Notable changes to Octa Pass: decisions, docs, releases.https://octap.app/https://octap.app/changelog/2026-11-07-extension-app-tab/https://octap.app/changelog/2026-11-07-extension-app-tab/The toolbar button now opens Octa Pass in a browser tab with the web vault's full layout, and the in-page menu, save prompts and passkey prompt are redesigned.Sat, 07 Nov 2026 00:00:00 GMTdecisionextensionhttps://octap.app/changelog/2026-11-07-faster-rust-test-builds/https://octap.app/changelog/2026-11-07-faster-rust-test-builds/Each crate's integration tests now build as one binary, and debug builds carry less debug info, so tests link faster and target/ stays much smaller.Sat, 07 Nov 2026 00:00:00 GMTcoreserverclidesktopmobilehttps://octap.app/changelog/2026-11-07-passkey-prf-and-mac-fixes/https://octap.app/changelog/2026-11-07-passkey-prf-and-mac-fixes/Octa Pass passkeys now support the WebAuthn PRF extension, so the browser extension's Touch ID unlock passkey can be kept in Octa Pass on a Mac or iPhone; Safes kept on one device stay there, synced ones sync on their own on the Mac, iPhone and Android, and the Mac app connects to Firefox and starts its SSH agent.Sat, 07 Nov 2026 00:00:00 GMTcoremobiledesktopextensionclihttps://octap.app/changelog/2026-11-07-public-alpha-website/https://octap.app/changelog/2026-11-07-public-alpha-website/Free accounts are open at vault.octap.app. The website now sends you there, shows which apps are coming to the stores, and links to the source of each one.Sat, 07 Nov 2026 00:00:00 GMTwebsitedocsreleasehttps://octap.app/changelog/2026-11-07-safes-tab-and-sidebar-health/https://octap.app/changelog/2026-11-07-safes-tab-and-sidebar-health/On iPhone and Android, Safes takes the Generator's place in the tab bar; on the Mac and iPad, Health is a single sidebar row with its score.Sat, 07 Nov 2026 00:00:00 GMTmobiledesktophttps://octap.app/changelog/2026-11-07-server-image-builds-again/https://octap.app/changelog/2026-11-07-server-image-builds-again/apps/server/Dockerfile had fallen behind the workspace; it now copies the relay crate, builds the Tools WASM core and no longer races on the cargo cache.Sat, 07 Nov 2026 00:00:00 GMTserverhttps://octap.app/changelog/2026-11-06-autofill-list-and-fill-on-load/https://octap.app/changelog/2026-11-06-autofill-list-and-fill-on-load/In the browser extension, the in-page list now shows only the logins matching what you type in the username field, its text is readable on every site, and an opt-in setting fills the login you used last as soon as a sign-in page opens.Fri, 06 Nov 2026 00:00:00 GMTdecisionsecurityextensiondesktopmobilehttps://octap.app/changelog/2026-11-06-mac-app-is-native/https://octap.app/changelog/2026-11-06-mac-app-is-native/The native SwiftUI Mac app replaces the Tauri desktop app on macOS; the Tauri app stays on Windows and Linux.Fri, 06 Nov 2026 00:00:00 GMTdecisiondesktophttps://octap.app/changelog/2026-11-06-mac-browser-extension-cli-ssh-agent/https://octap.app/changelog/2026-11-06-mac-browser-extension-cli-ssh-agent/The native Mac app unlocks the browser extension and the octapass CLI with Touch ID, and runs the SSH agent, as the Tauri app did.Fri, 06 Nov 2026 00:00:00 GMTdesktopextensionclihttps://octap.app/changelog/2026-11-06-native-desktop-apps/https://octap.app/changelog/2026-11-06-native-desktop-apps/The desktop app is moving from a web view to native apps on the same Rust core, starting with a SwiftUI app for macOS.Fri, 06 Nov 2026 00:00:00 GMTdecisiondesktophttps://octap.app/changelog/2026-11-06-reveal-without-asking/https://octap.app/changelog/2026-11-06-reveal-without-asking/While Octa Pass is unlocked, revealing and copying never ask for Face ID or your master password, however it was opened. Exporting, your Secret Key and your account settings still ask every time.Fri, 06 Nov 2026 00:00:00 GMTdecisionsecuritymobiledesktopextensionhttps://octap.app/changelog/2026-11-05-docs-sidebar-fix/https://octap.app/changelog/2026-11-05-docs-sidebar-fix/The docs sidebar showed its section headings with no pages under them. Every section now lists its pages, in English and Arabic.Thu, 05 Nov 2026 00:00:00 GMTwebsitedocshttps://octap.app/changelog/2026-11-05-fewer-face-id-prompts/https://octap.app/changelog/2026-11-05-fewer-face-id-prompts/Once you unlock Octa Pass with Face ID, your fingerprint, your device's lock or your master password, revealing and copying a password don't ask again until it locks.Thu, 05 Nov 2026 00:00:00 GMTdecisionsecuritymobiledesktopextensionhttps://octap.app/changelog/2026-11-05-repeated-websites-and-reuse-warning/https://octap.app/changelog/2026-11-05-repeated-websites-and-reuse-warning/A login no longer lists the same site two or three times after importing from several apps, and its page now says when its password is also on other logins.Thu, 05 Nov 2026 00:00:00 GMTcoreextensiondesktopmobilehttps://octap.app/changelog/2026-11-05-roadmap-status/https://octap.app/changelog/2026-11-05-roadmap-status/The roadmap's status was checked against the code after every November branch merged, and it now has a list of what's still missing before 1.0.Thu, 05 Nov 2026 00:00:00 GMTdocshttps://octap.app/changelog/2026-11-05-save-while-locked/https://octap.app/changelog/2026-11-05-save-while-locked/Logins, addresses, cards and API keys you save while Octa Pass is locked wait on your device, sealed, and are added to your vault the next time you unlock.Thu, 05 Nov 2026 00:00:00 GMTdecisionsecuritycoreextensionmobilehttps://octap.app/changelog/2026-11-05-stay-unlocked/https://octap.app/changelog/2026-11-05-stay-unlocked/A new setting, on by default in the desktop and phone apps and the browser extension, opens Octa Pass without a prompt while your device is unlocked. Revealing and copying ask once, and exporting always asks.Thu, 05 Nov 2026 00:00:00 GMTdecisionsecuritydesktopmobileextensionhttps://octap.app/changelog/2026-11-05-subdomain-autofill/https://octap.app/changelog/2026-11-05-subdomain-autofill/Octa Pass now suggests the logins for the page's own address, the domains above it and the addresses below it, not those for other parts of the same site. They're one tap away, and filling one offers to add the page to it.Thu, 05 Nov 2026 00:00:00 GMTdecisionextensiondesktopmobilecorehttps://octap.app/changelog/2026-11-05-tauri-phone-app-removed/https://octap.app/changelog/2026-11-05-tauri-phone-app-removed/The earlier Tauri phone app, which showed the web vault's screens in a web view, is removed. The native iPhone, iPad and Android apps replace it.Thu, 05 Nov 2026 00:00:00 GMTmobiledecisionhttps://octap.app/changelog/2026-11-04-build-commands/https://octap.app/changelog/2026-11-04-build-commands/pnpm build:desktop, build:macos, build:windows, build:linux, build:cli, build:vscode and build:jetbrains join the existing app builds, and every build asks which server the apps offer as "Octa Pass".Wed, 04 Nov 2026 00:00:00 GMTextensiondesktopmobileclihttps://octap.app/changelog/2026-11-04-desktop-runs-in-the-background/https://octap.app/changelog/2026-11-04-desktop-runs-in-the-background/The desktop app has an icon in the menu bar or system tray and opens when you sign in to the computer, so quick access and the browser extension are ready straight away. Both can be turned off.Wed, 04 Nov 2026 00:00:00 GMTdesktophttps://octap.app/changelog/2026-11-04-dev-scripts-ask/https://octap.app/changelog/2026-11-04-dev-scripts-ask/pnpm start asks where people open the server and who can sign up, and the iPhone, Simulator and Android scripts pick the device, team and server or let you choose.Wed, 04 Nov 2026 00:00:00 GMTservermobilehttps://octap.app/changelog/2026-11-04-firefox-extension-touch-id/https://octap.app/changelog/2026-11-04-firefox-extension-touch-id/In the Firefox extension, Settings → Security no longer offers an Unlock with Touch ID switch that failed with "The operation is insecure". It links to the desktop app instead.Wed, 04 Nov 2026 00:00:00 GMTextensionsecuritydocshttps://octap.app/changelog/2026-11-04-health-check-pages/https://octap.app/changelog/2026-11-04-health-check-pages/Health now shows your score and a tile per check; choosing one opens that check's passwords on a page of their own instead of one long page with every list.Wed, 04 Nov 2026 00:00:00 GMTwebdesktopextensionmobilehttps://octap.app/changelog/2026-11-04-import-from-apple-passwords/https://octap.app/changelog/2026-11-04-import-from-apple-passwords/Moving passwords from the Passwords app to Octa Pass with Export Data to Another App failed with "This file can't be imported with the source you chose". It now imports.Wed, 04 Nov 2026 00:00:00 GMTmobilecorehttps://octap.app/changelog/2026-11-04-ios-app-store-builds/https://octap.app/changelog/2026-11-04-ios-app-store-builds/pnpm build:ios now signs the iPhone app for App Store Connect and can upload it, and the app carries the privacy manifest and permission texts the App Store asks for.Wed, 04 Nov 2026 00:00:00 GMTmobilereleasehttps://octap.app/changelog/2026-11-04-iphone-app-icon/https://octap.app/changelog/2026-11-04-iphone-app-icon/The iPhone and iPad app showed the icon of the framework the first phone app was built with. It now has the Octa Pass icon, on the home screen and in App Store Connect.Wed, 04 Nov 2026 00:00:00 GMTmobilehttps://octap.app/changelog/2026-11-04-mac-app-autofill-entitlement/https://octap.app/changelog/2026-11-04-mac-app-autofill-entitlement/Builds made with pnpm build:macos now give the Mac app its own provisioning profile and the AutoFill entitlement, as the iPhone app has, so that macOS can list Octa Pass under AutoFill from.Wed, 04 Nov 2026 00:00:00 GMTdesktophttps://octap.app/changelog/2026-11-04-mac-credential-exchange/https://octap.app/changelog/2026-11-04-mac-credential-exchange/On macOS 26, the Passwords app's Export Data to Another App can now send your passwords, passkeys and codes to the Octa Pass desktop app, with no file.Wed, 04 Nov 2026 00:00:00 GMTdesktopdocshttps://octap.app/changelog/2026-11-04-macos-autofill-and-code-setup/https://octap.app/changelog/2026-11-04-macos-autofill-and-code-setup/The Mac app now opens one-time code setup links, which lists it under Set up codes in on macOS 15, and builds made with pnpm build:macos sign the AutoFill extension so macOS lists it under AutoFill from.Wed, 04 Nov 2026 00:00:00 GMTdesktopdocshttps://octap.app/changelog/2026-11-04-native-libraries-rebuild/https://octap.app/changelog/2026-11-04-native-libraries-rebuild/pnpm dev:ios, dev:ios:device, build:ios, dev:android and build:android rebuild the app's Rust library after a pull that changes it, and a failed Xcode build now shows its errors.Wed, 04 Nov 2026 00:00:00 GMTmobilehttps://octap.app/changelog/2026-11-04-no-copies-on-import/https://octap.app/changelog/2026-11-04-no-copies-on-import/An Octa Pass export imported into a vault that already has its items updates them or leaves them alone instead of adding every item again, and saving a login you already have asks first.Wed, 04 Nov 2026 00:00:00 GMTdecisioncoreextensiondesktopmobileclihttps://octap.app/changelog/2026-11-04-pinned-and-recent-lists/https://octap.app/changelog/2026-11-04-pinned-and-recent-lists/The sidebar's Vaults section now starts with Recently created, Pinned, Favourites, Frequently used, Recently used and Recently modified, with Nearby coming soon, on the web, the desktop app and both phone apps.Wed, 04 Nov 2026 00:00:00 GMTdecisioncoreextensiondesktopmobilehttps://octap.app/changelog/2026-11-03-core-rebuilds-when-stale/https://octap.app/changelog/2026-11-03-core-rebuilds-when-stale/pnpm start, pnpm build:web, dev:stack, the end-to-end tests and the Safari build now rebuild the WebAssembly core after a pull that changes the Rust crates, instead of reusing an old build.Tue, 03 Nov 2026 00:00:00 GMTcorehttps://octap.app/changelog/2026-11-03-m25-integration/https://octap.app/changelog/2026-11-03-m25-integration/Health checks, vault features, key rotation, post-quantum sharing and the key log, organisations, Connect and service accounts, CLI and Git, the developer toolkit, local mode and native parity now live together, with the places where they met made consistent.Tue, 03 Nov 2026 00:00:00 GMTsecuritycoreserverextensiondesktopmobileclihttps://octap.app/changelog/2026-11-02-alias-actions/https://octap.app/changelog/2026-11-02-alias-actions/Aliases in use now has Turn off, Turn on and Delete for each alias, for every provider with an API for them.Mon, 02 Nov 2026 00:00:00 GMTcoredesktopmobiledocshttps://octap.app/changelog/2026-11-02-arabic-safari-desktop-menus/https://octap.app/changelog/2026-11-02-arabic-safari-desktop-menus/The screen that shows where to turn on the Safari extension, and the desktop app's standard Edit and Window menus, now come in Arabic.Mon, 02 Nov 2026 00:00:00 GMTextensiondesktophttps://octap.app/changelog/2026-11-02-arabic-website-and-docs/https://octap.app/changelog/2026-11-02-arabic-website-and-docs/Arabic landing page and docs at /ar/, per-page social images, hreflang links, and the setup for community translations through Weblate.Mon, 02 Nov 2026 00:00:00 GMTwebsitedocshttps://octap.app/changelog/2026-11-02-cli-ssh-agent-git/https://octap.app/changelog/2026-11-02-cli-ssh-agent-git/Create, edit and delete items and sign up from the terminal, hide secrets in `octapass run` output, unlock the CLI through the desktop app, serve SSH keys to ssh and Git with per-use approval, and sign commits with keys from your vault.Mon, 02 Nov 2026 00:00:00 GMTclidesktopsecuritycorehttps://octap.app/changelog/2026-11-02-counter-based-codes/https://octap.app/changelog/2026-11-02-counter-based-codes/HOTP codes are now real codes with a Next code button, counter sync and imports, instead of hidden fields.Mon, 02 Nov 2026 00:00:00 GMTcoreextensiondesktopmobilehttps://octap.app/changelog/2026-11-02-cvv-re-prompt/https://octap.app/changelog/2026-11-02-cvv-re-prompt/A new extension setting asks you to confirm it's you before a card's security code goes into a page.Mon, 02 Nov 2026 00:00:00 GMTextensionsecurityhttps://octap.app/changelog/2026-11-02-developer-toolkit/https://octap.app/changelog/2026-11-02-developer-toolkit/Make and read TLS certificates, keys, JWTs, hashes and encodings on your own device, from the CLI, the web vault and the desktop app, with Certificate and Key items in the vault.Mon, 02 Nov 2026 00:00:00 GMTcoreclidesktopextensionmobilesecurityhttps://octap.app/changelog/2026-11-02-docs-match-the-code/https://octap.app/changelog/2026-11-02-docs-match-the-code/Every page marked planned was checked against the code, and claims about features that don't exist yet were corrected.Mon, 02 Nov 2026 00:00:00 GMTdocssecurityhttps://octap.app/changelog/2026-11-02-docs-mcp-server/https://octap.app/changelog/2026-11-02-docs-mcp-server/AI tools that speak the Model Context Protocol can now search and read the Octa Pass docs through a small local server.Mon, 02 Nov 2026 00:00:00 GMTdocshttps://octap.app/changelog/2026-11-02-email-breach-alerts/https://octap.app/changelog/2026-11-02-email-breach-alerts/Health can tell you when your account email or aliases appear in a breach. It's off by default, because this is the one check that sends an address off your device.Mon, 02 Nov 2026 00:00:00 GMTsecurityservercorehttps://octap.app/changelog/2026-11-02-everything-inside-1-0/https://octap.app/changelog/2026-11-02-everything-inside-1-0/The Windows passkey provider, SSH agent, teams, watch apps, post-quantum sharing, the developer toolkit and the file safe all move inside 1.0, and the roadmap now says what's actually built.Mon, 02 Nov 2026 00:00:00 GMTdecisiondocshttps://octap.app/changelog/2026-11-02-file-safe/https://octap.app/changelog/2026-11-02-file-safe/Encrypt files in the age format from the CLI, the desktop app or your file manager, and keep them in Octa Pass Safe, an encrypted folder that locks with your vault.Mon, 02 Nov 2026 00:00:00 GMTcoreclidesktopmobilesecuritydocshttps://octap.app/changelog/2026-11-02-ide-extensions/https://octap.app/changelog/2026-11-02-ide-extensions/Browse references and run with secrets from your IDE, and save pasted API keys or fill bearer tokens from the browser extension.Mon, 02 Nov 2026 00:00:00 GMTextensiondocshttps://octap.app/changelog/2026-11-02-item-version-history/https://octap.app/changelog/2026-11-02-item-version-history/Open an item's version history to see what it used to say and restore an older version, encrypted like the item itself.Mon, 02 Nov 2026 00:00:00 GMTcoreserversecurityhttps://octap.app/changelog/2026-11-02-key-rotation-and-takeover/https://octap.app/changelog/2026-11-02-key-rotation-and-takeover/You can now replace your Secret Key and give a vault a new key whenever you want. Emergency takeover works, and family members can opt in to organiser recovery.Mon, 02 Nov 2026 00:00:00 GMTcoreserversecuritywebsitedesktopmobileclihttps://octap.app/changelog/2026-11-02-local-mode-apps/https://octap.app/changelog/2026-11-02-local-mode-apps/Vaults with no account come to the desktop app and the iPhone and Android apps, with encrypted backups, automatic folder backups, several vaults on one device and Turn on sync.Mon, 02 Nov 2026 00:00:00 GMTdesktopmobilesecurityhttps://octap.app/changelog/2026-11-02-masked-email-relay/https://octap.app/changelog/2026-11-02-masked-email-relay/Octa Pass now has its own mail forwarder for masked email, for servers that turn it on. It stores no messages, and the hosted service doesn't run it.Mon, 02 Nov 2026 00:00:00 GMTserversecurityhttps://octap.app/changelog/2026-11-02-match-rules-and-equivalent-domains/https://octap.app/changelog/2026-11-02-match-rules-and-equivalent-domains/Choose how each website on a login matches, and tell Octa Pass which sites share one sign-in.Mon, 02 Nov 2026 00:00:00 GMTcoreextensiondesktopmobilesecurityhttps://octap.app/changelog/2026-11-02-more-importers/https://octap.app/changelog/2026-11-02-more-importers/Five more password managers can be imported on the device, as best effort, because none of them documents its export.Mon, 02 Nov 2026 00:00:00 GMTcoredocshttps://octap.app/changelog/2026-11-02-native-reveal-gate/https://octap.app/changelog/2026-11-02-native-reveal-gate/Revealing, copying and exporting in the native apps now ask for your device's lock or master password, and opening the app has its own switch.Mon, 02 Nov 2026 00:00:00 GMTsecuritymobilehttps://octap.app/changelog/2026-11-02-native-ssh-environments/https://octap.app/changelog/2026-11-02-native-ssh-environments/The native phone apps can now make, read, edit and save SSH keys, and keep environments with their projects, stages and variables.Mon, 02 Nov 2026 00:00:00 GMTmobilehttps://octap.app/changelog/2026-11-02-new-item-types/https://octap.app/changelog/2026-11-02-new-item-types/Seven new kinds of item in every app, payment QR codes for bank accounts and wallets, and imports that keep these items as what they are.Mon, 02 Nov 2026 00:00:00 GMTcoreextensiondesktopmobileclihttps://octap.app/changelog/2026-11-02-octa-pass-connect/https://octap.app/changelog/2026-11-02-octa-pass-connect/A local helper hands approved programs a secret by reference, every hand-out goes in your security log, and API credentials can hold a live OAuth2 token.Mon, 02 Nov 2026 00:00:00 GMTclidesktopsecuritydocshttps://octap.app/changelog/2026-11-02-organisations/https://octap.app/changelog/2026-11-02-organisations/Teams can now run on Octa Pass with roles, groups, server-enforced policies and OpenID Connect sign-in, with no new key and no path to anyone's vault for admins, the server or an identity provider.Mon, 02 Nov 2026 00:00:00 GMTsecurityservercoredecisionhttps://octap.app/changelog/2026-11-02-post-quantum-sharing-and-key-log/https://octap.app/changelog/2026-11-02-post-quantum-sharing-and-key-log/Shares are now sealed with hybrid X25519 + ML-KEM-768, and account keys go into an append-only log that clients check. Neither has had the outside cryptographer's review yet.Mon, 02 Nov 2026 00:00:00 GMTsecuritycoreserverhttps://octap.app/changelog/2026-11-02-security-dashboard/https://octap.app/changelog/2026-11-02-security-dashboard/Health now flags insecure websites, expiring cards and IDs, passkeys you could use, low backup codes and old passwords, and you can dismiss warnings and change a password in one step.Mon, 02 Nov 2026 00:00:00 GMTcoreextensiondesktopmobilehttps://octap.app/changelog/2026-11-02-security-questions/https://octap.app/changelog/2026-11-02-security-questions/Logins can record security questions in their recovery info, and the generator makes random answers.Mon, 02 Nov 2026 00:00:00 GMTcoremobilehttps://octap.app/changelog/2026-11-02-service-accounts/https://octap.app/changelog/2026-11-02-service-accounts/A token bound to one shared vault, read-only by default, revocable and logged, that lets a job read secrets without the server ever seeing them.Mon, 02 Nov 2026 00:00:00 GMTcliserversecuritycoredocshttps://octap.app/changelog/2026-11-02-site-password-rules/https://octap.app/changelog/2026-11-02-site-password-rules/The login editor's generator and Android's Autofill suggestion now use the site password rules the browser extension already had.Mon, 02 Nov 2026 00:00:00 GMTcoremobiledesktophttps://octap.app/changelog/2026-11-02-watch-codes/https://octap.app/changelog/2026-11-02-watch-codes/Watch apps show the one-time codes your phone sends, for 15 minutes at a time. The secrets never leave the phone.Mon, 02 Nov 2026 00:00:00 GMTmobilesecurityhttps://octap.app/changelog/2026-11-02-wifi-guests-and-nfc/https://octap.app/changelog/2026-11-02-wifi-guests-and-nfc/Give a guest a one-time link as a QR code, or write a network to an NFC tag on Android.Mon, 02 Nov 2026 00:00:00 GMTmobiledesktophttps://octap.app/changelog/2026-11-02-windows-passkey-provider/https://octap.app/changelog/2026-11-02-windows-passkey-provider/The desktop app can act as a passkey provider on Windows 11, off by default and asking for Windows Hello on every use. Not yet tried on real Windows.Mon, 02 Nov 2026 00:00:00 GMTdesktopsecurityhttps://octap.app/changelog/2026-10-27-device-auth-gates/https://octap.app/changelog/2026-10-27-device-auth-gates/Opening Octa Pass and every autofill can now ask for your device's lock independently, with a clear lockless fallback and a master-password gate for secrets.Tue, 27 Oct 2026 00:00:00 GMTsecurityextensionhttps://octap.app/changelog/2026-10-26-more-importers/https://octap.app/changelog/2026-10-26-more-importers/Import from Bitwarden's CSV, Raivo OTP, Ente Auth plain or encrypted exports, and Proton Pass's PGP-encrypted ZIP. Importing an authenticator backup again now updates its codes instead of copying them.Mon, 26 Oct 2026 00:00:00 GMTcoreclidesktopmobileextensionhttps://octap.app/changelog/2026-10-26-ssh-keys/https://octap.app/changelog/2026-10-26-ssh-keys/SSH keys are their own encrypted item type, with Ed25519, ECDSA and RSA generation, OpenSSH/PEM/PKCS#8 import, guarded private-key viewing and export, in the web vault, the CLI and the extension.Mon, 26 Oct 2026 00:00:00 GMTcorecliextensionsecurityhttps://octap.app/changelog/2026-10-25-android-brand-fonts/https://octap.app/changelog/2026-10-25-android-brand-fonts/The native Android app now shows Mona Sans and Monaspace Neon, the same font files the web vault uses, instead of the phone's own font.Sun, 25 Oct 2026 00:00:00 GMTmobilehttps://octap.app/changelog/2026-10-25-desktop-sharing/https://octap.app/changelog/2026-10-25-desktop-sharing/The desktop app now shares vaults, runs families, makes one-time share links and handles emergency access, with every key sealed and opened in the app's own process.Sun, 25 Oct 2026 00:00:00 GMTdesktophttps://octap.app/changelog/2026-10-25-environments/https://octap.app/changelog/2026-10-25-environments/Keep a project's environment variables in the vault, edit them as a table in the web vault and extension, and load them into commands, files and your shell from the CLI.Sun, 25 Oct 2026 00:00:00 GMTcorecliextensiondocshttps://octap.app/changelog/2026-10-25-http-sign-in-and-export-log/https://octap.app/changelog/2026-10-25-http-sign-in-and-export-log/The browser extension can answer a site's username-and-password pop-up once you allow it, and every export now shows in your security log.Sun, 25 Oct 2026 00:00:00 GMTextensionserversecurityhttps://octap.app/changelog/2026-10-25-master-password-reset/https://octap.app/changelog/2026-10-25-master-password-reset/Forgot your master password? Reset it with the recovery code from your Recovery Kit. You can also change it in Settings.Sun, 25 Oct 2026 00:00:00 GMTcoreserversecuritywebsiteextensionmobileclihttps://octap.app/changelog/2026-10-24-android-app/https://octap.app/changelog/2026-10-24-android-app/The Octa Pass Android app runs on the Android emulator, with fingerprint or screen-lock unlock, an Autofill service with suggested passwords, a Credential Manager provider for passwords and passkeys, Wi-Fi Connect and QR codes.Sat, 24 Oct 2026 00:00:00 GMTmobilesecurityhttps://octap.app/changelog/2026-10-24-android-credential-transfer/https://octap.app/changelog/2026-10-24-android-credential-transfer/On Android, import into Octa Pass from Google Password Manager and other password managers on the phone, or let them take your items from Octa Pass, through Credential Manager's credential transfer.Sat, 24 Oct 2026 00:00:00 GMTmobilecoresecuritydocshttps://octap.app/changelog/2026-10-24-attachments/https://octap.app/changelog/2026-10-24-attachments/Keep files with any item, or store them as Document items. Files are encrypted on your device before upload; the server stores ciphertext and its size only.Sat, 24 Oct 2026 00:00:00 GMTcoreserverwebdesktopsecurityhttps://octap.app/changelog/2026-10-24-autofill-engine/https://octap.app/changelog/2026-10-24-autofill-engine/The engine the browser extension will use to find forms, show the Octa Pass menu and fill safely is in the repository, with a 76-page test corpus it passes in Chrome.Sat, 24 Oct 2026 00:00:00 GMTextensionsecurityhttps://octap.app/changelog/2026-10-24-browser-extension/https://octap.app/changelog/2026-10-24-browser-extension/Octa Pass now has a Manifest V3 extension for Chrome, Edge and Firefox that fills logins, saves new ones, creates and uses passkeys, unlocks through the desktop app, and works without an account. It isn't in the stores yet, but you can build it and load it unpacked.Sat, 24 Oct 2026 00:00:00 GMTextensionsecurityhttps://octap.app/changelog/2026-10-24-cli-preview/https://octap.app/changelog/2026-10-24-cli-preview/A native octapass CLI reads items and one-time codes, generates passwords, passes secrets to scripts with octapass:// references, and imports and exports, with a session kept in the OS keyring.Sat, 24 Oct 2026 00:00:00 GMTclisecurityhttps://octap.app/changelog/2026-10-24-core-import-local-vault/https://octap.app/changelog/2026-10-24-core-import-local-vault/The Rust core can now import from Chrome, Firefox, Safari, Bitwarden, 1Password, LastPass, any CSV and authenticator apps, match logins to websites safely, follow sites' password rules, and run a vault on one device with encrypted backups.Sat, 24 Oct 2026 00:00:00 GMTcoreextensionsecurityhttps://octap.app/changelog/2026-10-24-desktop-app/https://octap.app/changelog/2026-10-24-desktop-app/A Tauri desktop app shows the web vault on a native vault, with Touch ID unlock, quick access and browser integration.Sat, 24 Oct 2026 00:00:00 GMTdesktopsecurityhttps://octap.app/changelog/2026-10-24-desktop-bridge-hardening/https://octap.app/changelog/2026-10-24-desktop-bridge-hardening/Other programs on your computer can no longer ask the desktop app for your account key by pretending to be the Octa Pass browser extension.Sat, 24 Oct 2026 00:00:00 GMTdesktopextensionsecurityhttps://octap.app/changelog/2026-10-24-device-unlock-firefox-safari/https://octap.app/changelog/2026-10-24-device-unlock-firefox-safari/Turning on Unlock with Touch ID in the web vault no longer fails in Firefox and Safari on macOS, and it now takes one fingerprint instead of two.Sat, 24 Oct 2026 00:00:00 GMTsecurityextensiondocshttps://octap.app/changelog/2026-10-24-device-unlock-offer/https://octap.app/changelog/2026-10-24-device-unlock-offer/The phone and desktop apps now ask once whether to unlock with your device, so AutoFill on the iPhone no longer asks for your master password every time.Sat, 24 Oct 2026 00:00:00 GMTmobiledesktopsecurityhttps://octap.app/changelog/2026-10-24-docker-server-with-web-vault/https://octap.app/changelog/2026-10-24-docker-server-with-web-vault/One container now runs the sync server and the web vault on one port, invites the emails you list at start, can log sign-up codes when there's no SMTP, and makes daily online backups you can restore with one command.Sat, 24 Oct 2026 00:00:00 GMTserverreleasehttps://octap.app/changelog/2026-10-24-emergency-access-files/https://octap.app/changelog/2026-10-24-emergency-access-files/Once emergency access is released, your contact can download the files attached to the items they can see, decrypted on their device.Sat, 24 Oct 2026 00:00:00 GMTserversecuritywebsitehttps://octap.app/changelog/2026-10-24-extension-replaces-browser-autofill/https://octap.app/changelog/2026-10-24-extension-replaces-browser-autofill/One switch turns off Chrome's or Edge's own offers to save passwords, addresses and cards (passwords in Firefox), and the extension now offers to save the addresses and cards you type into websites.Sat, 24 Oct 2026 00:00:00 GMTextensionhttps://octap.app/changelog/2026-10-24-import-export/https://octap.app/changelog/2026-10-24-import-export/Export your whole vault, attached files included, as one encrypted file, move passkeys and passwords to any app that speaks CXF, and import from KeePass, Proton Pass, Dashlane, Keeper and more.Sat, 24 Oct 2026 00:00:00 GMTcoresecurityclidesktopmobileextensiondocshttps://octap.app/changelog/2026-10-24-import-fidelity/https://octap.app/changelog/2026-10-24-import-fidelity/Imported items keep the other app's dates, ids, HTTP realms and auto-type settings, and importing the same file again updates your items instead of adding copies.Sat, 24 Oct 2026 00:00:00 GMTcoreclidesktopmobileextensiondocshttps://octap.app/changelog/2026-10-24-ios-app/https://octap.app/changelog/2026-10-24-ios-app/The Octa Pass iPhone app runs in the iOS Simulator, with Face ID or passcode unlock, an AutoFill extension for passwords, passkeys and one-time codes, Wi-Fi Connect and QR codes.Sat, 24 Oct 2026 00:00:00 GMTmobilesecurityhttps://octap.app/changelog/2026-10-24-iphone-codes-and-autofill-button/https://octap.app/changelog/2026-10-24-iphone-codes-and-autofill-button/Octa Pass can be the iPhone's app for one-time code setup links and QR codes, and the phone apps have a button that turns AutoFill on.Sat, 24 Oct 2026 00:00:00 GMTmobileiosandroidhttps://octap.app/changelog/2026-10-24-iphone-credential-exchange-native/https://octap.app/changelog/2026-10-24-iphone-credential-exchange-native/On iOS 26, the native iPhone app imports from and exports to other password managers through Credential Exchange, with the same review as Android.Sat, 24 Oct 2026 00:00:00 GMTmobiledocshttps://octap.app/changelog/2026-10-24-iphone-masked-email-aliases/https://octap.app/changelog/2026-10-24-iphone-masked-email-aliases/Masked email in the native iPhone app shows the aliases your logins use, as the web vault does.Sat, 24 Oct 2026 00:00:00 GMTmobilehttps://octap.app/changelog/2026-10-24-live-sync-and-devices/https://octap.app/changelog/2026-10-24-live-sync-and-devices/The sync server now pushes changes to signed-in apps as they happen, takes imports in bulk, lets you see and sign out your devices, runs on PostgreSQL, and closes several abuse paths found in a security review.Sat, 24 Oct 2026 00:00:00 GMTserversecuritydocshttps://octap.app/changelog/2026-10-24-mobile-attachments/https://octap.app/changelog/2026-10-24-mobile-attachments/The mobile apps can now add, open and remove attachments and Document files, offline too, with the system's own pickers and viewer.Sat, 24 Oct 2026 00:00:00 GMTmobilesecurityhttps://octap.app/changelog/2026-10-24-mobile-core-bindings/https://octap.app/changelog/2026-10-24-mobile-core-bindings/The Octa Pass core now has Swift and Kotlin bindings, so the mobile apps and their autofill extensions can sign in, unlock with Face ID, a fingerprint or the device passcode, fill passwords and codes, and use passkeys.Sat, 24 Oct 2026 00:00:00 GMTcoremobilesecurityhttps://octap.app/changelog/2026-10-24-native-android-app/https://octap.app/changelog/2026-10-24-native-android-app/The Android app is rebuilt in Jetpack Compose, with every screen native and every feature of the current app, on the same Rust core.Sat, 24 Oct 2026 00:00:00 GMTmobilehttps://octap.app/changelog/2026-10-24-native-iphone-app/https://octap.app/changelog/2026-10-24-native-iphone-app/The iPhone and iPad app is rebuilt in SwiftUI, with every screen native, on the same Rust core as the native Android app.Sat, 24 Oct 2026 00:00:00 GMTmobilehttps://octap.app/changelog/2026-10-24-new-sign-in-email/https://octap.app/changelog/2026-10-24-new-sign-in-email/Octa Pass now emails you whenever a new device signs in to your account, with its name, platform and the time.Sat, 24 Oct 2026 00:00:00 GMTserversecurityhttps://octap.app/changelog/2026-10-24-one-time-codes-list/https://octap.app/changelog/2026-10-24-one-time-codes-list/A new One-time codes category, next to Passkeys, lists every item with a code and shows the current code with its countdown and a copy button.Sat, 24 Oct 2026 00:00:00 GMTwebextensiondesktopmobilehttps://octap.app/changelog/2026-10-24-passkey-authenticator/https://octap.app/changelog/2026-10-24-passkey-authenticator/The Octa Pass core can now create passkeys and sign in with them, checked against independent WebAuthn verifiers. The browser extension will put it in front of websites.Sat, 24 Oct 2026 00:00:00 GMTcoresecurityhttps://octap.app/changelog/2026-10-24-passkey-hash-in-core/https://octap.app/changelog/2026-10-24-passkey-hash-in-core/Signing a passkey request from iOS or Android now runs through the same tested code as the browser extension and the web vault, and refuses shared suffixes like github.io.Sat, 24 Oct 2026 00:00:00 GMTcoremobilesecurityhttps://octap.app/changelog/2026-10-24-phone-apps-feel-native/https://octap.app/changelog/2026-10-24-phone-apps-feel-native/The iPhone and Android apps no longer zoom, bounce or select like a web page. Text size follows your phone, screens slide, menus are sheets, and exports open the share sheet.Sat, 24 Oct 2026 00:00:00 GMTmobilehttps://octap.app/changelog/2026-10-24-qr-one-time-codes/https://octap.app/changelog/2026-10-24-qr-one-time-codes/Read a site's two-step QR code from the page, the screen, a photo or a screenshot, bring over every account from Google Authenticator's export QR codes, and choose which login each code joins.Sat, 24 Oct 2026 00:00:00 GMTcoreextensiondesktopmobilewebdocshttps://octap.app/changelog/2026-10-24-recovery-map-and-masked-email/https://octap.app/changelog/2026-10-24-recovery-map-and-masked-email/See which email or phone can reset which of your accounts, and give each site its own forwarding address from your own alias provider.Sat, 24 Oct 2026 00:00:00 GMTcoresecuritywebsiteextensiondesktopmobilehttps://octap.app/changelog/2026-10-24-release-builds/https://octap.app/changelog/2026-10-24-release-builds/The desktop app, browser extensions and Safari app can be built for one server and installed outside the stores, the Windows installer can be cross-compiled on a Mac, and a release workflow builds everything on version tags.Sat, 24 Oct 2026 00:00:00 GMTreleasedesktopextensionhttps://octap.app/changelog/2026-10-24-safari-extension/https://octap.app/changelog/2026-10-24-safari-extension/The Octa Pass extension now has a Safari build, packaged in small macOS and iOS apps that show you where to turn it on. It builds and passes checks in WebKit; it hasn't run in Safari itself yet.Sat, 24 Oct 2026 00:00:00 GMTextensionmobilehttps://octap.app/changelog/2026-10-24-shared-vaults-everywhere/https://octap.app/changelog/2026-10-24-shared-vaults-everywhere/Vaults shared with you, and your family vault, now open in the phone apps, the browser extension and the desktop app, not only the web vault.Sat, 24 Oct 2026 00:00:00 GMTmobileextensiondesktopsecurityhttps://octap.app/changelog/2026-10-24-sharing-backend/https://octap.app/changelog/2026-10-24-sharing-backend/The core and the sync server now support shared vaults with signed grants, families, one-time share links and emergency access. The screens for them come next.Sat, 24 Oct 2026 00:00:00 GMTcoreserversecurityhttps://octap.app/changelog/2026-10-24-sharing-security-fixes/https://octap.app/changelog/2026-10-24-sharing-security-fixes/Adding emergency contacts is rate limited, a contact for one vault gets nothing that opens your other vaults, and pending family invitations get the new key when someone is removed.Sat, 24 Oct 2026 00:00:00 GMTserversecurityhttps://octap.app/changelog/2026-10-24-site-groups/https://octap.app/changelog/2026-10-24-site-groups/When you have several logins for the same website, the item list shows one row for it with the number of accounts. Click or tap it to see the logins under it.Sat, 24 Oct 2026 00:00:00 GMTwebextensiondesktopmobilehttps://octap.app/changelog/2026-10-24-smaller-web-download/https://octap.app/changelog/2026-10-24-smaller-web-download/The encryption module the web vault loads on first visit went from 1.37 MB to 0.75 MB compressed, with the same unlock speed.Sat, 24 Oct 2026 00:00:00 GMTwebhttps://octap.app/changelog/2026-10-24-sort-and-group-lists/https://octap.app/changelog/2026-10-24-sort-and-group-lists/Item lists can be grouped by type, first letter or vault and sorted by name or date, from one Sort and group menu. All items now starts grouped by type.Sat, 24 Oct 2026 00:00:00 GMTwebextensiondesktopmobilehttps://octap.app/changelog/2026-10-24-two-step-sign-in/https://octap.app/changelog/2026-10-24-two-step-sign-in/Your Octa Pass account can now ask new devices for a code from an authenticator app, a security key or a recovery code after the master password.Sat, 24 Oct 2026 00:00:00 GMTserversecuritywebsiteextensiondesktopmobilehttps://octap.app/changelog/2026-10-24-web-sharing/https://octap.app/changelog/2026-10-24-web-sharing/The web vault can now share vaults, run a family, send one-time share links and set up emergency access. Changes from other devices arrive live, imports are faster, and you can see and sign out your devices.Sat, 24 Oct 2026 00:00:00 GMTwebsecurityhttps://octap.app/changelog/2026-10-24-website-icons/https://octap.app/changelog/2026-10-24-website-icons/Items with a website now show the site's icon instead of a coloured letter. Icons come through your Octa Pass server, never from an icon service, and you can turn them off on each device.Sat, 24 Oct 2026 00:00:00 GMTserverwebextensiondesktopmobilesecurityhttps://octap.app/changelog/2026-10-24-wifi-networks/https://octap.app/changelog/2026-10-24-wifi-networks/Wi-Fi networks are their own item type and category, with Enterprise settings; the apps mark the network you're on and those in range, import a computer's saved networks and offer to save new ones.Sat, 24 Oct 2026 00:00:00 GMTcoredesktopmobilehttps://octap.app/changelog/2026-10-23-arabic-interface/https://octap.app/changelog/2026-10-23-arabic-interface/The web vault, browser extension, desktop app and phone apps now come in Arabic, laid out right to left, and follow your system language or the one you pick in Settings.Fri, 23 Oct 2026 00:00:00 GMTwebextensiondesktopmobilehttps://octap.app/changelog/2026-10-23-crypto-core/https://octap.app/changelog/2026-10-23-crypto-core/The Octa Pass crypto core is built. Key derivation, encryption, OPAQUE login and the vault tools are now in Rust and compiled to WebAssembly for the web vault.Fri, 23 Oct 2026 00:00:00 GMTcoresecurityhttps://octap.app/changelog/2026-10-23-desktop-auto-type-and-macos-autofill/https://octap.app/changelog/2026-10-23-desktop-auto-type-and-macos-autofill/The desktop app can type a login into other apps' windows, after checking the window belongs to it, and on macOS it fills passwords and passkeys in Safari and other apps through the system's AutoFill.Fri, 23 Oct 2026 00:00:00 GMTdesktopsecurityhttps://octap.app/changelog/2026-10-23-extension-frames-and-browser-check/https://octap.app/changelog/2026-10-23-extension-frames-and-browser-check/A sign-in or payment form that a site shows from another site now needs your approval before Octa Pass fills it, and the extension says when the desktop app doesn't recognise your browser.Fri, 23 Oct 2026 00:00:00 GMTextensiondesktopsecurityhttps://octap.app/changelog/2026-10-23-hosted-first/https://octap.app/changelog/2026-10-23-hosted-first/Octa Pass is positioned as a free hosted password manager. Open source is how you can trust it, and self-hosting is an option that uses the same apps.Fri, 23 Oct 2026 00:00:00 GMTdecisionwebsitedocshttps://octap.app/changelog/2026-10-23-local-mode/https://octap.app/changelog/2026-10-23-local-mode/Local mode lets you use Octa Pass on one device with no account and no server, with encrypted backups and one-tap sync later. It arrives in phase 2 with the browser extension.Fri, 23 Oct 2026 00:00:00 GMTdecisiondocshttps://octap.app/changelog/2026-10-23-new-brand-and-website/https://octap.app/changelog/2026-10-23-new-brand-and-website/Octa Pass has a new OP monogram logo, a trust-blue and open-source-green palette, and a product-style website with a live encryption demo.Fri, 23 Oct 2026 00:00:00 GMTwebsitedecisionhttps://octap.app/changelog/2026-10-23-sync-server/https://octap.app/changelog/2026-10-23-sync-server/The Octa Pass sync server now handles sign-up, login, encrypted sync and full account deletion, and stores nothing but ciphertext.Fri, 23 Oct 2026 00:00:00 GMTserversecuritydocshttps://octap.app/changelog/2026-10-23-web-vault-on-the-real-stack/https://octap.app/changelog/2026-10-23-web-vault-on-the-real-stack/Sign up, sync, lock, device unlock and account deletion in the web vault now use the Rust core in WebAssembly and a real Octa Pass server, and an end-to-end test checks that the server only ever stores ciphertext.Fri, 23 Oct 2026 00:00:00 GMTcoreserversecurityhttps://octap.app/changelog/2026-10-23-web-vault-preview/https://octap.app/changelog/2026-10-23-web-vault-preview/You can now run the Octa Pass web vault locally. Create an account, save your Recovery Kit, manage items, check your passwords' health and unlock with Touch ID or Windows Hello, all on demo data for now.Fri, 23 Oct 2026 00:00:00 GMTsecuritydocshttps://octap.app/changelog/2026-10-22-project-kickoff/https://octap.app/changelog/2026-10-22-project-kickoff/The idea was reviewed and renamed to Octa Pass, the plans and security design were written, and the docs website went up with llms.txt and an agent skill.Thu, 22 Oct 2026 00:00:00 GMTdecisiondocswebsitesecurity