Skip to content

SafeKeepVault v1.51

Choose a tag to compare

View all tags
@github-actions github-actions released this 22 Oct 18:17
· 185 commits to main since this release
v1.51
ff93141
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Release Date: October 22, 2026

Build: v1.51 · build 339 · ff93141 · 2026-10-22

A stronger vault password: SafeKeep now refuses one that is easy to guess, can generate a strong one for you, and lets you change it without resetting the stick. Earlier changes are in the v1.50 release notes.

🔄 Update in place from v1.47 or later

  1. Copy SafeKeep-Update-v1.51.tar onto your stick's TRANSFER drive.
  2. Boot SafeKeep and unlock your vault.
  3. Open Device Options → Update SafeKeep → Check for update, then Install and Restart now.

Your vault, your vault password and your Transfer Drive are not touched. Before installing, SafeKeep shows the app's SHA-256: it should match the boot.html line of this release's SHA256SUMS.

Sticks set up with v1.46 or earlier still need one last reflash onto a flash drive of 8 GB or more. The update guide walks you through it.

🔐 Weak vault passwords refused

When you set up a vault, SafeKeep rates the password before locking the vault with it. One that is easy to guess, such as a common password, a name and a year, or a few words, is refused, with the reason. One that is only fair shows why it could be stronger, and you choose another or Use this one anyway. A long random password from a password manager goes straight through, as before. The check works the same for a typed password and a scanned QR code, and never shows the password on screen.

🎲 Generate One for Me

No password manager? At setup, choose Generate One for Me. SafeKeep makes a password of 6 random words and shows it as a QR code and as numbered words. Save it one way or both:

  • Phone: scan the QR code into your password manager, with your phone's camera or the Courier Tool (Receive, then Copy to clipboard).
  • Paper: write the words down.

Then Check Your Copy before the vault is locked with it: Scan it back from my phone, or Type the words from your paper. To unlock, scan the QR code, or type the words in lowercase with one space between them.

🔁 Change Master Passphrase

New in Device Options → Master Passphrase, which also shows how strong your current password is. Lock and Change locks the vault, then asks for your current password and a new one on the same screens as setup, including Generate One for Me. What is in your vault is not changed; the old password stops working and you unlock with the new one. The passwords are only typed or scanned into SafeKeep's own dialogs, never into the app.

If your vault was set up with an easy-to-guess password, the Dashboard now shows a red Weak Master Passphrase warning with a button to change it.

💾 Backup password strength

The Encrypted Backup screen shows how strong the backup password is, and refuses a weak one: a .7z backup can be copied to a computer and guessed far faster than the vault. Your vault password still works for backups if it came from a password manager or is 6 or more random words.

🛠️ Setup fixes

  • Cancel during setup now goes back a step, or offers to shut down, instead of ending at a black screen.
  • Every setup screen fits a 1080p display.

✅ Verifying This Release

The USB image (SafeKeep-Release-v1.51.zip):

  1. Download SafeKeep-Release-v1.51.zip, SHA256SUMS.txt and SHA256SUMS.txt.asc.
  2. Verify the signature:
    gpg --verify SHA256SUMS.txt.asc SHA256SUMS.txt
    Expect a good signature from Anton anton@safekeepbitcoin.com, key fingerprint A333 EB82 6F70 A79A 736F 0994 8EA7 DD8C EDBA 86C2.
  3. Unzip, then check the image hash:
    shasum -a 256 -c SHA256SUMS.txt
    Expected: f8a68013188355161228e336528738f1a871ca1558afea7ce3f651bf60c5ecbe SafeKeep-Release-v1.51.img

The update file (SafeKeep-Update-v1.51.tar) carries its own signature, which the stick checks before installing.

The app on its own (boot.html; its checksum file is SHA256SUMS, without .txt):

sha256sum -c SHA256SUMS
gh attestation verify boot.html -R Pasalon0404/SafeKeepVault
gpg --verify SHA256SUMS.asc SHA256SUMS

Expected: acb23943b6c71be52039159bb5cf4251a93e39fa0798da7f8664831108751559 boot.html

The boot.html inside the USB image and the update file is byte-for-byte this release's boot.html. See VERIFYING.md for every check.

Assets 10
Loading