apple Watch and Wear OS
Watch apps show the one-time codes your phone sends, for 15 minutes at a time. The secrets never leave the phone.
Share Wi-Fi for a day, or write it to an NFC tag
Give a guest a one-time link as a QR code, or write a network to an NFC tag on Android.
Passkey provider for Windows 11
The desktop app can act as a passkey provider on Windows 11, off by default and asking for Windows Hello on every use. Not yet tried on real Windows.
Device auth has separate gates for opening and autofill
Opening Octa Pass and every autofill can now ask for your device's lock independently, with a clear lockless fallback and a master-password gate for secrets.
Bitwarden CSV, Raivo OTP, Ente Auth and encrypted Proton Pass imports
Import from Bitwarden's CSV, Raivo OTP, Ente Auth plain or encrypted exports, and Proton Pass's PGP-encrypted ZIP. Importing an authenticator backup again now updates its codes instead of copying them.
SSH keys get their own item type
SSH keys are their own encrypted item type, with Ed25519, ECDSA and RSA generation, OpenSSH/PEM/PKCS#8 import, guarded private-key viewing and export, in the web vault, the CLI and the extension.
The Android app uses the brand fonts
The native Android app now shows Mona Sans and Monaspace Neon, the same font files the web vault uses, instead of the phone's own font.
Sharing and emergency access in the desktop app
The desktop app now shares vaults, runs families, makes one-time share links and handles emergency access, with every key sealed and opened in the app's own process.
Environments and .env files in the vault
Keep a project's environment variables in the vault, edit them as a table in the web vault and extension, and load them into commands, files and your shell from the CLI.
HTTP sign-in prompts, and exports in the security log
The browser extension can answer a site's username-and-password pop-up once you allow it, and every export now shows in your security log.
Change or reset your master password
Forgot your master password? Reset it with the recovery code from your Recovery Kit. You can also change it in Settings.
Android app preview with Autofill, Credential Manager and Wi-Fi Connect
The Octa Pass Android app runs on the Android emulator, with fingerprint or screen-lock unlock, an Autofill service with suggested passwords, a Credential Manager provider for passwords and passkeys, Wi-Fi Connect and QR codes.
Move between password managers on Android, without a file
On Android, import into Octa Pass from Google Password Manager and other password managers on the phone, or let them take your items from Octa Pass, through Credential Manager's credential transfer.
Attachments and Document items
Keep files with any item, or store them as Document items. Files are encrypted on your device before upload; the server stores ciphertext and its size only.
The autofill engine for the browser extension
The engine the browser extension will use to find forms, show the Octa Pass menu and fill safely is in the repository, with a 76-page test corpus it passes in Chrome.
The browser extension, built from source
Octa Pass now has a Manifest V3 extension for Chrome, Edge and Firefox that fills logins, saves new ones, creates and uses passkeys, unlocks through the desktop app, and works without an account. It isn't in the stores yet, but you can build it and load it unpacked.
The octapass command-line tool (preview)
A native octapass CLI reads items and one-time codes, generates passwords, passes secrets to scripts with octapass:// references, and imports and exports, with a session kept in the OS keyring.
Importers, site matching and local vaults in the core
The Rust core can now import from Chrome, Firefox, Safari, Bitwarden, 1Password, LastPass, any CSV and authenticator apps, match logins to websites safely, follow sites' password rules, and run a vault on one device with encrypted backups.
Desktop app preview (macOS, Windows, Linux)
A Tauri desktop app shows the web vault on a native vault, with Touch ID unlock, quick access and browser integration.
The desktop app only answers its own native host, started by a real browser
Other programs on your computer can no longer ask the desktop app for your account key by pretending to be the Octa Pass browser extension.
Touch ID unlock works in Firefox and Safari
Turning on Unlock with Touch ID in the web vault no longer fails in Firefox and Safari on macOS, and it now takes one fingerprint instead of two.
The apps offer Face ID, fingerprint or passcode unlock right after you sign in
The phone and desktop apps now ask once whether to unlock with your device, so AutoFill on the iPhone no longer asks for your master password every time.
The Docker image serves the web vault, with invites, log codes and backups built in
One container now runs the sync server and the web vault on one port, invites the emails you list at start, can log sign-up codes when there's no SMTP, and makes daily online backups you can restore with one command.
Emergency contacts can open your files
Once emergency access is released, your contact can download the files attached to the items they can see, decrypted on their device.
The extension can replace the browser's password manager, and saves addresses and cards
One switch turns off Chrome's or Edge's own offers to save passwords, addresses and cards (passwords in Firefox), and the extension now offers to save the addresses and cards you type into websites.
Encrypted export, CXF and ten new importers
Export your whole vault, attached files included, as one encrypted file, move passkeys and passwords to any app that speaks CXF, and import from KeePass, Proton Pass, Dashlane, Keeper and more.
Imports keep every field, and importing again updates instead of copying
Imported items keep the other app's dates, ids, HTTP realms and auto-type settings, and importing the same file again updates your items instead of adding copies.
iPhone app preview with AutoFill, passkeys and Wi-Fi Connect
The Octa Pass iPhone app runs in the iOS Simulator, with Face ID or passcode unlock, an AutoFill extension for passwords, passkeys and one-time codes, Wi-Fi Connect and QR codes.
The iPhone app can set up your one-time codes, and both phone apps turn AutoFill on for you
Octa Pass can be the iPhone's app for one-time code setup links and QR codes, and the phone apps have a button that turns AutoFill on.
The native iPhone app moves items to and from other password managers
On iOS 26, the native iPhone app imports from and exports to other password managers through Credential Exchange, with the same review as Android.
The native iPhone app lists your masked email aliases
Masked email in the native iPhone app shows the aliases your logins use, as the web vault does.
Live sync, bulk imports, device management and PostgreSQL
The sync server now pushes changes to signed-in apps as they happen, takes imports in bulk, lets you see and sign out your devices, runs on PostgreSQL, and closes several abuse paths found in a security review.
Files in the iPhone and Android apps
The mobile apps can now add, open and remove attachments and Document files, offline too, with the system's own pickers and viewer.
The core for the iPhone and Android apps
The Octa Pass core now has Swift and Kotlin bindings, so the mobile apps and their autofill extensions can sign in, unlock with Face ID, a fingerprint or the device passcode, fill passwords and codes, and use passkeys.
A fully native Android app
The Android app is rebuilt in Jetpack Compose, with every screen native and every feature of the current app, on the same Rust core.
A fully native iPhone and iPad app
The iPhone and iPad app is rebuilt in SwiftUI, with every screen native, on the same Rust core as the native Android app.
An email when a new device signs in
Octa Pass now emails you whenever a new device signs in to your account, with its name, platform and the time.
All your one-time codes in one list
A new One-time codes category, next to Passkeys, lists every item with a code and shows the current code with its countdown and a copy button.
The passkey authenticator in the core
The Octa Pass core can now create passkeys and sign in with them, checked against independent WebAuthn verifiers. The browser extension will put it in front of websites.
Passkeys on iPhone and Android use the same authenticator as the browser
Signing a passkey request from iOS or Android now runs through the same tested code as the browser extension and the web vault, and refuses shared suffixes like github.io.
The phone apps feel like phone apps
The iPhone and Android apps no longer zoom, bounce or select like a web page. Text size follows your phone, screens slide, menus are sheets, and exports open the share sheet.
Add one-time codes from any QR code, and link them to your logins
Read a site's two-step QR code from the page, the screen, a photo or a screenshot, bring over every account from Google Authenticator's export QR codes, and choose which login each code joins.
The recovery map and masked email
See which email or phone can reset which of your accounts, and give each site its own forwarding address from your own alias provider.
Release builds of the desktop app and extensions for your own server
The desktop app, browser extensions and Safari app can be built for one server and installed outside the stores, the Windows installer can be cross-compiled on a Mac, and a release workflow builds everything on version tags.
The extension, built for Safari
The Octa Pass extension now has a Safari build, packaged in small macOS and iOS apps that show you where to turn it on. It builds and passes checks in WebKit; it hasn't run in Safari itself yet.
Shared vaults now open in the phone apps and browser extension
Vaults shared with you, and your family vault, now open in the phone apps, the browser extension and the desktop app, not only the web vault.
Sharing, families, share links and emergency access on the server
The core and the sync server now support shared vaults with signed grants, families, one-time share links and emergency access. The screens for them come next.
Tighter emergency access and family invites
Adding emergency contacts is rate limited, a contact for one vault gets nothing that opens your other vaults, and pending family invitations get the new key when someone is removed.
One row for several accounts on the same website
When you have several logins for the same website, the item list shows one row for it with the number of accounts. Click or tap it to see the logins under it.
The web vault downloads half as much
The encryption module the web vault loads on first visit went from 1.37 MB to 0.75 MB compressed, with the same unlock speed.
Sort and group your item lists
Item lists can be grouped by type, first letter or vault and sorted by name or date, from one Sort and group menu. All items now starts grouped by type.
Two-step sign-in
Your Octa Pass account can now ask new devices for a code from an authenticator app, a security key or a recovery code after the master password.
Sharing, families, share links and emergency access in the web vault
The web vault can now share vaults, run a family, send one-time share links and set up emergency access. Changes from other devices arrive live, imports are faster, and you can see and sign out your devices.
Website icons in your item lists
Items with a website now show the site's icon instead of a coloured letter. Icons come through your Octa Pass server, never from an icon service, and you can turn them off on each device.
Wi-Fi networks get their own item type
Wi-Fi networks are their own item type and category, with Enterprise settings; the apps mark the network you're on and those in range, import a computer's saved networks and offer to save new ones.
Octa Pass in Arabic, right to left
The web vault, browser extension, desktop app and phone apps now come in Arabic, laid out right to left, and follow your system language or the one you pick in Settings.
The Rust crypto core runs in the browser
The Octa Pass crypto core is built. Key derivation, encryption, OPAQUE login and the vault tools are now in Rust and compiled to WebAssembly for the web vault.
Auto-type in the desktop app, and AutoFill on the Mac
The desktop app can type a login into other apps' windows, after checking the window belongs to it, and on macOS it fills passwords and passkeys in Safari and other apps through the system's AutoFill.
The extension asks before filling forms from other sites
A sign-in or payment form that a site shows from another site now needs your approval before Octa Pass fills it, and the extension says when the desktop app doesn't recognise your browser.
The free Octa Pass service comes first
Octa Pass is positioned as a free hosted password manager. Open source is how you can trust it, and self-hosting is an option that uses the same apps.
Planned: use Octa Pass without an account
Local mode lets you use Octa Pass on one device with no account and no server, with encrypted backups and one-tap sync later. It arrives in phase 2 with the browser extension.
A new brand and a redesigned website
Octa Pass has a new OP monogram logo, a trust-blue and open-source-green palette, and a product-style website with a live encryption demo.
The sync server runs
The Octa Pass sync server now handles sign-up, login, encrypted sync and full account deletion, and stores nothing but ciphertext.
The web vault now runs on the real crypto core and sync server
Sign up, sync, lock, device unlock and account deletion in the web vault now use the Rust core in WebAssembly and a real Octa Pass server, and an end-to-end test checks that the server only ever stores ciphertext.
A first look at the web vault
You can now run the Octa Pass web vault locally. Create an account, save your Recovery Kit, manage items, check your passwords' health and unlock with Touch ID or Windows Hello, all on demo data for now.
Octa Pass kicks off, with plans, docs and a website
The idea was reviewed and renamed to Octa Pass, the plans and security design were written, and the docs website went up with llms.txt and an agent skill.