# v5.17.0 Passbolt 5.17.0 "Mad World" introduces passkeys for multi factor authentication, improves autofill reliability, improves permission changes review when moving resources, and brings PIN code resources to QuickAccess. This release also includes security fixes and performance improvements. ## Passkeys for MFA This version adds passkeys as a second authentication factor, alongside the TOTP, Yubikey OTP and Duo providers that are already supported. It answers a requirement provifing multi-factor authentication that resists phishing, which one-time codes cannot provide. Built on the WebAuthn/FIDO2 standard, it is bound to the domain of the Passbolt instance, and Safari refuses to use it anywhere else, so a lookalike site has nothing to capture. Thus passkeys can be used to protect against this kind of phishing. They are available in every edition. Once an administrator enables them, each user can register passkeys, using a security key like a YubiKey or the biometrics built into their laptop, phone, such as Touch ID. ## A new autofill detection engine Autofill is a core part of the Passbolt browser experience, and v5.17 rebuilds its detection engine from scratch. It tackles two frustrations: no autofill on a form that needs it, and an autofill icon in a field that has nothing to do with credentials. Getting this right is harder than it looks, because no two websites build their forms the same way. Field names differ, labels come in many languages, and the underlying code varies widely from site to site. The new engine understands the context of each field, from the structure of the form to the labels around it, before deciding whether to step in. The first benchmarks show form detection rises from 74% to 93.4%, while processing cost stays low. ## Safer permission handling during resource moves "Mad World" brings the permission review introduced in 5.14 to resources and folders moves. Now, all operations involving a shared item, ask for the same explicit confirmation. A move needs this step because moving a resource in another folder, can change who has access to it. Previously, users chose between keeping the current permissions and applying those of the destination folder, without seeing what either option would produce. From now on, every move follows the destination folder strategy: permissions inherited from the origin parent folder are removed, and those of the destination folder take their place. Before saving, Passbolt shows who will gain, lose or keep access, and this proposal can be refined with the usual granular control. ## Access PIN Codes through QuickAccess This release brings PIN codes to QuickAccess. Users no longer need to switch to the web workspace to retrieve PINs. PIN codes also get offline availability, using the same security and synchronization controls as other secrets. This is part of a broader effort to expand QuickAccess and Offline Mode support to all remaining resource types in upcoming releases. ## Security Improvements v5.17.0 brings targeted security improvements and hardening measures resulting from internal and external assessments. * Safer Cookie Handling in Safari: Cookie management is strengthened following insights from the recent Cure53 audit. Cookies are now more strictly isolated preventing them from being exposed to other hosts. * Clipboard Auto-Clear Protection: Thanks to an external researcher, Alex J, an edge case has been fixed where a malicious website could cancel the clipboard-clearing timer. Copied secrets are now reliably cleared from the clipboard as intended. A dedicated security bulletin will be published soon. It will provide more details on each of the resolved issues, including their potential impact and how they were addressed. Updating to Passbolt 5.17.0 is recommended to benefit from these security improvements. ## Conclusion Many thanks to everyone who provided feedback, reported bugs and contributed to making Passbolt better.

# v5.16.1 Passbolt 5.16.1 “Enjoy the Silence” introduces Offline Mode enabling users to select passwords and TOTPs for offline access when the Passbolt server cannot be reached, avoiding separate exports that can quickly become outdated. ## Access essential credentials offline Keep critical credentials available during server outages or connectivity loss with read-only access to credentials prepared in advance. After authenticating locally with their passphrase, users can access and autofill them through QuickAccess and the in-form menu. This helps maintain access continuity in restricted networks, data centres, and other low-connectivity environments. ## Choose the passwords for offline availability Users can mark up to 1,000 passwords and TOTPs created in Passbolt version 5 for offline access, keeping storage focused on the credentials that are actually needed. Changes to the offline-enabled password or TOTP are automatically reflected in its stored copy while connected. If the user’s access to a password or TOTP is revoked, its cached copy is removed from offline storage. ## Protect and control offline access Keep offline access protected and under administrator control. Cached metadata, secrets, and the metadata private key remain encrypted in the browser extension’s private storage. While the plugin is enabled by default, administrators decide whether Offline Mode is available and can use RBAC to control which roles can view, mark, or remove resources for offline access. Passbolt Pro Edition administrators can also set offline session duration and cached data expiry. Community Edition uses the default limits of a 5-minute offline session and 7-day data expiry. ## Safari clipboard fix This version also fixes an issue on Safari where copy and paste could stop working due to conflicts with other extensions. ## Conclusion Many thanks to everyone who provided feedback, reported bugs, and contributed to making passbolt better.

# v5.15.0 Passbolt 5.15.0 improves form detection for autofill, makes permission changes easier to review, and adds several security and administration improvements. ## Clearer permission confirmation changes The permission confirmation dialog has been visually improved to make access changes clearer before they are applied. Users can now understand the impact of permission changes more clearly before applying them. New badges show whether permissions are being added, modified, or deleted. Deleted permissions can also be rolled back to their original state before confirmation, making access changes easier to review and correct. ## Improved autofill Passbolt 5.15.0 continues the process to improve the autofill feature in several phases. This first iteration improves detection on websites that were previously unsupported, enhancing the end-user experience by identifying complex forms and simplifying it. Upcoming releases will have iterations focusing on reducing false positives and refining the classification further. ## Deleted user notifications Administrators are now notified whenever any user is deleted, giving them better visibility into account removals across the organisation. Previously, notifications were sent only when an administrator was deleted. ## Conclusion As usual, release 5.15.0 has dependency updates Many thanks to everyone who provided feedback, reported bugs, and contributed to making passbolt better!

# v5.14.4 Passbolt 5.14.4 is a dedicated Safari extension release and introduces explicit permission confirmation prompts to improve control over shared resources. It also includes scalability and monitoring improvements for larger deployments, security updates, and bug fixes including a Safari specific one. ## Sharing transparency Users now receive an explicit confirmation dialog before creating items in shared folders or editing shared resources. This provides full permission transparency before changes take effect, preventing accidental privilege exposure. In addition, when a group appeared in the access list, its individual members were not visible, making it difficult to assess the actual reach of shared access. Group members are now displayed directly within the dialog. As the first stage of a broader security initiative, future updates will extend these confirmations to folder move operations and offer enhanced permission preview dialogs. ## Scalability and monitoring Administrators who monitor their instance through the healthcheck status endpoint (/healthcheck/status.json) will get a more complete signal. This endpoint now verifies the availability of the caching system. For organisations that manage large numbers of credentials, the browser extension now starts paginating resource fetching, which reduces server load. This is part of a continuous effort to improve passbolt scalability, with folder pagination being next in line. ## Maintenance and security This release fixes a number of bugs, among them an issue that prevented Safari from redirecting to a newly created resource. It also ships third-party dependency upgrades and security advisory fixes. Check the detailed logs below for the full list. ## Resource Suggestions Suggested resources in the browser extension are now ranked using an improved URL relevance algorithm. Exact URL matches appear first, followed by parent paths and domain matches, allowing users to select the correct credentials faster and with fewer autofill errors. ## Additional Improvements Passbolt Pro extends email-free account setup and recovery to OIDC and ADFS SSO providers, improving onboarding by integrating directly with enterprise identity management systems. Finally, this release lays the foundational backend architecture required for upcoming offline functionality. ## Conclusion Many thanks to everyone who provided feedback for the permission confirmation feature, reported bugs, and contributed to making Passbolt better!

Passbolt 5.12.1 makes the Safari browser extension generally available, ending the open beta period. This release also introduces a new PIN code resource type, PingOne as a new SSO provider, OAuth support for SMTP authentication with Microsoft Exchange Online along with improvements to TOTP field detection and the usual round of security and dependency updates. ## Safari Extension Out of Beta The Safari extension is now offered by default to all Safari users, on equal footing with Chrome, Firefox, and Edge. This milestone reflects months of work across both our internal testing and the open beta period, during which organisations enabled the extension on their own instances and gave feedback. Many thanks to everyone who joined the TestFlight program for the open beta. Your feedback shaped this release. ## SCIM: audit fixes and general availability (Passbolt Pro) SCIM provisioning, introduced as beta in Passbolt 5.5.0, is now marked as stable. With SCIM, administrators can create, update, suspend, and delete users directly from their identity provider, without ever touching the Passbolt UI. Microsoft Entra ID and Okta have been tested and validated as supported providers. This milestone follows an external security audit conducted by Cure53, whose findings have been addressed across this and previous releases. The full report will be published shortly and made available to the community. ## PingOne SSO support (Passbolt Pro) This release adds PingOne as a new SSO provider. Organisations using PingOne can now authenticate their users without leaving their existing identity infrastructure. PingOne joins the list of supported SSO providers alongside Azure AD, AD FS, Google, and the generic OpenID Connect connector that supports providers such as Keycloak or other in-house identity systems. ## SMTP OAuth support for Microsoft Exchange Online This release introduces OAuth 2.0 support for SMTP email delivery with Microsoft Exchange Online. Microsoft has announced that basic authentication for SMTP will be disabled by default at the end of 2026 (see Microsoft's updated deprecation timeline). Organisations using Exchange Online can start transitioning to OAuth now, ahead of the deadline. ## Other changes This release adds autofill support for ProxMox, OVH, Supermicro IPMI, and several other websites. We continuously work to improve autofill coverage and the feedback from the community is invaluable. If you encounter a website where autofill does not work as expected, do not hesitate to file a bug report. As usual, the release is also packed with additional improvements and fixes. Check out the detailed logs to learn more. ## Conclusion Many thanks to everyone who provided feedback, reported bugs, and contributed to making passbolt better!