This release introduces comprehensive GPG key management, extends the SSH/GPG agent to Windows, and delivers a completely reworked synchronization engine for KeePass (KDBX) vaults. It also adds major new integrations for Android, WebDAV support for remote vaults, and numerous security and performance enhancements across all platforms.
GPG Key Management and Agent on Windows
Keyguard now includes first-class support for managing GPG keys and using them through an integrated agent, which is now also available on Windows.
- GPG Key Management: You can now import, manage, and use GPG keys directly within Keyguard. It is also now possible to set or modify the expiration date for GPG keys and subkeys.
- Agent on Windows: The SSH and GPG agents are now available on Windows, providing seamless integration with development tools, terminals, and Git.
- Caller-Scoped Approval: Agent requests can be approved on a per-caller basis, allowing you to grant persistent access for trusted applications without being prompted for every operation.
- Platform Support: Added support for GPG key item types on Wear OS and resolved an issue where agent-related items were not displayed correctly on Windows.
- Security and Reliability: The GPG and SSH agents have been hardened with stricter key policy enforcement during signing and decryption, public key validation before imports, and more robust connection handling.
Reworked KeePass (KDBX) Sync and Attachments
The engine for handling KeePass (KDBX) vaults has been overhauled for significantly improved reliability, performance, and attachment management.
- New Sync Pipeline: The synchronization process is now more robust, performing better conflict resolution and handling unstable network connections more gracefully.
- Large File Support: The maximum supported attachment size has been increased to 500 MB. KDBX vaults are now processed using a streaming encoder and decoder to reduce memory usage, especially for vaults with large attachments.
- Reliable Attachment Sync: Attachments are now staged locally before upload, preventing data loss and ensuring that file changes are synchronized reliably.
- Improved Error Handling: A clear error message is now shown when attempting to add an attachment that exceeds the size limit. The app also better preserves original error details during decoding and avoids unnecessary unlock retries when an incorrect key is used.
New Android Integrations
Keyguard's integration with the Android ecosystem has been expanded with powerful new capabilities for developers and third-party app users.
- OpenKeychain Provider: Keyguard can now act as an OpenKeychain-compatible provider, allowing apps like Termux to use your SSH and GPG keys for authentication and signing operations.
- Credential Exchange (CXF): Added support for Credential Exchange (CXF), enabling secure credential sharing with other compatible Android applications.
- Enhanced Autofill Security: Autofill is now more secure, validating both the package name and the signing identity of the target application before filling credentials.
- Storage and Backup Fixes: Introduced a recovery mechanism for certain types of encrypted storage failures and ensured all sensitive application data is correctly excluded from automatic Android backups.
Security Enhancements
This release includes several important security improvements to protect your data.
- Clipboard Protection: On macOS and Windows, copying sensitive fields (like passwords) now prevents them from being stored in the system's clipboard history.
- Hardened KDBX Parsing: Strengthened the parsing of KDBX files from untrusted sources by enforcing limits on key derivation functions (KDF) and validating internal file structures to guard against malformed databases.
- Secure Temporary Files: Temporary files created during sync or other operations are now securely permissioned on Windows.
UI and Usability Improvements
- Customizable Navigation: The main navigation bar can now be customized. You can add your own filters for quick access to specific item types and reorder the tabs to suit your workflow.
- Link Vault Items: You can now create links between vault items. The "Related Items" section has been promoted to a first-class field for better visibility and ease of use.
- Easier Folder Creation: It is now simpler to create nested folder structures.
- Smarter Selections: When vault items are trashed or archived, they are now automatically removed from any active selection to prevent unintended actions.
- Incognito Fields on Desktop: On desktop platforms, password fields now block input method editors (IMEs) to prevent sensitive text from being captured by third-party keyboard utilities.
Fixes and Improvements
- WebDAV Support: You can now connect to and browse WebDAV servers to open and save your vault files. Compatibility has been improved for servers that do not support atomic write operations.
- Bitwarden Sync: Improved the reliability of Bitwarden vault synchronization by containing JSON parsing failures to a single item and hardening the underlying connection handling.
- Flatpak: Fixed an issue that caused a missing tray icon in the Flatpak distribution on Linux.
- Watchtower: Watchtower now correctly flags passwords that have appeared in a data breach even a single time.
- Performance: Optimized performance for vault list loading, search, and Watchtower scans.
- Data Libraries: Updated internal libraries and data sources for passkeys, two-factor authentication services, and public domain suffix lists.