v2.8.0

[2.8.0] - 2026-09-07

Secure by default. replaycut now listens on your PC only until you open it
up, and opening it up is one switch that asks for a password first. The
everyday way onto a phone is no longer typing that password: the phone
asks, your PC shows the request with a code and the device's name, and one
click lets it in - or the phone scans the QR code, which signs it in on the
spot. Settings lists every signed-in device and lets you sign one out.
Nothing about your clips or the sharing changed.

Added

• replaycut now listens on this PC only. A new installation is not
  reachable from the network until you turn it on - in the setup wizard or
  under Settings › Access - and turning it on sets a password first and
  then asks Windows for the firewall rule. The installer no longer creates
  that rule on its own.
• Settings › Signed-in devices: every browser that may use replaycut, with
  its name, address and when it was last seen, one "Sign out" per device
  and "Sign out everywhere".
• Diagnostics: three new lines - where the service listens (a failure when
  it is open to the network without a password), whether the firewall rule
  exists, and how the device login is doing.
• Sign in on your phone without typing the password. The login page
  offers "Ask" plus the name of your PC: the PC shows a notification, the
  open UI a card and the tray an entry, all with the same four-character
  code and with the device's name and address. One click on Allow and the
  phone is in. A request runs out after two minutes.
• The QR code in the wizard and in the settings signs a phone in when it
  is scanned: its address carries a token that is good once and for two
  minutes. Only this PC and signed-in devices get such a code.
• requireLoginOnLoopback in the settings: ask for the password on this PC
  as well, for a Windows account other people use.
• "Generate one for me" next to the password fields in the wizard and in
  the settings: four words from a built-in list, shown once in clear text.
• allowedHosts in the settings: names this replaycut answers to besides
  localhost, its own name and any address - for an own DNS name or a
  reverse proxy.

Changed

• An installation that is reachable from the network without a password
  keeps working, but says so: a red banner with "Set a password" and "This
  PC only", one notification per start, and a failure in the diagnostics.
• A request that names a host this replaycut does not answer to is refused
  with 421. That closes DNS rebinding, where a page in your browser uses
  its own name to reach the service on your PC.
• A password is 8 to 128 characters now, and there are no rules about
  digits or symbols: length is what counts.
• Signed-in devices are recorded with a name ("iPhone, Safari"), their
  browser, their address and when they were last seen. Sessions from
  earlier versions keep working.
• More than 30 failed logins from all addresses together within five
  minutes pause the password login for ten minutes.
• The size estimate in the share row learns from your own shares: the job
  records the recording's codec and bitrate (codec, sourceKbps), and
  the row uses the median ratio of the last plain H.264 shares of that
  codec instead of a fixed factor per codec.

Fixed

• The page is mobile-friendly again: 2.7.0 shipped with a broken viewport
  meta tag, so phones rendered the desktop layout scaled down.

• The "Limits" fields on the storage cards save from the settings page
  again; 2.7.0 sent the height as text and the service answered 400.

• A restart (update, settings, replaycut stop) no longer waits up to 5 s
  while a browser has the player open on a long clip: the shutdown now
  gives open connections one second, which is all the restarting request
  needs.

• "Post to ..." shows its result on the result card as well: the status
  reaches last (what the card shows after a reload), the card re-renders
  after the click, and a status such as "Discord: Link posted" or "Posted
  (HTTP 200)" is no longer drawn as a failure.