QtPass changelog
v1.8.4
Bug-fix release on the 1.8 line. Qt 5.15 and Qt 6 are both still supported.
Security
- A copied password carries the KDE password hint on FreeBSD and OpenBSD too, as it did on Linux, so Klipper, CopyQ and cliphist keep it out of their history
Bug Fixes
- Started from a terminal, QtPass no longer freezes when Git wants HTTPS credentials or SSH a passphrase: they prompted on that terminal, unseen, and every decrypt and save waited behind them. They now use an askpass helper when one is set and otherwise fail with an error QtPass shows (Qt 6.7 or newer)
- GNOME shows the QtPass icon for its window
v1.8.3
Bug-fix release on the 1.8 line. Qt 5.15 and Qt 6 are both still supported.
Bug Fixes
-
Saving an entry no longer loses what was typed when it fails. The
password dialog stays open until the entry is written; when
encryption fails (a missing or expired recipient key, an unusable
.gpg-id) the fields come back with the reason. Cancel still works while it waits, after asking
v1.8.2
Bug-fix release on the 1.8 line. Qt 5.15 and Qt 6 are both still supported.
Bug Fixes
- "Automatically push" and "Automatically pull" are saved again; since 1.8.0 they did nothing. Switching profiles also applies that profile's Git settings
-
The edit dialog only turns
key: valuelines into fields when the settings ask for it (the template's fields, or every line with "Template all fields"), so those lines can be edited as text again
Changed
-
The AppStream metainfo installs as
org.qtpass.QtPass.metainfo.xmlinstead ofqtpass.appdata.xml; packagers who install it themselves need the new name
v1.8.1
Security and bug-fix release: the fixes from the 2.0 branch that matter for 1.8 users, backported. Qt 5.15 and Qt 6 are both still supported.
Security
-
Windows/WSL: commands run through
wsl --execinstead of the distribution's login shell, so paths, recipients and commit messages are no longer word-split or expanded by a shell -
Every gpg encrypt call passes
--no-encrypt-to, so anencrypt-toin yourgpg.confcan no longer add a recipient the.gpg-idnever listed -
Only
http(s)URLs become clickable links; other schemes and URLs with embedded credentials are shown as text - The key-generation dialog no longer shows the passphrase in the batch template, and an expert-mode template cannot produce an unprotected key by accident
- The re-encryption backup commit stages tracked files only, so stray plaintext in the store is never committed and pushed
- Single-instance IPC: a stale socket no longer disables it, the socket is restricted to the owning user, and a failed forward opens a window instead of exiting silently
- An out-of-range character-set setting is clamped instead of read out of bounds
Bug Fixes
-
"New folder" no longer writes an empty
.gpg-idthat broke every insert in that folder; it inherits the parent's recipients - A configured GPG home that no longer exists is ignored with a status message instead of failing every gpg call with "No secret key"
-
Ctrl-drag copying an entry onto a folder works again in the native
(
gpg2/git) backend - "Use Git" without a Git executable no longer wedges the command queue
- Edits typed in the password dialog before the decrypt finished are no longer discarded; a failed decrypt shows the gpg error
-
The password pane and the open-in-browser tooltip no longer show
&,"for values with&and" -
.gpg-identries gpg accepts (v6 fingerprints, user IDs) are no longer dropped and erased on the next save - Cancelling the first-run wizard quits instead of showing a half-configured window
v1.8.0
Highlights
-
Built-in TOTP (RFC 6238, incl. Steam Guard): one-time passwords are
generated by QtPass itself; the
pass-otpextension is no longer needed. OTP is on by default after the upgrade; turn it off in Settings if you do not want it. - Share submenu (re-encrypt, export your public key, add recipients) and an Import key dialog in the Users dialog
- Process output panel, "Open in browser" for URL fields, content search, multiple templates with Ctrl+T, per-profile Git options
-
Automatic
SSH_AUTH_SOCKdetection with a manual override - 14 new languages (64 in total), most locales complete for the new strings pending Weblate review
Security
- Path-traversal hardening for new files, renames and drag-and-drop
.gpg-idis written with mode 0600- URLs are escaped in the password panel
- A TOTP secret is never displayed or copied as a password
Bug Fixes
- Settings no longer silently corrupted by the configuration dialog
- Executor could stall on a command that failed to start; crashed subprocesses no longer hang the UI
- The window, its content pane and the toolbar follow light/dark theme switches at runtime
- WSL path translation, clipboard autoclear tracking, key-generation start failures, tray close behaviour
Platform notes
-
macOS: the
.dmgis not notarized and the Homebrew cask is disabled; see the macOS page. - Windows: the installer is unsigned; SmartScreen asks once.
v1.7.0
Highlights
- Spanish regional variants support (ES_AR, ES_EC, ES_MX, ES_UY)
- Qt 6.10 beginFilterChange/endFilterChange support
- Integration tests for core workflows
- Various bug fixes and code quality improvements
Bug Fixes
- Guard against out-of-bounds index in password character set
- WSL case-insensitive path handling improvements