Keyguard App Updates & Release Notes

New

• Linux AppImage builds now support zsync delta updates.
• Added GPG public certificate validation.

Agents

• Improves SSH and GPG agent reliability on Android.
• GPG key details now respect configured policies.
• SSH and GPG keys are revalidated after an agent request is approved.

Platforms

• Improves reliability when running multiple app instances on Windows.
• Improves system tray icon reliability on desktop platforms.

Fixes

• Syncing local accounts no longer requires an active internet connection.
• The 'Mark all as read' action in Watchtower now applies only to the currently filtered items.
• Moving an item to the root of a KDBX database is now saved correctly.
• Creating a Bitwarden Send now requires selecting a destination account.
• Changing backup settings no longer resets the retention policy.
• Ensures the latest master password is used for authentication.
• Improves WebDAV sync reliability.
• The vault item details screen now updates immediately when the Markdown notes preference is changed.
• Fixes progress display for cancelled or failed vault exports.
• Invalid regular expressions are now rejected in input fields.
• The key generator shows an OpenPGP-specific tip for RSA keys.
• The color picker selects the nearest available palette color.

New

• Keyguard for Linux is now available as an AppImage.

KDBX

• Fixes password decryption in KDBXv3 databases that have protected pooled attachments.
• KDBXv3 AES padding is now validated.
• Correctly handles both compressed and raw KDBX attachments.
• Fixes an issue with byte mirroring during database decoding.
• Line endings in KDBX XML data are now normalized according to the XML specification.
• Preserves UTF-16 surrogate pairs when handling KDBX XML data.

Fixes

• On Android, the app now requests the local network access permission when required.
• Database schema migrations on desktop platforms are now atomic.
• File encryption and decryption operations can now be cancelled.
• Fixes handling of large OpenPGP MDC files.

This release introduces several new capabilities for managing GPG keys, improves support for KeePass KDBX vaults, and includes various platform-specific stability fixes.

GPG and SSH

• Added an option to export GPG public and private keys as .asc.
• Added an option to send the verification email when uploading a GPG public key.
• Caches by-email VKS responses during throttle windows.
• Key names are now fetched after unlocking if displaying key names is disabled.

Platform improvements and fixes

• KDBX databases with a key file set no longer require a password.
• Displays a more detailed error message when failing to open a URI on desktop platforms.
• Fixed a crash on Android when the file picker reports that no activity was found.
• Fixed an issue on Windows where the agent process was not stopped before closing the IPC transport.
• Fixed copying on macOS.

This release introduces biometric unlock on Windows with Windows Hello, a major overhaul of the OpenPGP pipeline, and significant improvements to sync conflict resolution for KDBX users.

• e009f2ed - refactor: Fix Detekt violations
• baba1021 - Revert "deps: Bump Compose"
• a2373ed1 - refactor: Move Zip service in a util/zip/ KMP module
• a885d303 - refactor: Move Zxcvbn implementation in a util/zxcvbn/ KMP module
• a69856db - chore: Smaller changelog summary is better
• a98219e7 - tests: Clean-up some of the GPG smoke tests
• 5e1ad797 - Merge pull request #1552 from AChep/localization_action
• 1d475f0e - chore: Bump app version to 3.1.0 …

This release addresses a critical stability issue for Windows users.

Fixes and Improvements

• Resolved an issue that caused the application to crash on startup on Windows.

---

This release introduces comprehensive GPG key management, extends the SSH/GPG agent to Windows, and delivers a completely reworked synchronization engine for KeePass (KDBX) vaults. It also adds major new integrations for Android, WebDAV support for remote vaults, and numerous security and performance enhancements across all platforms.

GPG Key Management and Agent on Windows

Keyguard now includes first-class support for managing GPG keys and using them through an integrated agent, which is now also available on Windows.

• GPG Key Management: You can now import, manage, and use GPG keys directly within Keyguard. It is also now possible to set or modify the expiration date for GPG keys and subkeys.
• Agent on Windows: The SSH and GPG agents are now available on Windows, providing seamless integration with development tools, terminals, and Git.
• Caller-Scoped Approval: Agent requests can be approved on a per-caller basis, allowing you to grant persistent access for trusted applications without being prompted for every operation.
• Platform Support: Added support for GPG key item types on Wear OS and resolved an issue where agent-related items were not displayed correctly on Windows. …

This release introduces comprehensive GPG key management, extends the SSH/GPG agent to Windows, and delivers a completely reworked synchronization engine for KeePass (KDBX) vaults. It also adds major new integrations for Android, WebDAV support for remote vaults, and numerous security and performance enhancements across all platforms.

GPG Key Management and Agent on Windows

Keyguard now includes first-class support for managing GPG keys and using them through an integrated agent, which is now also available on Windows.

• GPG Key Management: You can now import, manage, and use GPG keys directly within Keyguard. It is also now possible to set or modify the expiration date for GPG keys and subkeys.
• Agent on Windows: The SSH and GPG agents are now available on Windows, providing seamless integration with development tools, terminals, and Git.
• Caller-Scoped Approval: Agent requests can be approved on a per-caller basis, allowing you to grant persistent access for trusted applications without being prompted for every operation.
• Platform Support: Added support for GPG key item types on Wear OS and resolved an issue where agent-related items were not displayed correctly on Windows.
• Security and Reliability: The GPG and SSH agents have been hardened with stricter key policy enforcement during signing and decryption, public key validation before imports, and more robust connection handling.

Reworked KeePass (KDBX) Sync and Attachments …

On desktop, the UI scale can now be overridden using the keyguard.uiScale JVM property. In-app links have also been updated to point to the new project website.

All changes

• e0eb233f - chore: Bump app name to 2.14.2
• d82df23f - docs: Add QR codes page
• a00987f3 - docs: Add Large type page
• 4ad4030c - docs: Add Appearance page
• 2a2c293b - refactor: Remove now unused SSH agent timeout animation #1454
• a540575e - chore: Bump arrow to 2.2.3
• 8dc6edef - chore: Bump haze to 2.0.0-alpha03
• ab0f1632 - chore: Bump okhttp to 5.4.0
• 4c9da771 - chore: Bump sqlcipher-android to 4.16.0 …

Forgot to bump the app version name for the release, there were no changes comparing to the previous one:

KeePass file watching on Android is now more reliable, particularly for files accessed via the content:// scheme and on older OS versions. One-time password generation has been improved; exported otpauth:// URIs are now spec-compliant and the mOTP period has been corrected to the standard 10 seconds. This release also rejects pre-login KDF downgrades, cleans up stale SSH agent state on restart, and properly binds the agent socket in Flatpak environments.

All changes

• 65e25991 - chore: Bump app version name to 2.14.1

KeePass file watching on Android is now more reliable, particularly for files accessed via the content:// scheme and on older OS versions. One-time password generation has been improved; exported otpauth:// URIs are now spec-compliant and the mOTP period has been corrected to the standard 10 seconds. This release also rejects pre-login KDF downgrades, cleans up stale SSH agent state on restart, and properly binds the agent socket in Flatpak environments.

All changes

• 793c953a - fix: Reject pre-login KDF downgrade
• 14edc0ff - fix(Android): Observe the .kdbx file under content:// scheme
• ffd0b477 - fix(otpauth): Make exported otpauth:// URIs spec-compliant
• a378651b - fix: Use the standard 10s period for mOTP instead of a custom 30s one
• 1d95b0e2 - fix: Fully clean-up old stale ssh agent state on agent restart
• 5b0f47b6 - fix: Http connection leak if file preview fails early …

This update introduces automatic vault backups to protect against data loss, along with fixes to improve backup reliability. On desktop, you can now use Ctrl+Shift+L to lock your vault, and issues with popup window and quick search focus have been resolved. The SSH agent now includes a request history viewer and improved timeout management. Additionally, the network timeout has been increased to 30 seconds and Android autofill performance is enhanced.

All changes

• ade168ba - chore: Missing jdkVersion declaration
• f52c4704 - chore: Bump app version to 2.14.0
• 99002681 - tests: Correct stale Backup behavior
• b08d4c1f - fix(Desktop): Request foreground on Windows / Linux when showing a popup window
• 0d98b246 - fix(Desktop): After quick search pops up for a second time it does not auto-focus the input field
• 6262d80e - improvement(MacOS): Better Popup window management with Accessory path …

WebAuthn Level 3 support has been added for Android, and window capture protection is now available on Windows. On Windows and macOS, the app will now use the system's accent color. The previously used barcode format is also now remembered on a per-item basis. Fixes in this release correct WebAuthn authenticator flags, improve domain matching for autofill, resolve a Watchtower search bug, and prevent a potential crash in the TOTP component.

All changes

• 06066aac - chore: Bump app version to 2.13.0
• c6dddea0 - refactor(KMP): Fake signalr websockets to allow iOS tets to pass
• dac56dd1 - refactor(KMP): Switch to explicit binary search implementation because the method is not available for KMP
• 29e5b1b2 - feat(Android): Webauthn Level 3
• 7ac90ee9 - fix: Handle public suffix exception rules in TLD impl
• 56ded491 - @billiegoose has signed the CLA in #1435 …

In-app previews are now available for image and text attachments, including on WearOS. The clipboard can now be configured to clear automatically, and the desktop app can be set to minimize after copying an item. Watchtower now supports using a custom HIBP token for username breach checks. This release also improves Bitwarden sync compatibility and fixes a potential crash on Android when launching the Large Type activity.

All changes

• 65e88418 - Merge pull request #1430 from AChep/localization_action
• 38f8fb66 - [AUTO] Update localization library
• e3f0c4d7 - build: fix missing string tokens
• 63c9affc - Merge pull request #1414 from AChep/localization_action
• bcd5daa7 - Merge pull request #1425 from AChep/dependabot/gradle/androidx.wear.compose-compose-material3-1.6.2
• 8526292a - Merge pull request #1426 from AChep/dependabot/gradle/androidxCamera-1.6.1 …

The SSH agent now features a key approval window and maintains a request history; its settings have been moved to a new Developer section. The password generator adds support for Cloudflare and Fastmail email forwarders, displaying service logos in the list. When merging vault items, you can now choose to keep, archive, or trash the originals, and password history is preserved through the process. For Bitwarden users, TOTP changes are now stored in password history and several sync reliability issues are resolved.

All changes

• f09d8c4d - tests: Correct Cloudflare email forwarder tests
• 41e73dc8 - chore: Adjust changelog generation script for a more human-sounding generation
• 89e5fceb - chore: Bump app version to 2.11.0
• 439b8e3d - refactor: Move the SSH agent settings from Security to a new Developer settings section
• b8159a72 - improvement: SSH agent key approval window #1407
• fbc9a809 - improvement: Maintain SSH agent history …

This update brings improvements for Wear OS and SSH functionality. The Wear OS app introduces a platform-specific UI for the change password screen, displays Watchtower alerts for SSH keys, and now respects Send tab visibility preferences. For SSH users, the in-app tutorial shows actual socket paths. This release also resolves issues where the Wear OS vault did not persist through restarts and trashed SSH keys were not correctly omitted from lists or signing requests.

All changes

• e8fd4433 - chore: Bump app version to 2.10.2
• 0104295f - refactor(Desktop): Allow both prod & dev builds running side by side
• f78a8289 - improvement(Wear): Use a Wear-specific UI for the CHange password screen
• c41b8e1a - improvement(SSH): Wear SSH key watchtower alert
• 51ef5e4b - fix(Wear): Persist vault database through app restarts
• 66514a6f - fix(SSH): Omit trashed SSH keys from list & sign requests …

This update addresses several user interface issues. On Android, a layout rendering issue in the subscriptions view has been corrected. Additionally, the 'Send' tab will no longer flicker upon application launch, as its visibility state is now loaded from the cache to prevent waiting for upstream status.

All changes

• 90113b81 - chore: Bump app version to 2.10.1
• a8879e2f - fix(Android): Remove double wrapping into surface for subscriptions layout
• 2d222012 - fix: Prevent Send tab visibility from always waiting for the upstream status instead of using cache -- no more flicker on launch
• 7bb52de2 - docs: Add attachment upload feature to vault

This update introduces support for file attachments and Bitwarden Sends. Passkey authentication is now enforced if the authentication mode is set to preferred or higher. Performance for lists has been updated, and UI animations now use the Material 3 motion scheme. This release also resolves an autofill crash on pre-Android 10 devices, clears the password field when the unlock screen is moved to the background, and addresses various issues with Bitwarden file uploads and the new Send feature.

All changes

• c4fe2ce6 - fix: Prevent Send tab launching it hidden state if you have many accounts
• 1b953aeb - chore: Bump app version to 2.10.0
• 9d9e24c2 - Merge pull request #1383 from AChep/localization_action
• e57a3c84 - Merge pull request #1394 from AChep/justdeleteme_action
• 02afe559 - Merge pull request #1395 from AChep/tld_public_suffix_list_action
• ed79ad1f - Merge pull request #1396 from AChep/passkeys_action …