Chromium Extension 1.39.0

• A keyboard shortcut (Ctrl+Shift+L, Cmd+Shift+L on a Mac) fills the page's login: the first one for the site, or the one whose username you're typing.
• A small New login link appears under a site's logins on the username field.
• A new option confirms passkeys once per unlock.
• You can choose the app language, and Korean is available.
• You can duplicate an entry and create an email alias from the generator without a login.
• Reused passwords now count as At Risk, and TOTP setup accepts loose otpauth URIs and Steam Guard keys.
• Import tags now include the time, so two imports on one day are distinguishable.
• The sync log can be copied, and sync reconnects more reliably.

All changes (27)

Features

• add the time to the import tag, so two imports on one day differ (#209)
• Korean, and translate this batch's new strings (#211)
• the fill shortcut fills the first login, or the one being typed
• choose the app's language (#163)
• create an email alias from the generator, without a login (#120)
• a New login row under a site's logins in the dropdown (#213)
• a keyboard shortcut to fill the page's login (#215)
• confirm passkeys once per unlock
• duplicate an entry (#212)
• tag what an import adds with the day it ran (#209)
• count reused passwords as At Risk (#210)
• read loose otpauth URIs and Steam Guard keys (#204, #55)
• copy the sync log, and fix the German section title

Bug Fixes

• make New login a small link, on the username field only (#213)
• let the detail footer wrap, so Duplicate fits a narrow phone in German
• name the no-timeout auto-lock option for what ends it (#188)
• correct the German recovery-code reset line (#216)
• drop the vault setup line about choosing where to store it
• a deleted vault's name leaves the list
• keep the vault list's place when coming back from a record (#200)
• a blank relay setting means the hosted relay
• let in a device whose inviter's key came in the same envelope
• a connection always reports its end, so a peer can reconnect
• detect code boxes that each have their own wrappers

Other

• chore(deps): bump node-forge to 1.4.3 and fast-xml-parser to 5.12.0 (Dependabot)
• chore(i18n): translate the duplicate, reuse, import-tag, save and auto-lock strings
• chore(repo): point everything at bramble-sh/bramble

Full Changelog: 1.38.0-chromium...1.39.0-chromium

Firefox Extension 1.36.0

• A keyboard shortcut (Ctrl+Shift+L, Cmd+Shift+L on a Mac) fills the page's login: the first one for the site, or the one whose username you're typing.
• A small New login link appears under a site's logins on the username field.
• A new option confirms passkeys once per unlock.
• You can choose the app language, and Korean is available.
• You can duplicate an entry and create an email alias from the generator without a login.
• Reused passwords now count as At Risk, and TOTP setup accepts loose otpauth URIs and Steam Guard keys.
• Import tags now include the time, so two imports on one day are distinguishable.
• The sync log can be copied, and sync reconnects more reliably.

All changes (27)

Features

• add the time to the import tag, so two imports on one day differ (#209)
• Korean, and translate this batch's new strings (#211)
• the fill shortcut fills the first login, or the one being typed
• choose the app's language (#163)
• create an email alias from the generator, without a login (#120)
• a New login row under a site's logins in the dropdown (#213)
• a keyboard shortcut to fill the page's login (#215)
• confirm passkeys once per unlock
• duplicate an entry (#212)
• tag what an import adds with the day it ran (#209)
• count reused passwords as At Risk (#210)
• read loose otpauth URIs and Steam Guard keys (#204, #55)
• copy the sync log, and fix the German section title

Bug Fixes

• make New login a small link, on the username field only (#213)
• let the detail footer wrap, so Duplicate fits a narrow phone in German
• name the no-timeout auto-lock option for what ends it (#188)
• correct the German recovery-code reset line (#216)
• drop the vault setup line about choosing where to store it
• a deleted vault's name leaves the list
• keep the vault list's place when coming back from a record (#200)
• a blank relay setting means the hosted relay
• let in a device whose inviter's key came in the same envelope
• a connection always reports its end, so a peer can reconnect
• detect code boxes that each have their own wrappers

Other

• chore(deps): bump node-forge to 1.4.3 and fast-xml-parser to 5.12.0 (Dependabot)
• chore(i18n): translate the duplicate, reuse, import-tag, save and auto-lock strings
• chore(repo): point everything at bramble-sh/bramble

Full Changelog: 1.35.0-firefox...1.36.0-firefox

Android 0.30.0

• You can choose the app language, and Korean is available.
• You can duplicate an entry and create an email alias from the generator without a login.
• Reused passwords now count as At Risk, and TOTP setup accepts loose otpauth URIs and Steam Guard keys.
• Import tags now include the time, so two imports on one day are distinguishable.
• The sync log can be copied, and sync reconnects more reliably.
• You can save an attachment to your device.
• Autofill follows each login's subdomain match setting.
• Passkeys now work when you scan a QR code shown on another device.

All changes (25)

Features

• add the time to the import tag, so two imports on one day differ (#209)
• Korean, and translate this batch's new strings (#211)
• choose the app's language (#163)
• create an email alias from the generator, without a login (#120)
• confirm passkeys once per unlock
• save an attachment to the device (#217)
• duplicate an entry (#212)
• tag what an import adds with the day it ran (#209)
• count reused passwords as At Risk (#210)
• read loose otpauth URIs and Steam Guard keys (#204, #55)
• copy the sync log, and fix the German section title

Bug Fixes

• trust Play Services for passkey QR codes from another device
• honour a login's subdomain match setting in Android and iOS autofill (#215)
• let the detail footer wrap, so Duplicate fits a narrow phone in German
• name the no-timeout auto-lock option for what ends it (#188)
• correct the German recovery-code reset line (#216)
• drop the vault setup line about choosing where to store it
• a deleted vault's name leaves the list
• keep the vault list's place when coming back from a record (#200)
• a blank relay setting means the hosted relay
• let in a device whose inviter's key came in the same envelope
• a connection always reports its end, so a peer can reconnect

Other

• chore(deps): bump node-forge to 1.4.3 and fast-xml-parser to 5.12.0 (Dependabot)
• chore(i18n): translate the duplicate, reuse, import-tag, save and auto-lock strings
• chore(repo): point everything at bramble-sh/bramble

Full Changelog: 0.29.0-android...0.30.0-android

Desktop 0.18.0

• You can choose the app language, and Korean is available.
• You can duplicate an entry and create an email alias from the generator without a login.
• Reused passwords now count as At Risk, and TOTP setup accepts loose otpauth URIs and Steam Guard keys.
• Import tags now include the time, so two imports on one day are distinguishable.
• The sync log can be copied, and sync reconnects more reliably.
• On Linux, the browser extension can now link to Snap and Flatpak Firefox, Zen and Floorp.
• RPMs are now signed, and apt remove no longer removes the repository key.

All changes (26)

Features

• add the time to the import tag, so two imports on one day differ (#209)
• Korean, and translate this batch's new strings (#211)
• choose the app's language (#163)
• create an email alias from the generator, without a login (#120)
• confirm passkeys once per unlock
• duplicate an entry (#212)
• tag what an import adds with the day it ran (#209)
• count reused passwords as At Risk (#210)
• read loose otpauth URIs and Steam Guard keys (#204, #55)
• copy the sync log, and fix the German section title

Bug Fixes

• write the Firefox host manifest for Snap, Flatpak, Zen and Floorp on Linux (#218)
• keep the keyring on apt remove, so apt update keeps working
• let the detail footer wrap, so Duplicate fits a narrow phone in German
• name the no-timeout auto-lock option for what ends it (#188)
• correct the German recovery-code reset line (#216)
• drop the vault setup line about choosing where to store it
• a deleted vault's name leaves the list
• keep the vault list's place when coming back from a record (#200)
• a blank relay setting means the hosted relay
• let in a device whose inviter's key came in the same envelope
• a connection always reports its end, so a peer can reconnect

Other

• chore(nix): refresh the pnpm hash for the new lockfile
• chore(nix): refresh the pnpm hash for the new lockfile
• chore(deps): bump node-forge to 1.4.3 and fast-xml-parser to 5.12.0 (Dependabot)
• chore(i18n): translate the duplicate, reuse, import-tag, save and auto-lock strings
• chore(repo): point everything at bramble-sh/bramble

Full Changelog: 0.17.0-desktop...0.18.0-desktop

Chromium Extension 1.38.0

You can now confirm it’s you for passkey actions with Touch ID, Windows Hello, or a security key.

• Fixed a passkey issue where the confirmation popup could reopen after finishing.
• Improved colour contrast and focus visibility to meet WCAG AA.
• The "Open website" action now fills the login in the tab it opens.
• Fixed Nostr event signing to match how relays check events.
• The "Lock when the screen locks" option is now hidden on Firefox.

All changes (7)

Features

• confirm it's you with Touch ID, Windows Hello or a security key
• "Open website" fills the login in the tab it opens

Bug Fixes

• really stop the popup reopening a finished confirm (#187)
• meet WCAG AA contrast and focus visibility
• tighten launch and fill after review
• sign Nostr events the way relays check them
• hide "Lock when the screen locks" on Firefox

Full Changelog: 1.37.0-chromium...1.38.0-chromium

Firefox Extension 1.35.0

Passkey confirmation can now use Touch ID, Windows Hello, or a security key.

• The passkey confirmation popup no longer reopens after you finish confirming.
• Text contrast and keyboard focus indicators now meet WCAG AA.
• "Open website" fills the login in the tab it opens.
• Nostr sync events are now signed the way relays expect.
• The "Lock when the screen locks" option is hidden on Firefox.

All changes (7)

Features

• confirm it's you with Touch ID, Windows Hello or a security key
• "Open website" fills the login in the tab it opens

Bug Fixes

• really stop the popup reopening a finished confirm (#187)
• meet WCAG AA contrast and focus visibility
• tighten launch and fill after review
• sign Nostr events the way relays check them
• hide "Lock when the screen locks" on Firefox

Full Changelog: 1.34.0-firefox...1.35.0-firefox

Android 0.29.0

Passkey confirmation can now use Touch ID, Windows Hello, or a security key.

• The passkey confirmation popup no longer reopens after a completed confirmation.
• Text contrast and focus visibility now meet WCAG AA.
• Nostr sync events are now signed in the way relays validate them.
• Locking the app now ends the keep-unlocked session used by autofill.

All changes (5)

Features

• confirm it's you with Touch ID, Windows Hello or a security key

Bug Fixes

• really stop the popup reopening a finished confirm (#187)
• meet WCAG AA contrast and focus visibility
• sign Nostr events the way relays check them
• locking the app ends autofill's keep-unlocked session

Full Changelog: 0.28.0-android...0.29.0-android

Desktop 0.17.0

You can now confirm passkey actions with Touch ID, Windows Hello, or a security key.

• The passkey confirmation popup no longer reopens after you finish confirming.
• Text contrast and focus indicators now meet WCAG AA.
• Nostr sync events are now signed the way relays check them.
• The desktop app locks automatically after the inactivity timeout.

All changes (5)

Features

• confirm it's you with Touch ID, Windows Hello or a security key
• auto-lock after the inactivity timeout

Bug Fixes

• really stop the popup reopening a finished confirm (#187)
• meet WCAG AA contrast and focus visibility
• sign Nostr events the way relays check them

Full Changelog: 0.16.0-desktop...0.17.0-desktop

Chromium Extension 1.37.0

Bramble now links the desktop app and browser extension by comparing an emoji, and the two sides can combine their vaults.

• The extension can offer to become the default password manager, ask for Touch ID when the popup opens, and prefer the current page's own subdomain login.
• The vault list can be filtered from Overview cards and by attachments, and the search field has a clear button.
• The password generator is available from the header, and you can open a login's website from its list entry or view.
• Adding a device to sync now requires the master password, a synced vault keeps its master password, and device names are shared across the group.
• Backups can keep only the latest copy.

All changes (80)

Features

• offer to become the default password manager (#135)
• clear button in the search field (#201)
• a combine hides the old vault and asks nothing
• ask whether to delete the old vault after a combine
• a vault combined in brings its alias provider and backup targets
• the old vault stays only where removing it would lose something
• a copy of an entry on both sides brings what it holds
• keeping the old vault after a combine is a choice
• no half pairings: no Not now, retries, a link per vault
• give the single desktop link to the vault that syncs with it
• one desktop link per vault
• drop the browser's empty vault once the desktop's arrives
• combine the browser's vault into the desktop's
• link the desktop app from the first screen
• tell the linking browser what the desktop vault holds
• decide what linking does from what each side holds
• one emoji check on both screens
• link to the desktop app by comparing emoji
• Noise XX link handshake with its handshake hash
• give the vault only to the browser that just paired, over the link
• tag link sync frames with a room
• keep desktop and browser on the local link, off the relay
• a synced vault keeps its master password
• adding a device requires a master password
• name any device in the group, the same on every device
• filter the list from the Overview cards
• the vault's name follows it to every device in the group
• let a biometric gate keep the key native, and name Windows Hello
• ask for Touch ID as the popup opens, opt-in (#180)
• open the password generator from the header (#162)
• filter the list to items with attachments (#157)
• open a login's website from the list and its view (#141)
• say what a "Never" auto-lock still locks on (#146)
• add a "Latest only" option to Backups to keep (#176)

Bug Fixes

• name entry types the same in the filter and the add menu (#203)
• tie the disk record to the state being written
• a save no longer writes over another window's
• copy from the disk, and hide the old vault until the user decides
• mark the old vault before the removal's wait
• a page's pipe carrying the link counts as up
• show no unlock form on an unlocked vault
• bring the link back at once with a window open, and sooner without
• let a worker from before the grant be replaced, so the link comes back
• write nothing until the open vault has loaded
• hold the link while locked, and end a half-made pairing on both sides
• finish what the user chose, and wait as long as the link does
• hold the open vault's link, and drop links only on the app's word
• keep the desktop link card through its own vault copy
• carry sync on the link's own connection after linking
• one session per native pipe a page lends
• clearer linking on both screens
• keep the held desktop link in step
• a peer skipped for the local link stays skipped
• the joining browser opens the vault copy on the link
• link the desktop app from the first screen and finish there
• name damaged entries left behind, and say only what is true about the old vault
• let go of an emoji link nobody answers
• treat Firefox's missing native host as missing, not as an older app
• derive the link emoji from a committed nonce exchange
• fall back to the relay copy and its emoji for older apps and extensions
• show a failure after the join where the screen still shows it
• count files and the alias provider before calling a vault empty
• copy held-back look-alikes into the vault that is open now
• run everything after the join against the desktop's vault
• don't reopen the popup on a finished passkey confirm (#187)
• shorten the synced master-password note
• drop the disconnect hint from the synced master-password note
• confirm a key-only vault's actions under the platform rpID too
• one prompt for tap to unlock when several keys are registered
• call the header's generator button by the screen it opens
• mark a Lock-button lock as the user's before anything shows it
• detect Google's authenticator code field (#158)
• leave the edit form by going back, so back can't reopen it (#150)
• offer the page's own subdomain's login first (#183)
• drop the breach warning when a page updates the password (#161)

Other

• chore(link): drop what the old-vault question left behind
• chore(deps): type-check with TypeScript 7, the native Go compiler
• chore(i18n): translate the revised desktop link strings
• chore(i18n): translate the desktop link strings
• test(fixtures): grow the screenshot seed to 2,100 entries

Full Changelog: 1.36.0-chromium...1.37.0-chromium

Firefox Extension 1.34.0

Bramble can now link the desktop app to the browser by comparing an emoji, sync over a local link rather than the relay, and let you choose whether to keep or remove the old vault after combining.

• The extension can offer to become the default password manager.
• Adding a device to a synced vault requires the master password, and a synced vault keeps its master password.
• You can filter the vault list from the Overview cards, including by whether items have attachments, and clear the search field with a button.
• The password generator opens from the header, and a login's website can be opened from the list or item view.
• Backups can be set to keep only the latest backup, and the extension can ask for Touch ID when the popup opens.

All changes (80)

Features

• offer to become the default password manager (#135)
• clear button in the search field (#201)
• a combine hides the old vault and asks nothing
• ask whether to delete the old vault after a combine
• a vault combined in brings its alias provider and backup targets
• the old vault stays only where removing it would lose something
• a copy of an entry on both sides brings what it holds
• keeping the old vault after a combine is a choice
• no half pairings: no Not now, retries, a link per vault
• give the single desktop link to the vault that syncs with it
• one desktop link per vault
• drop the browser's empty vault once the desktop's arrives
• combine the browser's vault into the desktop's
• link the desktop app from the first screen
• tell the linking browser what the desktop vault holds
• decide what linking does from what each side holds
• one emoji check on both screens
• link to the desktop app by comparing emoji
• Noise XX link handshake with its handshake hash
• give the vault only to the browser that just paired, over the link
• tag link sync frames with a room
• keep desktop and browser on the local link, off the relay
• a synced vault keeps its master password
• adding a device requires a master password
• name any device in the group, the same on every device
• filter the list from the Overview cards
• the vault's name follows it to every device in the group
• let a biometric gate keep the key native, and name Windows Hello
• ask for Touch ID as the popup opens, opt-in (#180)
• open the password generator from the header (#162)
• filter the list to items with attachments (#157)
• open a login's website from the list and its view (#141)
• say what a "Never" auto-lock still locks on (#146)
• add a "Latest only" option to Backups to keep (#176)

Bug Fixes

• name entry types the same in the filter and the add menu (#203)
• tie the disk record to the state being written
• a save no longer writes over another window's
• copy from the disk, and hide the old vault until the user decides
• mark the old vault before the removal's wait
• a page's pipe carrying the link counts as up
• show no unlock form on an unlocked vault
• bring the link back at once with a window open, and sooner without
• let a worker from before the grant be replaced, so the link comes back
• write nothing until the open vault has loaded
• hold the link while locked, and end a half-made pairing on both sides
• finish what the user chose, and wait as long as the link does
• hold the open vault's link, and drop links only on the app's word
• keep the desktop link card through its own vault copy
• carry sync on the link's own connection after linking
• one session per native pipe a page lends
• clearer linking on both screens
• keep the held desktop link in step
• a peer skipped for the local link stays skipped
• the joining browser opens the vault copy on the link
• link the desktop app from the first screen and finish there
• name damaged entries left behind, and say only what is true about the old vault
• let go of an emoji link nobody answers
• treat Firefox's missing native host as missing, not as an older app
• derive the link emoji from a committed nonce exchange
• fall back to the relay copy and its emoji for older apps and extensions
• show a failure after the join where the screen still shows it
• count files and the alias provider before calling a vault empty
• copy held-back look-alikes into the vault that is open now
• run everything after the join against the desktop's vault
• don't reopen the popup on a finished passkey confirm (#187)
• shorten the synced master-password note
• drop the disconnect hint from the synced master-password note
• confirm a key-only vault's actions under the platform rpID too
• one prompt for tap to unlock when several keys are registered
• call the header's generator button by the screen it opens
• mark a Lock-button lock as the user's before anything shows it
• detect Google's authenticator code field (#158)
• leave the edit form by going back, so back can't reopen it (#150)
• offer the page's own subdomain's login first (#183)
• drop the breach warning when a page updates the password (#161)

Other

• chore(link): drop what the old-vault question left behind
• chore(deps): type-check with TypeScript 7, the native Go compiler
• chore(i18n): translate the revised desktop link strings
• chore(i18n): translate the desktop link strings
• test(fixtures): grow the screenshot seed to 2,100 entries

Full Changelog: 1.33.0-firefox...1.34.0-firefox