2Secret v1.1.0

Quantum-resistant sharing:

• Vault keys shared with other people are wrapped with a hybrid of X25519 and
  ML-KEM-768 (FIPS 203), so recorded traffic or a stolen server database
  cannot be decrypted later with a quantum computer. The recipient's device
  re-wraps the key with its own 256-bit account key on its next sync.
• Accounts publish their ML-KEM public key automatically on their first sync
  with this version; their fingerprint changes once when that happens.
• New Secret Keys have 130 bits of entropy (26 random characters instead of
  25). Existing Secret Keys keep working.
• Update every device: 2Secret 1.0 cannot open a vault shared with the new
  scheme until the recipient has synced once with 1.1.

Security hardening, informed by the LastPass breaches:

• Browser extension: right before filling, the page and every frame are
  checked against the item's websites, so credentials never reach a frame
  from another site or a page the tab navigated to after the popup opened.
• Websites are matched by registrable domain using the Public Suffix List,
  https items are never filled into http pages, ports are respected.
• Master passwords need at least 12 characters and a "good" strength rating.
• Clients and servers refuse Argon2id parameters below 19 MiB / 2 passes.
• Encrypted data is padded to size classes, so the server no longer learns
  exact item sizes.

Downloads

File	What
2Secret_*_aarch64.dmg	macOS app for Apple silicon (M1 and newer)
2Secret_*_x64.dmg	macOS app for Intel Macs
*.msi, *-setup.exe	Windows app
*.deb, *.rpm, *.AppImage	Linux app (x86_64)
2secret-*-<platform>.tar.gz / .zip	2secret CLI and 2secret-server for Linux, macOS (Apple silicon and Intel) and Windows
2secret-web-*.tar.gz	Web vault – serve it with 2secret-server --web-dir
2secret-extension-*.zip	Browser extension for Chrome, Edge, Brave and Firefox (load unpacked)
SHA256SUMS	Checksums of all files

Server image for x86_64 and ARM64 (e.g. Raspberry Pi 4/5 with a 64-bit OS):
docker pull ghcr.io/joostiphone/2secret:latest – see
self-hosting.

On macOS, drag 2Secret to Applications and open it. If macOS says it cannot
verify the app, open System Settings → Privacy & Security and click Open
Anyway (on macOS 14 and older you can also right-click the app and choose
Open).
On Windows, SmartScreen may ask you to confirm (More info → Run anyway).

FreeBSD, OpenBSD, NetBSD and iOS: build from source, see the
README.