<!-- released: 2026-07-28 -->

Deletions now sync properly across your devices, and importing from another password
manager shows you exactly what it is about to use.

• Deleting a service now sticks. Remove an entry on one device and it stays removed
  everywhere, instead of reappearing the next time another device syncs.
• Delete-versus-edit conflicts are kept, not guessed. If you delete a service on one
  device while editing it on another, Keygrain shows you both and lets you decide, rather
  than silently picking a winner.
• Fewer failed syncs when several devices write at once.

• You can now verify the login address before anything is imported. The preview shows
  the address read from your export next to the site Keygrain derived from it, because the
  site is what generates your password — if the two disagree, you need to know before you
  rotate a real password, not after.
• Fixed: imports from KeePassXC could get the wrong site. Exports that store a bare
  address (github.com rather than https://github.com) fell back to the entry title, so
  a "GitHub" entry was imported as github instead of github.com. That produced a
  different password than adding the same account by hand, and autofill never matched it.
  If you already migrated from such an export, check the Site field on those entries.
• Entries whose address had to be guessed from the entry title are now marked, and entries
  with no address at all say so.

No algorithm changes — every password, code, key and seed is byte-identical to before
(SPEC v4).

The biggest Keygrain update yet: autofill, one-time codes, and full control over your
account and synced data.

• In-field autofill — an opt-in inline icon and account dropdown on your saved
  sites, so you can fill credentials in place.
• TOTP one-time codes — fill 2FA codes from the inline dropdown, the popup, the
  keyboard shortcut, or the right-click menu. No separate authenticator app.
• Smarter matching across multiple accounts and subdomains, plus a discoverability tip
  for the fill shortcut.

• Switch account — use a different master secret / email without a full reset,
  from the menu or the lock screen.
• Offline mode — use Keygrain without syncing; turn sync back on anytime.
• Delete synced data — remove your encrypted blob from the sync server, with an
  option to keep a local copy on this device.

• Popup password fill now loads its autofill dependency reliably.
• Clearer lock-screen message when the entered secret/email doesn't match this
  device's account.
• Removed the misleading "clears in 30 seconds" clipboard message.

No algorithm changes — every password, code, key, and seed is byte-identical to before
(SPEC v4).

• SSH private key display — view and copy SSH private keys in the browser extension and Android app
• Open-source visibility — GitHub link in website nav, extension settings, and mobile HelpScreen
• README badges — CI status, license, and platform badges

• All platform versions unified and enforced by CI (ci/version-check.sh)
• Extension manifests include homepage_url pointing to the repository
• LICENSE (MIT) added to repo root

• Unified commit history across GitHub and GitLab
• Default branch renamed to main

• 🟢 Chrome Extension
• 🦊 Firefox Add-on
• 📱 Android APK
• 🐍 pip install keygrain