Keygrain Releases

• Enhanced security & PIN removal: eliminated persistent PIN storage in favor of volatile in-memory auto-lock with configurable timeouts.
• Two-tier auto-lock UX: keep service names visible for fast search while credentials require quick re-authentication.
• Multi-asset tabs: manage web logins, standalone SSH keys, and HD wallets directly inside the popup.
• Zero-Knowledge sync: all service names, keys, and timestamps are end-to-end encrypted with zero server visibility.
• Streamlined HD wallets: generates standard 12 or 24-word BIP-39 disaster recovery phrases directly.
• Email-decoupled keys: SSH keys and crypto wallets derive independently of your account email.
• Autofill shortcut: default shortcut updated to Ctrl+Shift+L (Command+Shift+L on Mac) to avoid browser conflicts.
• Offline mode & server controls: easily isolate from sync networks or erase server data while keeping your local vault.

• Enhanced security & PIN removal: eliminated persistent PIN storage in favor of volatile in-memory auto-lock with configurable timeouts.
• Two-tier auto-lock UX: keep service names visible for fast search while credentials require quick re-authentication.
• Multi-asset tabs: manage web logins, standalone SSH keys, and HD wallets directly inside the popup.
• Zero-Knowledge sync: all service names, keys, and timestamps are end-to-end encrypted with zero server visibility.
• Streamlined HD wallets: generates standard 12 or 24-word BIP-39 disaster recovery phrases directly.
• Email-decoupled keys: SSH keys and crypto wallets derive independently of your account email.
• Autofill shortcut: default shortcut updated to Ctrl+Shift+L (Command+Shift+L on Mac) to avoid browser conflicts.
• Offline mode & server controls: easily isolate from sync networks or erase server data while keeping your local vault.

• Multi-asset keychain: manage logins, standalone SSH keys, and HD wallets in one place.
• Email-decoupled keys: SSH keys and crypto wallets derive independently from your account email.
• Zero-Knowledge sync: all item metadata and timestamps are end-to-end encrypted with zero server visibility.
• Autofill TOTP: automatically detects and fills 2FA one-time verification codes on login forms.
• Interactive Demo Mode: try Keygrain with sample logins, SSH keys, and wallets before entering your master secret.
• Streamlined HD wallets: generates standard 12 or 24-word BIP-39 disaster recovery phrases directly.
• More reliable biometric unlock handling across device manufacturers.

• Email-decoupled keys: SSH keypair and HD wallet derivations derive independently from your account email.
• Streamlined HD wallet derivation: generate standard 12 or 24-word BIP-39 mnemonic seed phrases directly.
• Added wallet export formats via --format (json, sparrow, electrum).
• keygrain --version now reports git commit metadata and dirty state when run from source.

• You can now stop a password migration part-way through. Services you have not rotated are removed from the migration batch and that decision syncs to your other devices; their old site passwords remain unchanged, so change them if needed.
• Migration progress stays consistent between the popup, migration page, and synced data.
• Domain matching during migration now uses the public suffix list, improving handling of subdomains and multi-part domains.
• Sync serialization and password-symbol validation are more consistent across Keygrain clients.
• Additional security and reliability fixes improve migration and sync behavior.

• You can now stop a password migration part-way through. Services you have not rotated are removed from the migration batch and that decision syncs to your other devices; their old site passwords remain unchanged, so change them if needed.
• Migration progress stays consistent between the popup, migration page, and synced data.
• Domain matching during migration now uses the public suffix list, improving handling of subdomains and multi-part domains.
• The keyboard shortcut no longer conflicts with Firefox's own shortcuts.
• Sync serialization and password-symbol validation are more consistent across Keygrain clients.

• Autofill now chooses the most-specific saved service for a site, reducing ambiguous matches on subdomains.
• Sync serialization is aligned with other Keygrain clients, and migration status survives sync round trips.
• Safer sync transport rejects redirects; copied passwords are cleared safely and sensitive autofill details are no longer logged.
• Invalid saved settings no longer break onboarding or editing.

• Unsafe sync endpoints are now rejected; HTTPS is required except for loopback development endpoints.
• Password-symbol validation is consistent with the other Keygrain clients.
• Wallet expansion diagnostics now distinguish input mismatches from hardware faults.

Deletions now sync properly across your devices, and importing from another password

manager shows you exactly what it is about to use.

Sync

• Deleting a service now sticks. Remove an entry on one device and it stays removed

everywhere, instead of reappearing the next time another device syncs.

• Delete-versus-edit conflicts are kept, not guessed. If you delete a service on one

device while editing it on another, Keygrain shows you both and lets you decide, rather

than silently picking a winner.

• Fewer failed syncs when several devices write at once.

Importing from another password manager

• You can now verify the login address before anything is imported. The preview shows

the address read from your export next to the site Keygrain derived from it, because the

site is what generates your password — if the two disagree, you need to know before you

rotate a real password, not after.

• Fixed: imports from KeePassXC could get the wrong site. Exports that store a bare

address (github.com rather than https://github.com) fell back to the entry title, so

a "GitHub" entry was imported as github instead of github.com. That produced a

different password than adding the same account by hand, and autofill never matched it.

If you already migrated from such an export, check the Site field on those entries.

• Entries whose address had to be guessed from the entry title are now marked, and entries

with no address at all say so.

No algorithm changes — every password, code, key and seed is byte-identical to before

(SPEC v4).

Deletions now sync properly across your devices, and importing from another password

manager shows you exactly what it is about to use.

Sync

• Deleting a service now sticks. Remove an entry on one device and it stays removed

everywhere, instead of reappearing the next time another device syncs.

• Delete-versus-edit conflicts are kept, not guessed. If you delete a service on one

device while editing it on another, Keygrain shows you both and lets you decide, rather

than silently picking a winner.

• Fewer failed syncs when several devices write at once.

Importing from another password manager

• You can now verify the login address before anything is imported. The preview shows

the address read from your export next to the site Keygrain derived from it, because the

site is what generates your password — if the two disagree, you need to know before you

rotate a real password, not after.

• Fixed: imports from KeePassXC could get the wrong site. Exports that store a bare

address (github.com rather than https://github.com) fell back to the entry title, so

a "GitHub" entry was imported as github instead of github.com. That produced a

different password than adding the same account by hand, and autofill never matched it.

If you already migrated from such an export, check the Site field on those entries.

• Entries whose address had to be guessed from the entry title are now marked, and entries

with no address at all say so.

No algorithm changes — every password, code, key and seed is byte-identical to before

(SPEC v4).

• Deleting a service now sticks. Remove an entry on one device and it stays removed everywhere, instead of reappearing when another syncs.
• Delete-versus-edit conflicts are kept, not guessed: delete on one device while editing on another and Keygrain shows you both.
• Fewer failed syncs when several devices write at once.
• Update your other devices too — deletions only propagate between updated ones.

No algorithm changes — every password, code, key and seed is byte-identical (SPEC v4).

• Tap an entry to view it, and copy any field with a single tap.
• Adding and editing now happen on a full screen with a "Discard changes?" prompt, so an accidental swipe can't lose your work.
• A copied value still clears from the clipboard after 30 seconds if you move to another screen.
• The auto-lock timer resets while you view or edit, so long edits aren't cut short.

No algorithm changes — every password, code, key and seed is byte-identical (SPEC v4).

The biggest Keygrain update yet: autofill, one-time codes, and full control over your

account and synced data.

Autofill & 2FA

• In-field autofill — an opt-in inline icon and account dropdown on your saved

sites, so you can fill credentials in place.

• TOTP one-time codes — fill 2FA codes from the inline dropdown, the popup, the

keyboard shortcut, or the right-click menu. No separate authenticator app.

• Smarter matching across multiple accounts and subdomains, plus a discoverability tip

for the fill shortcut.

Account & data control

• Switch account — use a different master secret / email without a full reset,

from the menu or the lock screen.

• Offline mode — use Keygrain without syncing; turn sync back on anytime.
• Delete synced data — remove your encrypted blob from the sync server, with an

option to keep a local copy on this device.

Fixed

• Popup password fill now loads its autofill dependency reliably.
• Clearer lock-screen message when the entered secret/email doesn't match this

device's account.

• Removed the misleading "clears in 30 seconds" clipboard message.

No algorithm changes — every password, code, key, and seed is byte-identical to before

(SPEC v4).

The biggest Keygrain update yet: autofill, one-time codes, and full control over your

account and synced data.

Autofill & 2FA

• In-field autofill — an opt-in inline icon and account dropdown on your saved

sites, so you can fill credentials in place.

• TOTP one-time codes — fill 2FA codes from the inline dropdown, the popup, the

keyboard shortcut, or the right-click menu. No separate authenticator app.

• Smarter matching across multiple accounts and subdomains, plus a discoverability tip

for the fill shortcut.

Account & data control

• Switch account — use a different master secret / email without a full reset,

from the menu or the lock screen.

• Offline mode — use Keygrain without syncing; turn sync back on anytime.
• Delete synced data — remove your encrypted blob from the sync server, with an

option to keep a local copy on this device.

Fixed

• Popup password fill now loads its autofill dependency reliably.
• Clearer lock-screen message when the entered secret/email doesn't match this

device's account.

• Removed the misleading "clears in 30 seconds" clipboard message.

No algorithm changes — every password, code, key, and seed is byte-identical to before

(SPEC v4).

Keygrain arrives on Google Play. One master secret derives every password, TOTP code,

SSH key, and wallet seed. Derived passwords are not stored; service configuration is stored locally and can be synced in encrypted form.

New

• On Google Play — targeting Android 16 (API 36), with 16 KB page-size support.
• Offline mode — derive without a network connection.
• Switch account — move between identities in the app.
• Delete server data — remove your synced blob from within the app.

Fixed

• Resolved an ANR (app-not-responding) case.

Note

The app's package id is com.secbytech.keygrain.

No algorithm changes — every password, code, key, and seed is byte-identical to before

(SPEC v4).

Keygrain is now on PyPI: pip install keygrain.

New

• Published to PyPI via Trusted Publishing (OIDC — no long-lived tokens), with

reproducible wheels and PEP 740 provenance attestations.

• Read-only sync download + local encrypted cache — retrieve your passwords, TOTP

seeds, and SSH material from your synced configuration.

• Derive passwords, TOTP codes, SSH keys, and HD-wallet seeds from your master secret,

as a CLI and an importable library.

No algorithm changes — output is byte-identical across all Keygrain platforms (SPEC v4).