LoginSign Up
← Back to all sparks
P

Passbolt

COLLAB
Velocity2.5

Open-source password manager for teams

www.passbolt.com ↗

Passbolt adds passkeys for MFA and rebuilds autofill detection, with passwordless still to come.

password-managerpasskeysautofillaccess-controloffline-mode
◆Current state
Passbolt 5.17 adds passkeys as a second factor in every edition and rebuilds autofill detection, raising form detection on its internal test set from 74% to 93.4%. It also brings the permission review to moves of resources and folders, as earlier notes promised. The previous release, 5.16, added a read-only Offline Mode in beta for when the server is unreachable.
◆Where it's heading
The access-review arc that began with 5.14 has reached moves, so it is close to complete. The next arc is authentication: passkeys for MFA are stated as a first step, with passkey storage for third-party sites and passwordless sign-in to Passbolt named as follow-ups. Offline Mode and QuickAccess are also being extended resource type by resource type.
◆Prediction
The next releases should deliver passkey storage as a resource type, with passwordless sign-in after it. Further resource types will move into QuickAccess and Offline Mode, as the 5.17 notes say.

◆Recent moves

  1. 13d ago

    5.17 adds passkeys for MFA and a rebuilt autofill engine

    Passkeys for MFA answer the phishing-resistance requirement the notes cite from procurement, and open a stated path toward passwordless sign-in. The rebuilt autofill engine and permission review on moves advance two threads from earlier releases.

    View source ↗
  2. 1mo ago

    5.16 adds read-only Offline Mode in beta

    Offline Mode, in beta, gives permitted users read-only access to credentials when the server is down. It targets the awkward case where the credentials needed to restore a system are locked inside that system.

    View source ↗
  3. 2mo ago

    5.15 adds database sessions and closes shared-tag permission bypasses

    Continues the permission-transparency arc with add/modify/delete badges and rollback of deleted permissions before confirmation, and starts the autofill form-detection series. Underneath it moves sessions to database storage with pruning and healthcheck reporting, rejects JWTs for disabled users, and fixes three reported bypasses that let non-owners promote or unlink V5 tags and share personal folders.

    View source ↗
  4. 2mo ago

    5.14.3 limits the permission dialog to actual secret changes

    Corrects the 5.14 dialog firing on metadata-only edits such as renaming, and makes it read-only when a user creates a resource in a shared folder they do not own so inherited permissions cannot be overridden. A quick fix to a feature that had over-reached in its first form.

    View source ↗
  5. 3mo ago

    5.14 adds confirmation prompts before shared-resource edits

    Introduces the explicit confirmation dialog that the following two releases spend their time refining, and shows group members inline so the real reach of a share is visible. Also reranks browser-extension suggestions by URL relevance so exact matches surface first.

    View source ↗
  6. 4mo ago

    5.13 adds in-app switching between Community and Pro

    Builds on the 5.12 codebase unification so administrators can move between editions from settings rather than running manual migrations. Also adds cache availability to the healthcheck endpoint and starts paginating resource fetching for large credential sets.

    View source ↗