Passbolt

No entries match these filters. Clear filters

1. changelog Oct 28, 2026 · issue 123

   Passbolt 5.17.0 adds phishing-resistant passkeypasskeyPhishing-resistant sign-in credentials built on FIDO2/WebAuthn: the device holds a private key and proves possession instead of the user typing a password. They sync across a user's devices. MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. and extends QuickAccess and Offline Mode to PIN codes⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   ⤢ ⤢ ⤢

   ▶ ⤢
   • Adds phishing-resistant passkey MFA to the browser extension⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Confirms permission changes during resource moves in the browser extension
   • Improves autofill detection across modern websites in the browser extension
   • Moves the Microsoft Edge extension to Manifest V3 for continued credential access as Microsoft phases out Manifest V2
   • Adds phishing-resistant passkey MFA to the browser extension⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Confirms permission changes during resource moves in the browser extension

   2 more in Everything

2. updated seen Oct 21, 2026 · issue 115

   Passbolt 5.17.0 adds phishing-resistant passkeypasskeyPhishing-resistant sign-in credentials built on FIDO2/WebAuthn: the device holds a private key and proves possession instead of the user typing a password. They sync across a user's devices. MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. and extends QuickAccess and Offline Mode to PIN codes.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   ⤢ ⤢ ⤢

   ▶ ⤢
   • Adds phishing-resistant passkey MFA as a new multi-factor authenticationmulti-factor authenticationMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. option.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Confirms permission changes when resources are moved, surfacing a review step before the move completes.
   • Improves autofill detection across modern websites.
   • Adds phishing-resistant passkey MFA as a new multi-factor authenticationmulti-factor authenticationMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. option.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   2 more in Everything

3. updated seen Oct 17, 2026 · issue 111

   Passbolt gains Offline Mode (beta), secret history, zero-knowledge encrypted metadata, standalone notes, PIN code resource type, custom fields, RBACRBACRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. dynamic roles, and in-app edition switching.

   • Introduces Offline Mode (beta) giving users secure read-only access and autofill for selected credentials when the Passbolt server cannot be reached.
   • Introduces secret history, letting users view prior versions of stored secrets.
   • Enables administrators to run encrypted metadata in zero-knowledge mode.
   • Promotes encrypted metadata and new resource types to stable.
   • Introduces standalone notes as a distinct resource type.

   +10 more show less

   • Introduces a dedicated PIN code resource type.
   • Adds custom fields (beta) for resources.
   • Introduces dynamic role management in RBAC and drag-and-drop group assignment.
   • Adds in-app edition management so administrators can switch between Community and Pro editions directly from the application.
   • Adds shared metadata key rotation.
   • Adds personalised resource icons and support for multiple URIs per resource.
   • Adds support for encrypted resource metadata as an opt-in feature.
   • Adds a new administrative tool to manage LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory./AD integration.
   • Adds a detailed import summary report.
   • Adds resizable sidebars.

   15 details in Everything

   • New integration PingOne SSO integration
   • New integration SMTP OAuth support for Microsoft Exchange Online
   • Updated integration SCIM provisioning promoted out of beta
   • New supported platform Safari browser extension generally available
   • Updated supported platform Microsoft Edge extension migrated to Manifest V3
   • New supported platform PHP 8.5 support
   • New supported platform Slovenian and Ukrainian language support
4. changelog Oct 12, 2026 · issue 105

   Passbolt 5.16.2 migrates the Microsoft Edge browser extension to Manifest V3, preserving account settings and enabling automatic updates.

   • Updated supported platform Microsoft Edge extension moved to Manifest V3
5. changelog Sep 26, 2026 · issue 086

   Passbolt 5.16.0 adds Offline Mode (Beta) for secure read-only access and autofill when the server is unreachable.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   ⤢ ⤢ ⤢

   ▶ ⤢
6. changelog Sep 23, 2026 · issue 083

   Passbolt 5.16.0 adds Offline Mode (Beta) for secure read-only access and autofill when the server is unreachable.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   ⤢ ⤢ ⤢

   ▶ ⤢
7. 5.0.0 Sep 18, 2026 · issue 078

   API surface changed: +3 endpoints⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   API change

   API surface changed: +3 endpoints⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   • + DELETE /offline/settings/{id}.json
   • + GET /offline/settings.json
   • + POST /offline/settings.json
   • New endpoint DELETE /offline/settings/{id}.json⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • New endpoint GET /offline/settings.json
   • New endpoint POST /offline/settings.json

   3 details in Everything

8. docs update Sep 17, 2026 · issue 077

   Passbolt adds Offline mode API endpoints to get, save, and delete org-wide offline access settings.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ TRY IT
   Enable Offline mode for your organisation, allowing users up to 1 hour of unauthenticated access, retaining encrypted data for 7 days, and capping each user at 1000 offline items.
   copy

   $ curl -X POST --url {{API_BASE_URL}}/offline/settings.json \
     -H 'Content-Type: application/json' \
     -H 'Authorization: Bearer <token>' \
     --data '{"max_session_duration":3600,"data_retention_period":7,"max_items":1000}'

   Check whether Offline mode is currently configured for the organisation — an empty body means it is off.
   copy

   $ curl -X GET --url {{API_BASE_URL}}/offline/settings.json \
     -H 'Authorization: Bearer <token>'

   Disable Offline mode and remove all users' cached offline data by deleting the settings record.
   copy

   $ curl -X DELETE --url {{API_BASE_URL}}/offline/settings/606581db-4edc-44d4-8f5c-85e98cc70a0e.json \
     -H 'Authorization: Bearer <token>'

   • Adds GET /offline/settings.json endpoint to retrieve the organisation's current Offline mode settings (max_session_duration, data_retention_period, max_items), returning an empty body when Offline mode is disabled.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds POST /offline/settings.json endpoint (admin-only) to enable Offline mode by saving settings: max_session_duration (300–86400 s), data_retention_period (1–30 days), and max_items (1–5000 items per user).
   • Adds DELETE /offline/settings/{id}.json endpoint (admin-only) to disable Offline mode for the organisation and purge all users' locally stored offline items.
   • Adds contain[offline] query parameter to supported endpoints, appending per-resource offline availability marks to response bodies (returned as null when Offline mode is disabled or the requesting user's role cannot view offline items).

   4 details in Everything

9. docs update Sep 17, 2026 · issue 077

   Passbolt: Adds offlineMode plugin block in /etc/passbolt/passbolt.php (or PASSBOLT_PLUGINS_OFFLINE_MODE_ENABLED=false env var) to enable or disable the Offline Mode plugin instance-wide.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   ⤢
   └──▷ USE IT
   Disable the Offline Mode plugin entirely on a package-installed instance so the feature never appears in the administration menu.
   /etc/passbolt/passbolt.php copy

   'passbolt' => [
       'plugins' => [
           'offlineMode' => [
               'enabled' => false,
           ],
       ],
   ]

   On a Docker-based Pro instance, pin all Offline Mode settings to Community Edition defaults (5 min session, 7-day retention, 1000 items) by disabling only the policies plugin while keeping the feature available.
   .env copy

   PASSBOLT_PLUGINS_OFFLINE_MODE_POLICIES_ENABLED=false

   Navigate to Offline Mode admin settings in the Passbolt UI to configure session duration and data retention period for your organisation.
   📍In the Passbolt administration panel, go to Organisation settings › Offline mode. Set Session duration (5 minutes, 15 minutes, 1 hour, or 1 day) and Maximum data retention period (1, 7, 14, or 30 days), then click Save.
   • Adds offlineModePolicies plugin block in /etc/passbolt/passbolt.php (or PASSBOLT_PLUGINS_OFFLINE_MODE_POLICIES_ENABLED=false env var) to control whether Pro Edition customisable policy settings are active.
   • Adds max_session_duration API setting (any whole number of seconds, 300–86400) to control how long a user stays authenticated offline before re-entering their passphrase.
   • Adds data_retention_period API setting (any whole number of days, 1–30) to set the maximum time encrypted offline data is stored on a user's device before automatic deletion.
   • Adds max_items API setting (1–5000 on Pro/Business/Sovereign/Enterprise Cloud; fixed at 1000 on Community Edition) to cap the number of resources each user can mark available offline.
   • Adds three Role-Based Access ControlRole-Based Access ControlRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. actions — OfflineItemsView.view, OfflineItemsAdd.add, and OfflineItemsDelete.delete — to the API Permissions block, controlling who can view, mark, and unmark offline resources.

   +2 more show less

   • Offline mode stores only v5-format resources (passwords, TOTPTOTPA one-time password algorithm (RFC 6238) that generates short-lived codes from a shared secret and the current time, giving cyber tools phishing-resistant second-factor authentication without a server round-trip., notes, custom fields, PIN codes); v4 resources and folders cannot be marked as available offline.
   • Administrators receive email notifications (You edited the Offline Mode settings / You disabled Offline Mode) whenever Offline Mode settings are saved or the feature is disabled.

   7 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !Disabling Offline Mode (switching the toggle off and saving) immediately deletes every user's offline-marked items across the organisation with no separate confirmation step; re-enabling does not restore them.
   • !Setting the OfflineItemsView.view RBACRBACRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. action to deny for a role deletes the offline items already marked by users holding that role (deletion occurs on the next server-side cleanup run).
   • !Downgrading from Pro to Community Edition leaves existing Offline Mode settings in place; the Community Edition validator rejects them on the next save unless the flush_pro_data command is run first.
10. docs update Sep 17, 2026 · issue 077

    Passbolt: Supports offline mode, allowing users to mark resources as available offline and sign in to access them when the Passbolt server is unreachable.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

11. docs update Sep 17, 2026 · issue 077

    Passbolt: Adds contain[offline] query parameter to resource listing endpoints to include per-item offline availability status in the response body.

    └──▷ TRY IT
    Enable Offline mode for the organisation, allowing each user up to 1000 items cached for up to 7 days with a 1-hour re-auth window.
    copy

    $ curl -s -X POST 'https://<passbolt-host>/offline/settings.json?api-version=v2' \
      -H 'Content-Type: application/json' \
      -H 'Authorization: Bearer <token>' \
      -d '{"max_session_duration": 3600, "data_retention_period": 7, "max_items": 1000}'

    Check whether Offline mode is currently active and review the configured limits before a planned policy change.
    copy

    $ curl -s 'https://<passbolt-host>/offline/settings.json?api-version=v2' \
      -H 'Authorization: Bearer <token>'

    Disable Offline mode entirely for the organisation and purge all cached offline items from user devices.
    copy

    $ curl -s -X DELETE 'https://<passbolt-host>/offline/settings/<settings-id>.json?api-version=v2' \
      -H 'Authorization: Bearer <token>'

12. Enjoy the Silence | Browser Extension & API Sep 17, 2026 · issue 077

    Passbolt 5.16.0 adds Offline Mode (Beta) for secure read-only access and autofill when the server is unreachable.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ⤢ ⤢ ⤢

    ▶ ⤢
13. Enjoy the Silence | Browser Extension & API Sep 17, 2026 · release notes

    Passbolt 5.16.0 adds Beta Offline Mode for browser extension with local storage of credentials

    • Adds Offline Mode (Beta) to Passbolt Pro administration settings, allowing admin-enabled, RBACRBACRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists.-restricted read-only access to cached credentials when the server is unreachable.
    • Introduces QuickAccess application accessible via the browser toolbar icon for viewing offline passwords and TOTPTOTPA one-time password algorithm (RFC 6238) that generates short-lived codes from a shared secret and the current time, giving cyber tools phishing-resistant second-factor authentication without a server round-trip. tokens in the extension.
    • Adds capability to mark individual resources as available offline from the More menu, with local storage limited to 1,000 resources per user (passwords and TOTP only).
    • Configures session duration (default 5 minutes) and data retention (default 7 days) for offline credentials in Passbolt Pro settings.

    4 details in Everything

14. docs update Sep 12, 2026 · issue 072

    Passbolt API gains four Action Log endpoints for querying folder, resource, user, and raw log activity⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ TRY IT
    Audit all permission changes on a specific resource by pulling its interpreted activity log.
    copy

    $ curl -s -H 'Authorization: Bearer {{JWT_TOKEN}}' '{{API_BASE_URL}}/actionlog/resource/8e3874ae-4b40-590b-968a-418f704b9d9a.json?limit=50&page=1'

    Investigate failed API calls over a time window by querying the raw action log filtered to failures after a given timestamp.
    copy

    $ curl -s -H 'Authorization: Bearer {{JWT_TOKEN}}' '{{API_BASE_URL}}/actionlog/logs.json?filter[is-success]=0&filter[created-after]=2026-08-21T00:00:00Z&limit=50'

    Review all activity on a shared folder to confirm who changed its permissions and when.
    copy

    $ curl -s -H 'Authorization: Bearer {{JWT_TOKEN}}' '{{API_BASE_URL}}/actionlog/folder/e97b14ba-8957-57c9-a357-f78a6e1e1a46.json?limit=20&page=1'

    • Adds GET /actionlog/folder/{folderId}.json to retrieve interpreted activity for a folder (requires the Folders plugin; Pro, Enterprise, or Cloud plan).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds GET /actionlog/resource/{resourceId}.json to retrieve interpreted activity for a resource, with limit and page pagination parameters.
    • Adds GET /actionlog/user/{userId}.json to retrieve interpreted activity for a user account, with limit and page pagination parameters.
    • Adds GET /actionlog/logs.json to retrieve raw action log entries, filterable by filter[is-success], filter[created-after], and filter[created-before], with limit and page pagination.
    • Adds activity and logEntry response schemas: activity carries action_log_id, type (e.g. Resources.created, Permissions.updated), creator, and a data object whose shape varies by type; logEntry carries action_id, context (method + path), and status (1 = success, 0 = failure).

    5 details in Everything

15. docs update Sep 12, 2026 · issue 072

    Passbolt audit log docs detail four /actionlog API endpoints, SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. forwarding, and the action_logs_purge retention command.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ⤢
    └──▷ TRY IT
    Pull all successful actions since a specific date for ingestion into a SIEM or periodic audit export — admin-only endpoint with date and success filters.
    copy

    $ curl -s -H "Authorization: Bearer $JWT" "https://passbolt.example.org/actionlog/logs.json?filter[created-after]=1767225600&filter[is-success]=1"

    Retrieve the full activity trail for a specific user account — the only way to get this data, as there is no UI tab for user activity.
    copy

    $ curl -s -H "Authorization: Bearer $JWT" "https://passbolt.example.org/actionlog/user/{userId}.json"

    • Exposes four read-only audit log API endpoints: GET /actionlog/resource/{resourceId}.json, GET /actionlog/folder/{folderId}.json, GET /actionlog/user/{userId}.json, and GET /actionlog/logs.json (admins only).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • GET /actionlog/logs.json accepts filters has-users, is-success, created-after, and created-before, plus a contain parameter on user and user.profile, and sorting on created, enabling periodic extractions.
    • Supports GET /actionlog/user/{userId}.json as the only way to read a user account's activity trail, with no equivalent Activity tab in the UI.
    • Activity tab in the resource details sidebar (Pro/Cloud) shows five entry types — resource created, metadata updated, secret accessed, secret updated, and permissions changed — with permission changes expanding to list affected users and groups with levels (can read, can update, is owner) and change labels (new, updated, deleted).
    • Purge old audit log rows with the action_logs_purge command, which accepts a retention period in days and supports a dry-run mode.

    +2 more show less

    • Forward audit log rows to a SIEM for long-term retention or cross-estate correlation; Community Edition users can exploit the log this way even without the Activity tab or /actionlog endpoints.
    • Documents two audit log blind spots: exports are not recorded (no entry is written when data leaves the vault as a file), and entries record that an item was updated but not which fields changed or their previous values.

    7 details in Everything

16. docs update Sep 12, 2026 · issue 072

    Passbolt API docs add action log endpoints for folders, resources, and users, plus share and share-simulate endpoints.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ TRY IT
    Audit all recent activity on a specific resource to investigate who created or modified it.
    copy

    $ curl -s -H 'Authorization: Bearer <token>' 'https://<instance>/actionlog/resource/36484a18-1eb6-4863-9f50-05d9fc69ea69.json?limit=20&page=1'

    As an admin, pull the raw action log filtered to only successful events after a specific date for a SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. pipeline.
    copy

    $ curl -s -H 'Authorization: Bearer <token>' 'https://<instance>/actionlog/logs.json?filter[is-success]=1&filter[created-after]=2026-08-01T00:00:00Z&limit=50'

    • Adds GET /actionlog/folder/{folderId}.json endpoint to return interpreted activity for a folder, with limit and page query parameters (Pro, Enterprise, or Cloud plans; requires the folders plugin).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds PUT /share/resource/{foreignId}.json endpoint to share a resource, accepting v5 encrypted metadata payloads with object_type PASSBOLT_RESOURCE_METADATA and per-recipient secrets.
    • Adds PUT /share/folder/{foreignId}.json endpoint to share a folder (also accepts POST; requires the Folders plugin).
    • Adds POST /share/simulate/resource/{foreignId}.json endpoint to dry-run a resource share before committing it.

    4 details in Everything

17. 5.0.0 Sep 7, 2026 · issue 067

    API surface changed: +9 endpoints, −4 endpoints

    API change

    API surface changed: +9 endpoints, −4 endpoints

    • + DELETE /favorites/{favoriteId}.json
    • + GET /actionlog/folder/{folderId}.json
    • + GET /actionlog/logs.json
    • + GET /actionlog/resource/{resourceId}.json
    • + GET /actionlog/user/{userId}.json
    • + POST /favorites/resource/{foreignId}.json
    • + POST /share/simulate/resource/{foreignId}.json
    • + PUT /share/folder/{foreignId}.json
    • + PUT /share/resource/{foreignId}.json
    • − DELETE /favorite/{favoriteId}.json (breaking)
    • − POST /favorite/{foreignModel}/{foreignId}.json (breaking)
    • − POST /share/simulate/{foreignModel}/{foreignId}.json (breaking)
    • − PUT /share/{foreignModel}/{foreignId}.json (breaking)
    • New endpoint DELETE /favorites/{favoriteId}.json
    • New endpoint GET /actionlog/folder/{folderId}.json
    • New endpoint GET /actionlog/logs.json
    • New endpoint GET /actionlog/resource/{resourceId}.json
    • New endpoint GET /actionlog/user/{userId}.json

    +4 more show less

    • New endpoint POST /favorites/resource/{foreignId}.json
    • New endpoint POST /share/simulate/resource/{foreignId}.json
    • New endpoint PUT /share/folder/{foreignId}.json
    • New endpoint PUT /share/resource/{foreignId}.json

    9 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Removed endpoint DELETE /favorite/{favoriteId}.json
    • !Removed endpoint POST /favorite/{foreignModel}/{foreignId}.json
    • !Removed endpoint POST /share/simulate/{foreignModel}/{foreignId}.json
    • !Removed endpoint PUT /share/{foreignModel}/{foreignId}.json
18. Who Is He | Browser Extension & API Aug 21, 2026 · issue 052

    Passbolt 5.15 adds autofill improvements and enhanced permissions confirmation dialog UI.

    ⤢ ⤢

    ▶ ⤢

    ⤢
    • Improves autofill behavior in the browser extension.
    • Enhances the UI on permissions confirmation dialogs.

    2 details in Everything

19. Who Is He | Browser Extension & API Aug 21, 2026 · release notes

    Passbolt 5.15.0 adds database-stored sessions (beta), SSRFSSRFServer-side request forgery, an attack that tricks a server into making requests chosen by an attacker. Those requests can reach internal services the attacker cannot access directly. guard for SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management., SCIMSCIMA standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave. admin protection, and improved autofill detection.

    └──▷ USE IT
    Configure the SSO egress guard to block private network access for SSRF protection in a docker deployment.
    env copy

    PASSBOLT_SECURITY_SSO_EGRESS_GUARD_ENABLED=true
    PASSBOLT_SECURITY_SSO_EGRESS_BLOCK_ENABLED=true
    PASSBOLT_SECURITY_SSO_EGRESS_BLOCK_LINK_LOCAL=true
    PASSBOLT_SECURITY_SSO_EGRESS_BLOCK_PRIVATE_RANGES=true
    PASSBOLT_SECURITY_SSO_EGRESS_PRIVATE_RANGE_ALLOWED_IPS="10.10.5.20, 10.10.5.21"

    Allow SCIM deletion of administrators in Passbolt Pro if your identity provideridentity providerA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. manages this workflow.
    php copy

    'plugins' => [
        'scim' => [
            'security' => [
                'allowDeleteAdministrators' => true
            ]
        ],
    ],

    • Adds Session.defaults config key to enable database-stored sessions via passbolt.php or SESSION_DEFAULTS env var
    • Restricts users’ last login dates visibility to administrators only

    2 details in Everything

20. Sunshine | Browser Extension & API seen Jul 28, 2026 · issue 028

    Passbolt 5.14 adds smarter credential suggestions, stronger MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. policy enforcement, and email-free SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. setup and recovery.

    ⤢
    • Improves visibility over shared access for resources.
    • Delivers more relevant in-context credential suggestions.
    • Strengthens MFA policy enforcement.
    • Expands email-free SSO setup and recovery workflows.
    • Makes subscription changes easier to assess.

    5 details in Everything

21. Sunshine | Browser Extension & API Jul 28, 2026 · release notes

    Passbolt 5.14 adds explicit permission confirmation dialogs for shared resources and extends SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. recovery to OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user./ADFS

    • Adds an explicit permission confirmation dialog before creating items in shared folders or editing shared resources, displaying group membership details for transparency.
    • Extends email-free account setup and recovery flows to support OIDC and ADFS SSO providers for Passbolt Pro users.
    • Improves resource suggestion ranking in the browser extension by prioritizing exact URL matches over parent paths and domain matches.

    3 details in Everything

22. Big Jet Plane | Browser Extension & API seen Jul 13, 2026 · issue 014

    Passbolt 5.6.0 adds standalone notes, shared metadata key rotation, and resizable sidebars.

    • New standalone notes capability lets users create and store notes independently of password entries.
    • New shared metadata key rotation enables teams to rotate the encryption keys used for shared resource metadata.
    • New resizable sidebars let practitioners adjust the UI layout to surface more context during investigations or vault management.

    3 details in Everything

23. Bloom | Browser Extension & API seen Jul 13, 2026 · issue 014

    Passbolt 5.7.0 adds secret history, improved user/group management, and a detailed import summary report.

    • New secret history feature lets practitioners review past versions of stored secrets.
    • Improved user and group management capabilities in the browser extension and API.
    • New detailed import summary report surfaces per-record results after bulk credential imports.

    3 details in Everything

24. Everything in its Right Place | Browser Extension & API seen Jul 13, 2026 · issue 014

    Passbolt 5.8.0 adds dynamic RBACRBACRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. role management, drag & drop group assignment, and maintenance updates.

    • New dynamic role management in RBAC, enabling administrators to adjust role permissions without static configuration.
    • New drag & drop interface for assigning users to groups, streamlining group membership management.

    2 details in Everything

25. Flight Facilities | Browser Extension & API seen Jul 13, 2026 · issue 014

    Passbolt 5.9 adds PHP 8.5 support, account-discovery hardening, and DB end-of-life deadline visibility.

    • Adds PHP 8.5 support for teams preparing future infrastructure upgrades.
    • Strengthens protection against low-effort account discovery attacks.
    • Strengthens protection against UI spoofing/trickery attacks.
    • Surfaces upcoming database support deadlines more prominently in the platform.

    4 details in Everything

26. Got To Be Real | Browser Extension & API seen Jul 13, 2026 · issue 014

    Passbolt 5.11 adds SMTP OAuthSMTP OAuthAn authentication method for SMTP email submission that replaces passwords with OAuth 2.0 tokens, letting cyber tools send mail on a user's behalf without storing credentials. for Exchange Online, PingOne SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management., and production-ready SCIMSCIMA standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave. provisioning.

    └──▷ HOW TO FIND IT
    Connect Passbolt mail delivery to Exchange Online using OAuth instead of a service-account password.
    📍In the Admin console, go to Administration › Email Server, select Microsoft Exchange Online as the provider, choose OAuth 2.0 as the authentication method, and enter your Azure app Client ID and Client Secret.
    Enable PingOne as your SSO identity provideridentity providerA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. to let users authenticate via your PingOne directory.
    📍In the Admin console, go to Administration › Single Sign-On, select PingOne as the provider, and enter your PingOne Environment ID, Client ID, and Client Secret.
    Enable production SCIM provisioning to automate user lifecycle management from your identity provider.
    📍In the Admin console, go to Administration › SCIM, enable the SCIM integration, and copy the SCIM base URL and bearer token into your IdP's provisioning settings.
    • Adds SMTPSMTPThe application-layer protocol used to send email between servers and from clients to servers; cyber tools use it to relay alerts, phishing simulations, or exfiltrated data over standard mail infrastructure. OAuth 2.0OAuth 2.0An open authorization framework (IETF RFC 6749) that lets a service grant limited API access to a third party without sharing credentials, giving cyber tools a standard way to authenticate against external platforms. support for Microsoft Exchange Online, enabling modern auth mail delivery without stored passwords.
    • Introduces PingOne SSO integration, expanding supported identity providersidentity providersA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. for single sign-onsingle sign-onSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management..
    • Promotes SCIM user provisioning out of beta, making it generally available for production directory sync.

    3 details in Everything

27. I Feel Love | Browser Extension & API seen Jul 13, 2026 · issue 014

    Passbolt 5.13.0 adds in-app edition management, letting admins switch between Community and Pro editions.

    └──▷ HOW TO FIND IT
    Upgrade from Community to Pro edition without leaving the app.
    📍In the Passbolt admin console, go to Administration › Edition Management and select your target edition to switch.
28. Natural Blues | Browser Extension & API seen Jul 13, 2026 · issue 014

    Passbolt 5.12 launches Safari extension GA, adds PIN code resource type, and improves TOTPTOTPA one-time password algorithm (RFC 6238) that generates short-lived codes from a shared secret and the current time, giving cyber tools phishing-resistant second-factor authentication without a server round-trip. field detection.

    • Safari browser extension is now generally available for all users.
    • New dedicated PIN code resource type for storing numeric credentials separately from passwords.
    • Improved TOTP field detection for more reliable one-time password autofill.

    3 details in Everything

29. You've Got the Love | Browser Extension & API seen Jul 13, 2026 · issue 014

    Passbolt 5.10 debuts the first Safari-compatible browser extension, bringing the password manager to Apple's browser.

    └──▷ HOW TO FIND IT
    Install the Passbolt extension on Safari to access and share passwords directly from Apple's browser.
    📍In Safari, go to the App Store, search for Passbolt, install the extension, then enable it under Safari › Settings › Extensions.
    • New Safari browser extension support: Passbolt is now compatible with Apple's Safari browser for the first time.

    1 detail in Everything

30. I Feel Love | Browser Extension & API Jun 12, 2026 · release notes

    Passbolt 5.13 introduces in-app edition switching, cache health checks, and browser extension pagination.

    • Adds /healthcheck/status.json endpoint support for verifying the caching system availability.
    • Enables administrators to switch between Community and Pro editions directly from Organisation settings without manual migrations.
    • Introduces paginated resource fetching in the Passbolt browser extension to reduce server load for large deployments.
    • Adds healthcheck capability to report the edition currently served by the instance (PB-51980).

    4 details in Everything

31. Natural Blues | Browser Extension & API May 12, 2026 · release notes

    Passbolt 5.12 adds a dedicated PIN code resource type and moves the Safari extension out of beta.

    • PIN Code resource type: secure numeric storage (4-12 digits) with dedicated form, validation, generation, grid column, and import/export support.
    • Safari browser extension is now generally available by default for all Safari users.

    2 details in Everything

32. Got To Be Real | Browser Extension & API Apr 9, 2026 · release notes

    Passbolt 5.11.0 adds SCIMSCIMA standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave. GA, PingOne SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management., SMTP OAuthSMTP OAuthAn authentication method for SMTP email submission that replaces passwords with OAuth 2.0 tokens, letting cyber tools send mail on a user's behalf without storing credentials., and Safari extension support.

    └──▷ USE IT
    Enable the new Safari extension using the configuration file.
    php copy

    'passbolt' => [
      'plugins' => [
        'safari' => [
          'enabled' => true,
        ],
      ],
    ],

    • SCIM provisioning is production-ready for user lifecycle management via identity providersidentity providersA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. like Microsoft Entra IDEntra IDMicrosoft's cloud-based identity and access management service, formerly Azure Active Directory, used by cyber tools to authenticate users and enforce access policies in Microsoft 365 and Azure environments. and Okta
    • Adds PingOne as a new supported SSO provider alongside Azure AD and Google
    • Supports OAuth 2.0OAuth 2.0An open authorization framework (IETF RFC 6749) that lets a service grant limited API access to a third party without sharing credentials, giving cyber tools a standard way to authenticate against external platforms. for SMTPSMTPThe application-layer protocol used to send email between servers and from clients to servers; cyber tools use it to relay alerts, phishing simulations, or exfiltrated data over standard mail infrastructure. authentication with Microsoft Exchange Online, replacing deprecated basic auth
    • Enables Safari browser extension beta via the PASSBOLT_PLUGINS_SAFARI_ENABLED environment variable or passbolt.php config

    4 details in Everything

33. You've Got the Love | Browser Extension & API Mar 11, 2026 · release notes

    Passbolt 5.10 adds Safari beta extension, TOTPTOTPA one-time password algorithm (RFC 6238) that generates short-lived codes from a shared secret and the current time, giving cyber tools phishing-resistant second-factor authentication without a server round-trip. autofill, grid tags, and CSV export policies

    • GET /auth/logout endpoint is now disabled by default via PB-24273.
    • Admins can define exportPolicies to control CSV exports, with the feature disabled by default for security.
    • The browser extension now supports TOTP autofill in login forms via the in-form menu or Quick Access interface.
    • A tags column is now visible in the resources grid (Passbolt Pro), allowing direct filtering of workspace resources.

    4 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !GET /auth/logout endpoint is now disabled by default (issue PB-24273).
    • !CSV export is now disabled by default; organizations must re-enable it through configuration to use CSV exports.
34. Flight Facilities | Browser Extension & API Jan 27, 2026 · release notes

    Passbolt 5.9 adds PHP 8.5 support and new bin/cron CLI reporting for email digest queues

    • Adds verbose output to the passbolt email_digest command showing count of emails sent and remaining in queue

    1 detail in Everything

35. Bloom | Browser Extension & API Nov 13, 2025 · release notes

    Passbolt 5.7.0 adds secret history with admin config flags, new CLI commands for users/mfa, and browser extension UI improvements.

    • passbolt user_index command to list all users
    • passbolt user_promote_to_administrator command to promote users to administrators
    • passbolt mfa_user_settings_disable command to disable MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. for a given user
    • secret_history_enabled admin toggle in the administration workspace to enable secret history visibility

    4 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The passbolt truncate_account_recovery_tables command now requires --username and --fingerprint arguments (validation can be skipped with --no-verify)
36. Big Jet Plane | Browser Extension & API Oct 8, 2025 · release notes

    Passbolt 5.6 adds standalone notes for non-password secrets and metadata key rotation with trusted_proxies env var support

    • Adds new standalone_notes resource type allowing text-based secrets up to 50 KB that are not tied to passwords or TOTPTOTPA one-time password algorithm (RFC 6238) that generates short-lived codes from a shared secret and the current time, giving cyber tools phishing-resistant second-factor authentication without a server round-trip. entries
    • Adds organisation settings capability to rotate the shared metadata key without instance downtime, supported by new background services (RotateResourcesMetadataKeyService, UpdateMetadataKeysService)

    2 details in Everything

37. It’s my life | Browser Extension & API Aug 12, 2025 · release notes

    Passbolt 5.4 stabilizes encrypted metadata, adds ECC keys for new users and a Czech locale.

    • Adds GET /metadata-settings-getting-started API endpoint to help clients enable E2EE by default for new instances
    • Sets ECC (Curve25519Curve25519The elliptic-curve key exchange most modern TLS, SSH and WireGuard connections use to agree on a session key. Post-quantum hybrids pair it with ML-KEM./Ed25519Ed25519A fast elliptic-curve signature scheme with small keys, the default for new SSH keys and common in code signing. It is not quantum-safe.) keys as the default key type for newly created users
    • Increases the maximum size of secret notes to 50,000 characters
    • Adds support for importing and exporting multiple URIs on KDBX files in the browser extension
    • Adds support for importing and exporting custom fields on KDBX files in the browser extension

    +2 more show less

    • Makes encrypted metadata stable by default for all new Passbolt instances
    • Adds azure_sso.login_hint configuration setting to configure Azure SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. login hints

    7 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The legacy endpoint is replaced by /complete/recover.json for resource recovery
38. Somebody To Love | Browser Extension & API Jul 17, 2025 · release notes

    Passbolt 5.3.2 adds clipboard flushing timer and SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. configuration locking for enhanced security.

    • Enables encrypted metadata support for users with imported keys that have expiry dates and automates metadata key distribution when administrators leave

    1 detail in Everything

39. Riders on the Storm | Browser Extension & API Jul 9, 2025 · release notes

    Passbolt 5.3 introduces custom fields for resources via encrypted metadata and enables OpenID ConnectOpenID ConnectOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user./ADFS SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. by default.

    • Adds custom fields to resources as key-value pairs attached via encrypted metadata

    1 detail in Everything

40. Something’s Got a Hold on Me | Browser Extension & API Jun 11, 2025 · release notes

    Passbolt v5.2 adds multi-URI resources, resource appearance customization, Ukrainian/Slovenian locales, and density settings to the browser extension.

    • Resources with encrypted metadata now support multiple URIs (e.g., app.example.com, admin.example.com) linked to a single credential
    • Users can set custom icons and background colours for resources in the Create/Edit dialog, compatible with KDBX import/export
    • New density setting in workspace column controls grid spacing in the browser extension
    • API supports User GPG key policies (ECC by default) behind a feature flag

    4 details in Everything

41. Four To The Floor | Browser Extension & API May 15, 2025 · release notes

    Passbolt v5.1 adds opt-in encrypted resource metadata, default password expiry for new installs, and tag rotation APIs.

    • Adds encrypted resource metadata support as an opt-in feature to protect names, URLs, and other contextual fields cryptographically
    • Enables password expiry by default for all new Passbolt installations in v5.1
    • Adds /metadata/keys.json API endpoint that now returns the creator field alongside metadata keys
    • Adds email claim alias support for OAuth2OAuth2An open authorization framework (RFC 6749) that lets a service grant limited access to a user's resources on another service without exposing credentials, giving cyber tools a standard way to authenticate against third-party APIs. providers via server config, enabling custom email mappings
    • Adds PRO tag management API endpoints to get and rotate tags with expired metadata keys (PB-37364)

    +3 more show less

    • Adds PRO tag upgrade capability from v4 format to v5 format (PB-37702)
    • Adds datacheck command support for v5 resources in Passbolt administration
    • Adds dedicated autofill input in the browser extension to fix autofill on specific websites

    8 details in Everything

42. Need To Feel Loved | Browser Extension & API Apr 10, 2025 · release notes

    Passbolt v5.0 adds SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents.-compatible action logs, browser grid filters, and modular resource dialogs.

    • Adds PB-39434 capability to log user actions on files in an SIEM compatible format
    • Adds resource grid filter in the browser extension to display only private resources
    • Introduces unified and modular resource creation and editing dialogs for upcoming resource types

    3 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Minimum server requirement has changed to PHP 8.2 or greater
43. Rusty Cage | Browser Extension & API Mar 12, 2025 · release notes

    Passbolt v4.12 adds v5 metadata migration controls for admins in browser extension and API

    • Adds PB-37699 capability: administrators can now upgrade folders to the v5 format via the API.
    • Adds PB-38932 through PB-38925: browser extension UI for migrating metadata content, including the MigrateMetadataContentServiceWorkerService, ConfirmMigrateMetadataDialog, and navigation to the administration page.
    • Adds PB-38850 and PB-36582 constraints: administrators cannot rotate entities while two metadata keys are active, and cannot reuse previously deleted metadata keys.

    3 details in Everything

44. Fortunate Son | Browser Extension & API Jan 30, 2025 · release notes

    Passbolt v4.11.0 adds beta encrypted metadata administration settings and preparatory API endpoints for the v5 resource format.

    • Adds metadata_keys administration settings with encryption support in the browser extension and API
    • Adds allow_v4_v5_upgrade setting to metadata types configuration to control compatibility during the v4-to-v5 transition
    • Adds API endpoints/commands for administrators to expire, rotate, and share metadata private keys (PB-36558, PB-37361, PB-35986)
    • Adds email notifications for administrators when a zero_knowledge_key_share is set or a metadata key is deleted
    • Adds health check logic in the browser extension's Service Worker to verify metadata types settings integrity (verifyDataHealth)

    5 details in Everything

45. Baianá Nov 4, 2024 · release notes

    Passbolt v4.10 adds beta v5 resource type support and metadata management APIs with PASSBOLT_V5_ENABLED flag

    • Adds the PASSBOLT_V5_ENABLED environment variable to enable beta support for the v5 resource type format in the v4 user interface.
    • Introduces new REST endpoints for metadata management: GET /metadata/settings.json, POST /metadata/settings.json, GET /metadata/keys.json, POST /metadata/keys.json, GET /metadata/session-keys.json, POST /metadata/session-keys.json, and DELETE /metadata/session-keys/<uuid>.json.

    2 details in Everything

46. B.Y.O.B. Jul 23, 2024 · release notes

    Passbolt v4.9.0 adds resource location display in grid, LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory. suspend strategy, and new API filters for search-aros and gpgkeys

    • Adds suspension strategy option to the LDAP integration settings UI and corresponding admin configuration to prevent user deletion on directory sync
    • Adds a has-users filter to the /gpgkeys.json index endpoint (/api/gpgkeys/index?has-users=1)
    • Adds location metadata (folder hierarchy) to resource grid rows and allows searching resources by parent folder names via the browser extension search

    3 details in Everything

47. Angel May 21, 2024 · release notes

    Passbolt Angel adds CLI commands to purge audit logs, debug SMTPSMTPThe application-layer protocol used to send email between servers and from clients to servers; cyber tools use it to relay alerts, phishing simulations, or exfiltrated data over standard mail infrastructure., and view email queue records.

    • Adds the ability for administrators to purge action logs via a dedicated CLI command to reclaim database space.
    • Adds a new CLI command to verify if a custom certificate is in use for the SMTP configuration.
    • Adds a new CLI command to view email_queue records for debugging SMTP integration issues.

    3 details in Everything

48. Bulls On Parade Apr 30, 2024 · release notes

    Passbolt v4.7 adds self-signed SMTPSMTPThe application-layer protocol used to send email between servers and from clients to servers; cyber tools use it to relay alerts, phishing simulations, or exfiltrated data over standard mail infrastructure. TLS support and HTTP HEAD to /healthcheck/status.json

    • Added PB-30330: Support HTTP HEAD method on the /healthcheck/status.json API endpoint for uptime monitoring tools
    • Added PB-26156: Administrator config option to enable SMTP TLS with a self-signed certificate on the mail server
    • Added PB-32931: SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. and Directory Sync health checks visible in the Passbolt API Status page

    3 details in Everything

49. Purple Haze Mar 14, 2024 · release notes

    Passbolt Purple Haze adds Beta AD FS SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. and Health Check controls with flags

    • Adds Microsoft ADFS as a new supported SSO provider for streamlined single sign-onsingle sign-onSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. access management.
    • Introduces the ability to hide the share folder capability via RBACRBACRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. configuration in the Admin workspace.
    • Adds a flag to disable the health check index endpoint (/healthcheck) for API status exposure control.
    • Adds a flag to disable the health check administration panel UI for administrators.

    4 details in Everything