0.30.4

What's Changed

This release adds various UI improvements, improves the built-in favicon extractor reliability and fixes multiple reported bugs. This release also adds Indonesian as an official supported language (thanks to our contributors on Crowdin!).

Additionally, this release contains a number of forward-compatible improvements in preparation for our upcoming major data model update. As a sneak peek: we've been hard at work on the next big update for the past three months, and it will make vault syncing up to 10x faster, allow to have additional primary authentication methods besides a master password, support sharing vaults with family members etc. More on this soon!

🚀 New Features

• Update password reset docs instructions by @lanedirt in #2339 (reported by @VincentGijsen)
• Improve FaviconExtractor reliability so it works for more websites by @lanedirt in #2342 (reported by @Ahmedbd23 and @bundyland)
• Mobile app link in emails should always open in default external browser by @lanedirt in #2343 (reported by @arianr04)
• Make notes field resizable in mobile app by @lanedirt in #2345 (reported by @k4waiiiii)
• Make apps gracefully degrade instead of erroring with upcoming major update by @lanedirt in #2347
• Add Indonesian language option to all apps by @lanedirt in #2349
• Improve item creation flow UI in all apps by including type chooser by @lanedirt in #2351 (reported by @SanderRutten and @createthisnl)
• New Crowdin updates by @lanedirt in #2350

🐞 Bug Fixes

• Use nginx resolved X-Real-IP instead of appended X-Forwarded-For by @lanedirt in #2326 (reported by @vusalGIT)
• Fix negative pageSize which could cause a HTTP 500 in email API controller by @lanedirt in #2337 (reported by kelvisOp)
• Add max length for mobile login requests and add rate limiting by @lanedirt in #2341 (reported by kelvisOp)
• Add SRP validate endpoint sanity checks to prevent potentially incorrect lockouts by @lanedirt in #2340 (reported by kelvisOp)
• Update Android mobile app biometrics check so it checks for Level 3 biometrics everywhere by @lanedirt in #2344

🧩 Dependencies Updates

• Bump the npm_and_yarn group across 1 directory with 3 updates by @dependabot[bot] in #2328

Full Changelog: 0.30.3...0.30.4

0.30.3

What's Changed

Important

🔒 Server-Side Request Forgery via DNS rebinding in Favicon Extraction (disclosed 2026-08-16): This version 0.30.3 includes a fix for a server-side request forgery vulnerability in the favicon extraction component: (GHSA-7hm6-fj4m-pf6f). Self-hosted users of AliasVault are recommended to update to 0.30.3 or later. AliasVault cloud users are not affected.

This release fixes multiple reported bugs, updates translations, and improves the browser extension autofill accuracy so it works on more websites.

A big thank you to our community for reporting issues and suggesting improvements on GitHub. Your feedback helps make AliasVault better for everyone!

🚀 New Features

• Update URL sanitization for mobile app credential create flow by @lanedirt in #2301
• Add support for exporting/importing multiple URLs with CSV export format by @lanedirt in #2318
• Improve browser extension autofill form detection for login pages using shadow root by @lanedirt in #2320
• New Crowdin updates by @lanedirt in #2317

🐞 Bug Fixes

• Resolve favicon extraction target DNS host only once per connection by @lanedirt in #2311
• Copy TOTP to clipboard when authenticating with passkey too in all apps by @lanedirt in #2316
• Fix issue in browser extension which sometimes opened a recently created credential while it shouldn't by @lanedirt in #2313
• Do not truncate revealed password, instead allow to span to multiple lines by @lanedirt in #2322

🧩 Dependencies Updates

• Bump the npm_and_yarn group across 6 directories with 2 updates by @dependabot[bot] in #2302
• Bump sanitize-html from 2.17.4 to 2.17.5 in /apps/browser-extension in the npm_and_yarn group across 1 directory by @dependabot[bot] in #2314

Full Changelog: 0.30.2...0.30.3

0.30.2

What's Changed

This release introduces a small but powerful new Duplicate Credential option, letting you copy any credential with all standard and custom fields included. This allows you to easily reuse custom fields (templates) without having to add everything to each new credential. You can find this new option when right-clicking on a credential in the list view, or with a long press on mobile.

Additionally this release bumps dependencies, contains minor bugfixes and also fixes certain issues that could occur during custom builds.

🚀 New Features

• Add right-click context menu and credential duplicate option to all apps by @lanedirt in #2294
• Update items display default sort order to newest first by @lanedirt in #2292
• Replace Typescript identity generator with Rust-based cross platform implementation by @lanedirt in #2289
• New Crowdin updates by @lanedirt in #2275

🐞 Bug Fixes

• Add missing password length slider to browser extension password settings popup by @lanedirt in #2280

🧩 Dependencies Updates

• Update server dependencies and prevent builds from failing on dependency vulnerabilities by @lanedirt in #2283
• Bump brace-expansion from 1.1.14 to 1.1.16 in /apps/mobile-app in the npm_and_yarn group across 1 directory by @dependabot[bot] in #2284
• Bump the npm_and_yarn group across 6 directories with 5 updates by @dependabot[bot] in #2286
• Bump the npm_and_yarn group across 1 directory with 2 updates by @dependabot[bot] in #2290

Full Changelog: 0.30.1...0.30.2

0.30.1

What's Changed

This is a minor release which includes various technical improvements and bugfixes for reported issues, as well as improvements for self-hosted setups specifically.

This release also introduces new Irish and Hungarian language options to all apps, as well as adds Romanian language option to the passphrase generator.

🚀 New Features

• Add Irish language option to all apps by @lanedirt in #2246
• Add Hungarian language option by @lanedirt in #2248
• Add Romanian language to passphrase generator by @VuzzyM in #2228
• Strip pathnames from to be stored URLs in browser extension to cleanup UI by @lanedirt in #2232
• Show server version in browser extension and mobile app settings footer by @lanedirt in #2233
• Add password length slider to item create/edit screens in web app by @lanedirt in #2237
• Add support for using external postgresql server instead of built-in container by @lanedirt in #2239
• Allow HEAD method on API healthcheck URL for self-hosted reverse-proxy by @lanedirt in #2242
• Make deploy method visible in web app and webserver headers for troubleshooting purposes by @lanedirt in #2244
• Update web app language switcher dropdown to use native select by @lanedirt in #2250
• Update web app light mode dropdown menu font color to be darker for better readability by @lanedirt in #2260
• Update minimum client version to 0.26.3 to prepare for upcoming release by @lanedirt in #2266
• Improve sync performance by reducing unnecessary data loading in API and local by @lanedirt in #2269
• Improve autofill form detection in browser extension by @lanedirt in #2271
• New Crowdin updates by @lanedirt in #2251

🐞 Bug Fixes

• Make keyboard shortcuts button in browser extension show up for Firefox and Safari too by @lanedirt in #2258
• Browser extension do not close expanded popup when deleting an email by @lanedirt in #2273
• Add /secrets Docker bind mount path override via .env for self-hosted deployments by @lanedirt in #2274
• Improve all-in-one container first boot initialization recovery in case it would get stuck by @lanedirt in #2256
• Add server-side PostgreSQL keepalive settings to improve connection reliability by @lanedirt in #2254

New Contributors

• @VuzzyM made their first contribution in #2228

Full Changelog: 0.30.0...0.30.1

0.30.0

What's Changed

Welcome to AliasVault v0.30.0 🎉

This release now adds support for generating passphrases (based on word dictionaries) in addition to random-character passwords in all AliasVault apps. This has been one of the most upvoted feature requests on GitHub. Click the settings icon in the password field to switch between the two, or set your preferred default for new credentials in the Password Settings.

We also updated a lot of things behind the scenes in the last couple of weeks: we revamped our self-hosted docs website to be more accessible and user friendly. We also moved our official website and communications to aliasvault.com, after recently acquiring this domain. User email aliases continue to use @aliasvault.net, creating a more clear distinction between official AliasVault team/support addresses (.com) and user-generated aliases (.net).

Finally, we're also hard at work on making the sync mechanism and datamodel more efficient. The work on this is well underway and will significantly improve vault synchronization performance across all apps once ready. These upcoming improvements will enable us to introduce vault sharing as well. Stay tuned!

Highlighted new features/improvements

1. Generate passphrases via the Diceware dictionary method. Supports 6 languages out of the box: English, Dutch, German, French, Spanish and Italian. Help with improving the dictionary lists is very welcome! Please check for more info: https://docs.aliasvault.com/contributing/passphrase-dictionaries/
2. Update default cloud API domain from aliasvault.net to aliasvault.com in all apps
3. Improved browser extension UI for highlighting credentials for the current website in the popup, as well as streamlined new credential/alias creation via the autofill prompt.
4. You can now change default password generator settings in the browser extension via a new settings menu option, bringing it line with the other apps
5. Add default Ctrl+Shift+L browser extension shortcut for manually triggering the autofill popup (now also works if autofill popup is disabled in settings)
6. Fixed multiple reported bugs and improved reliability

🚀 New Features

• Migrate documentation site from Jekyll to Docusaurus by @lanedirt in #2192
• Reduce web app memory usage during import/export and vault updates by @lanedirt in #2198
• Update aliasvault.net to aliasvault.com in all apps as default URL by @lanedirt in #2200
• Browser extension show current site item as a suggestion instead of opening it automatically by @lanedirt in #2205
• Add passphrase generator by @lanedirt in #2214
• Improve 2FA TOTP create flow to show secret field on top and make custom label optional by @lanedirt in #2217
• Assign Ctrl+Shift+L default keyboard shortcut to browser extension manual autofill prompt by @lanedirt in #2222
• Improve TOTP 2FA autofill field detection in browser extension by @lanedirt in #2224
• New Crowdin updates by @lanedirt in #2188

🐞 Bug Fixes

• Fix browser extension content script item creation error when server is offline by @lanedirt in #2207
• Update mobile app and browser extension server connection timeouts by @lanedirt in #2208
• Fix passkey login issues for several websites in browser extension by @lanedirt in #2210
• Make web app refresh button always force a UI re-render to correctly show new vault contents by @lanedirt in #2219

🧩 Dependencies Updates

• Bump dompurify from 3.4.9 to 3.4.11 in /apps/browser-extension in the npm_and_yarn group across 1 directory by @dependabot[bot] in #2190
• Update NPM dependency packages by @lanedirt in #2195

Full Changelog: 0.29.6...0.30.0

0.29.6

What's Changed

This release addresses several reported issues, and also includes the following improvements:

• Add support for Passkey passive autofill in the browser extension, preventing automatic popups from interfering with the browsing experience
• Add new Password custom field type (with generate password button)

🚀 New Features

• Show skeleton loader when opening an email modal in the web app (UX improvement) by @lanedirt in #2153
• Update default developer ports by @lanedirt in #2167
• Improve install.sh db-export reliability and add verbose mode by @lanedirt in #2169
• Details on how to run the backup import/export script by @vincegre in #2171
• Security autofill tightening by @AmarBego in #2160
• docs: fix some typos by @jeis4wpi in #2175
• Implement browser extension passive autofill flow for passkeys by @lanedirt in #2178
• Add support for RS-256 public key algorithm for passkeys by @lanedirt in #2181
• Add password custom field type by @lanedirt in #2187

🐞 Bug Fixes

• Fix accented characters being stripped from email previews by @lanedirt in #2155
• Include custom fields when importing a .avux or .avux file by @lanedirt in #2164
• Fix notices during browser extension debug build by @lanedirt in #2172
• Add browser extension force-ascii output conversion to fix load errors on Safari 18.4 and lower by @lanedirt in #2173
• Restore 2FA and notes during credential edit popup reopen in browser extension by @lanedirt in #2183

🧩 Dependencies Updates

• Bump esbuild from 0.25.0 to 0.28.1 in /apps/server/AliasVault.Client in the npm_and_yarn group across 1 directory by @dependabot[bot] in #2165
• Bump dompurify from 3.4.0 to 3.4.9 in /apps/browser-extension in the npm_and_yarn group across 1 directory by @dependabot[bot] in #2184
• Bump the npm_and_yarn group across 5 directories with 1 update by @dependabot[bot] in #2185

New Contributors

• @vincegre made their first contribution in #2171
• @jeis4wpi made their first contribution in #2175

Full Changelog: 0.29.5...0.29.6

0.29.5

What's Changed

Minor bugfix release that addresses several reported issues, improves the web app email performance and updates translations.

🚀 New Features

• Improve email inbox load times by @lanedirt in #2139
• Improve error reporting for Android native autofill issues by @lanedirt in #2142
• New Crowdin updates by @lanedirt in #2133

🐞 Bug Fixes

• Fix unlock method flicker when opening browser extension popup by @lanedirt in #2137
• Fix email server remaining in a soft-stopped state after server errors by @lanedirt in #2145
• Fix incorrect "field is required" validation errors in web app by @lanedirt in #2149
• Update install.sh db-import with input streaming to reduce import errors with larger filesizes by @lanedirt in #2150

Full Changelog: 0.29.4...0.29.5

0.29.4

What's Changed

Important

🔒 Browser extension passkey validation vulnerability (disclosed 2026-06-18): This version 0.29.4 includes a fix for a browser extension-specific passkey validation issue (CVE-2026-55587). Users of the AliasVault browser extension are recommended to update to version 0.29.4 or later. Self-hosted servers, the web app, and mobile apps were not affected. Fix commit: a60d096

Bugfix release: fixes for potential Android app crashes, updated translations, improved browser extension passkey reliability, and performance enhancements in the web app.

🚀 New Features

• Improve email page performance in web app by @lanedirt in #2126
• New Crowdin updates by @lanedirt in #2115

🐞 Bug Fixes

• Make all username checks case insensitive in API by @lanedirt in #2123
• Android app crashes when trying to render certain favicons by @lanedirt in #2127

🧩 Dependencies Updates

• Bump the npm_and_yarn group across 3 directories with 1 update by @dependabot[bot] in #2118
• Bump the npm_and_yarn group across 1 directory with 1 update by @dependabot[bot] in #2119
• Bump react-router from 7.12.0 to 7.16.0 in /apps/browser-extension in the npm_and_yarn group across 1 directory by @dependabot[bot] in #2130

Full Changelog: 0.29.3...0.29.4

0.29.3

What's Changed

This release includes various community-suggested improvements and bugfixes. Notable changes this release:

1. Improved autofill:
   • Android: autofill suggestions now show up in the keyboard instead of as a popup (when supported)
   • All apps: Show up to 10 autofill matched suggestions instead of 3
   • Improved form field detection in browser extension
2. Improved web app performance for larger vaults
3. Updated app usability in several areas, reducing amount of clicks for common actions
4. Improved web app import reliability
5. And many other smaller improvements and bugfixes

Join our Discord community to stay up-to-date on the project with the latest releases and to discuss upcoming features with us.

🚀 New Features

• Hide browser extension autofill when detected field is removed by @lanedirt in #2043
• Improve web app navigation performance for large vaults (200+ items) by @lanedirt in #2045
• Add browser extension context menu "Autofill 2FA" manual option by @lanedirt in #2048
• Add more auto-lock timeout options to mobile app by @lanedirt in #2050
• Add max upload size env setting support to all-in-one docker container by @lanedirt in #2052
• Make email attachments open in default viewer app (when available) instead of prompting download by @lanedirt in #2072
• Add mobile app authentication grace period to prevent re-prompts by @lanedirt in #2074
• Add arrow based keyboard navigation to browser extension by @lanedirt in #2076
• fix(extension): hold mobile-login RSA private key as non-extractable CryptoKey by @AmarBego in #2078
• Increase default shown autofill suggestions from 3 to 10 in all apps by @lanedirt in #2087
• Add Android inline keyboard autofill suggestions support by @lanedirt in #2086
• Make dropdown navigation visible on recently deleted page by @lanedirt in #2091
• feat: cache email RSA CryptoKeys by public key by @AmarBego in #2083
• Remember and auto-prompt last used unlock method in browser extension by @lanedirt in #2103
• Enable browser extension to autofill AliasVault web app login (opt-in) by @lanedirt in #2101
• feat: add email format switcher (HTML/Plain/Source) by @Sanjays2402 in #1893
• Fix Android passkeys not working in the PayPal app and others by @lanedirt in #2112

🐞 Bug Fixes

• Use explicit font size for browser extension autofill popup to prevent host page conflicts by @lanedirt in #2032
• Update importers to skip failed rows instead of failing whole import by @lanedirt in #2041
• Update browser extension autofill form detector logic by @lanedirt in #2058
• Update browser extension autofill form detector by @lanedirt in #2061
• Make browser extension lock/logout events sync to other open browser extension windows too by @lanedirt in #2065
• Fix email attachment download in mobile apps by @lanedirt in #2069
• Enable scrolling inside browser extension autofill popup by @lanedirt in #2094
• Fix browser extension add-credential form from showing previously saved item by @lanedirt in #2104
• Fix issue with custom field label value when using enter key in web app by @lanedirt in #2108
• Update browser extension autofill form detection so it works with Tailwind CSS forms by @lanedirt in #2110
• Auto-type email instead of value insert in browser extension autofill by @lanedirt in #2114

🧩 Dependencies Updates

• Update GitHub action versions by @lanedirt in #2031
• Bump faraday from 2.14.1 to 2.14.2 in /docs in the bundler group across 1 directory by @dependabot[bot] in #2036
• Upgrade mobile app Expo and browser extension WXT frameworks by @dependabot[bot] in #2067
• Add external dependencies refresh housekeeping scripts (gpm passkeys privileged apps list) by @lanedirt in #2085

New Contributors

• @AmarBego made their first contribution in #2078
• @Sanjays2402 made their first contribution in #1893

Full Changelog: 0.29.2...0.29.3

0.29.2

What's Changed

This minor release includes various improvements and bugfixes for reported issues. Most notable new features are: 2FA code is now auto-copied to clipboard on iOS and Android during autofill, as well as improving Android vault unlock flow. This release also adds a new vault storage insights page to the web app.

Join our Discord community to stay up-to-date on the project with the latest releases and to discuss upcoming features with us.

🚀 New Features

• Copy TOTP to clipboard after autofill on iOS and Android by @lanedirt in #2008
• Make Android autofill vault unlock flow work via overlay instead of via app by @lanedirt in #2025
• Add unused favicon and attachment cleanup check to reduce vault size by @lanedirt in #1992
• Add vault storage insights to web app client by @lanedirt in #1996
• Reduce false-positive browser extension autofill matching for TOTP fields by @lanedirt in #1999
• Improve API email retrieval performance by @lanedirt in #2015

🐞 Bug Fixes

• Web app password generator length slider does not work correctly for some languages by @lanedirt in #2003
• Fix importers adding second empty attachment for each actual existing attachment by @lanedirt in #2005
• Apps sometimes propose to link url to a credential that already has that url by @lanedirt in #2012
• Improve browser extension startup to prevent browser warnings by @lanedirt in #2013
• Update browser extension form detector to better detect password fields by @lanedirt in #2024

🧩 Dependencies Updates

• Bump fast-xml-builder from 1.1.5 to 1.2.0 in /apps/mobile-app in the npm_and_yarn group across 1 directory by @dependabot[bot] in #2001

Full Changelog: 0.29.1...0.29.2