Keygrain R4

Keygrain R4

Date: 2026-09-17

Component	Version
Chrome extension	1.4.1
Firefox extension	1.4.1
Android app	1.4.1
Python CLI	1.1.0

Chrome extension

[1.4.1] - 2026-09-17

• Enhanced security & PIN removal: eliminated persistent PIN storage in favor of volatile in-memory auto-lock with configurable timeouts.
• Two-tier auto-lock UX: keep service names visible for fast search while credentials require quick re-authentication.
• Multi-asset tabs: manage web logins, standalone SSH keys, and HD wallets directly inside the popup.
• Zero-Knowledge sync: all service names, keys, and timestamps are end-to-end encrypted with zero server visibility.
• Streamlined HD wallets: generates standard 12 or 24-word BIP-39 disaster recovery phrases directly.
• Email-decoupled keys: SSH keys and crypto wallets derive independently of your account email.
• Autofill shortcut: default shortcut updated to Ctrl+Shift+L (Command+Shift+L on Mac) to avoid browser conflicts.
• Offline mode & server controls: easily isolate from sync networks or erase server data while keeping your local vault.

Firefox extension

[1.4.1] - 2026-09-17

• Enhanced security & PIN removal: eliminated persistent PIN storage in favor of volatile in-memory auto-lock with configurable timeouts.
• Two-tier auto-lock UX: keep service names visible for fast search while credentials require quick re-authentication.
• Multi-asset tabs: manage web logins, standalone SSH keys, and HD wallets directly inside the popup.
• Zero-Knowledge sync: all service names, keys, and timestamps are end-to-end encrypted with zero server visibility.
• Streamlined HD wallets: generates standard 12 or 24-word BIP-39 disaster recovery phrases directly.
• Email-decoupled keys: SSH keys and crypto wallets derive independently of your account email.
• Autofill shortcut: default shortcut updated to Ctrl+Shift+L (Command+Shift+L on Mac) to avoid browser conflicts.
• Offline mode & server controls: easily isolate from sync networks or erase server data while keeping your local vault.

Android app

[1.4.1] - 2026-09-17

• Multi-asset keychain: manage logins, standalone SSH keys, and HD wallets in one place.
• Email-decoupled keys: SSH keys and crypto wallets derive independently from your account email.
• Zero-Knowledge sync: all item metadata and timestamps are end-to-end encrypted with zero server visibility.
• Autofill TOTP: automatically detects and fills 2FA one-time verification codes on login forms.
• Interactive Demo Mode: try Keygrain with sample logins, SSH keys, and wallets before entering your master secret.
• Streamlined HD wallets: generates standard 12 or 24-word BIP-39 disaster recovery phrases directly.
• More reliable biometric unlock handling across device manufacturers.

Python CLI

[1.1.0] - 2026-09-17

• Email-decoupled keys: SSH keypair and HD wallet derivations derive independently from your account email.
• Streamlined HD wallet derivation: generate standard 12 or 24-word BIP-39 mnemonic seed phrases directly.
• Added wallet export formats via --format (json, sparrow, electrum).
• keygrain --version now reports git commit metadata and dirty state when run from source.

Keygrain for Firefox 1.3.0

Keygrain for Firefox — 1.3.0

• You can now stop a password migration part-way through. Services you have not rotated are removed from the migration batch and that decision syncs to your other devices; their old site passwords remain unchanged, so change them if needed.
• Migration progress stays consistent between the popup, migration page, and synced data.
• Domain matching during migration now uses the public suffix list, improving handling of subdomains and multi-part domains.
• The keyboard shortcut no longer conflicts with Firefox's own shortcuts.
• Sync serialization and password-symbol validation are more consistent across Keygrain clients.

Keygrain CLI 1.0.1

Keygrain CLI — 1.0.1

• Unsafe sync endpoints are now rejected; HTTPS is required except for loopback development endpoints.
• Password-symbol validation is consistent with the other Keygrain clients.
• Wallet expansion diagnostics now distinguish input mismatches from hardware faults.

Keygrain for Chrome 1.3.0

Keygrain for Chrome — 1.3.0

• You can now stop a password migration part-way through. Services you have not rotated are removed from the migration batch and that decision syncs to your other devices; their old site passwords remain unchanged, so change them if needed.
• Migration progress stays consistent between the popup, migration page, and synced data.
• Domain matching during migration now uses the public suffix list, improving handling of subdomains and multi-part domains.
• Sync serialization and password-symbol validation are more consistent across Keygrain clients.
• Additional security and reliability fixes improve migration and sync behavior.

Keygrain for Chrome 1.2.0

Deletions now sync properly across your devices, and importing from another password
manager shows you exactly what it is about to use.

Sync

• Deleting a service now sticks. Remove an entry on one device and it stays removed
  everywhere, instead of reappearing the next time another device syncs.
• Delete-versus-edit conflicts are kept, not guessed. If you delete a service on one
  device while editing it on another, Keygrain shows you both and lets you decide, rather
  than silently picking a winner.
• Fewer failed syncs when several devices write at once.

Importing from another password manager

• You can now verify the login address before anything is imported. The preview shows
  the address read from your export next to the site Keygrain derived from it, because the
  site is what generates your password — if the two disagree, you need to know before you
  rotate a real password, not after.
• Fixed: imports from KeePassXC could get the wrong site. Exports that store a bare
  address (github.com rather than https://github.com) fell back to the entry title, so
  a "GitHub" entry was imported as github instead of github.com. That produced a
  different password than adding the same account by hand, and autofill never matched it.
  If you already migrated from such an export, check the Site field on those entries.
• Entries whose address had to be guessed from the entry title are now marked, and entries
  with no address at all say so.

No algorithm changes — every password, code, key and seed is byte-identical to before
(SPEC v4).

Verifying this build

SHA256SUMS.txt below is produced by GitHub Actions from this tag's commit. To reproduce it:

git clone https://github.com/iheb-eddine/keygrain.git && cd keygrain
git checkout chrome-v1.2.0
git checkout main -- extension/build.sh   # see note
bash extension/build.sh
sha256sum extension/dist/keygrain-chrome-1.2.0.zip

Why the extra checkout: build.sh at this commit did not normalise the builder's
timezone or file modes, so it only reproduced our hash on a UTC machine with a 022 umask.
That is fixed on main, and the fixed builder is a ~40-line shell script you can read in
full before running it. From the next release onward the plain instructions are enough.

The Chrome Web Store re-packages and re-signs what we upload, so the installed .crx will
not hash-match this zip — what you verify is the file contents, which are unminified and
unbundled. See VERIFY.md.

Keygrain for Firefox 1.2.0

Deletions now sync properly across your devices, and importing from another password
manager shows you exactly what it is about to use.

Sync

• Deleting a service now sticks. Remove an entry on one device and it stays removed
  everywhere, instead of reappearing the next time another device syncs.
• Delete-versus-edit conflicts are kept, not guessed. If you delete a service on one
  device while editing it on another, Keygrain shows you both and lets you decide, rather
  than silently picking a winner.
• Fewer failed syncs when several devices write at once.

Importing from another password manager

• You can now verify the login address before anything is imported. The preview shows
  the address read from your export next to the site Keygrain derived from it, because the
  site is what generates your password — if the two disagree, you need to know before you
  rotate a real password, not after.
• Fixed: imports from KeePassXC could get the wrong site. Exports that store a bare
  address (github.com rather than https://github.com) fell back to the entry title, so
  a "GitHub" entry was imported as github instead of github.com. That produced a
  different password than adding the same account by hand, and autofill never matched it.
  If you already migrated from such an export, check the Site field on those entries.
• Entries whose address had to be guessed from the entry title are now marked, and entries
  with no address at all say so.

No algorithm changes — every password, code, key and seed is byte-identical to before
(SPEC v4).

Keygrain v1.0.0

Keygrain v1.0.0

Keygrain's first stable release. One master secret deterministically derives every
password, TOTP code, SSH key, and HD‑wallet seed — no vault, nothing stored, the same
inputs always produce the same outputs on every platform. This release brings the
Android app to Google Play and the CLI to PyPI.

No algorithm changes. Derivation is unchanged (SPEC v4) — every password, code,
key, and seed is byte‑identical to previous versions. Upgrading changes nothing you
generate.

Highlights

• 📱 Android on Google Play — first Play Store release (also still available as a direct APK).
• 🐍 CLI on PyPI — pip install keygrain.
• 🧩 Native in‑field autofill + TOTP autofill in the browser extension.
• 🗑️ Delete your synced data on demand, from the app or the API.

What's new by target

Android

• Google Play debut, targeting Android 16 (API 36) with 16 KB page‑size support; application id com.secbytech.keygrain.
• Offline mode — derive without a network connection.
• Switch account — move between identities in‑app.
• Delete server data — remove your synced blob from within the app.
• Stability — fixed an ANR (app‑not‑responding) case.

Browser extension (Chrome / Firefox)

• Opt‑in in‑field autofill — an inline Keygrain icon and account dropdown on your saved sites. Off by default; enabled only with explicit consent.
• TOTP one‑time‑code autofill — fills 2FA codes across four surfaces: the inline dropdown, the popup, the Ctrl/Cmd+Shift+K shortcut, and the context menu. The seed never enters the page — only the current code is filled.
• Smarter shortcut & matching — a discoverability tip plus robust multi‑account and subdomain resolution that defers rather than fill the wrong account.

CLI / Python (PyPI)

• pip install keygrain — published via PyPI Trusted Publishing (OIDC, no long‑lived token), with reproducible wheels and PEP 740 provenance attestations.
• Read‑only sync download + local encrypted cache — retrieve passwords, TOTP seeds, and SSH material from your synced configuration.

Sync server

• Data deletion — an auth‑gated DELETE /api/sync/:lookup_id lets you erase your encrypted blob from the server (this backs the app's "delete server data"). The server still only ever stores opaque ciphertext.

Verify what you run

Keygrain is built to be checked, not just trusted:

• Reproducible browser‑extension zips with published SHA256SUMS on each GitHub release.
• A publicly verifiable web generator (source in web/, served verbatim).
• A published Android signing‑certificate fingerprint.
• Reproducible PyPI wheels with provenance attestations.

See VERIFY.md.

Install / upgrade

• 📱 Android — Google Play (link on listing approval) · or APK from https://keygrain.com
• 🧩 Chrome — https://chromewebstore.google.com/detail/keygrain/goeemlncopfbcnppjalfmgdalbhlgdha
• 🦊 Firefox — https://addons.mozilla.org/addon/keygrain/
• 🐍 CLI — pip install keygrain
• 🌐 Web — https://keygrain.com/generate

Upgrade notes

• Android package rename (com.badrani.keygrain → com.secbytech.keygrain): the
  Play build has a new application id, so it installs as a fresh app. Existing
  sideload users who install the new build will see it alongside the old one —
  uninstall the old com.badrani.keygrain app. Your data is safe: sync is keyed by
  your derived identifier (not the package), so re‑entering your master secret restores
  everything; only device‑local settings (e.g. auto‑lock) reset.

v0.11.0

What's New

Features

• SSH private key display — view and copy SSH private keys in the browser extension and Android app
• Open-source visibility — GitHub link in website nav, extension settings, and mobile HelpScreen
• README badges — CI status, license, and platform badges

Improvements

• All platform versions unified and enforced by CI (ci/version-check.sh)
• Extension manifests include homepage_url pointing to the repository
• LICENSE (MIT) added to repo root

Infrastructure

• Unified commit history across GitHub and GitLab
• Default branch renamed to main

Install

• 🟢 Chrome Extension
• 🦊 Firefox Add-on
• 📱 Android APK
• 🐍 pip install keygrain