October 12, 2026
2Secret 1.1.0
Quantum resistant sharing:
Quantum-resistant sharing:
- Vault keys shared with other people are wrapped with a hybrid of X25519 and ML-KEM-768 (FIPS 203), so recorded traffic or a stolen server database cannot be decrypted later with a quantum computer. The recipient's device re-wraps the key with its own 256-bit account key on its next sync.
- Accounts publish their ML-KEM public key automatically on their first sync with this version; their fingerprint changes once when that happens.
- New Secret Keys have 130 bits of entropy (26 random characters instead of 25). Existing Secret Keys keep working.
- Update every device: 2Secret 1.0 cannot open a vault shared with the new scheme until the recipient has synced once with 1.1.
Security hardening, informed by the LastPass breaches:
- Browser extension: right before filling, the page and every frame are checked against the item's websites, so credentials never reach a frame from another site or a page the tab navigated to after the popup opened.
- Websites are matched by registrable domain using the Public Suffix List,
httpsitems are never filled intohttppages, ports are respected. - Master passwords need at least 12 characters and a "good" strength rating.
- Clients and servers refuse Argon2id parameters below 19 MiB / 2 passes.
- Encrypted data is padded to size classes, so the server no longer learns exact item sizes.
Downloads
| File | What |
|---|---|
2Secret_*_aarch64.dmg |
macOS app for Apple silicon (M1 and newer) |
2Secret_*_x64.dmg |
macOS app for Intel Macs |
*.msi, *-setup.exe |
Windows app |
*.deb, *.rpm, *.AppImage |
Linux app (x86_64) |
2secret-*-<platform>.tar.gz / .zip |
2secret CLI and 2secret-server for Linux, macOS (Apple silicon and Intel) and Windows |
2secret-web-*.tar.gz |
Web vault – serve it with 2secret-server --web-dir |
2secret-extension-*.zip |
Browser extension for Chrome, Edge, Brave and Firefox (load unpacked) |
SHA256SUMS |
Checksums of all files |
Server image for x86_64 and ARM64 (e.g. Raspberry Pi 4/5 with a 64-bit OS):
docker pull ghcr.io/joostiphone/2secret:latest – see
self-hosting.
On macOS, drag 2Secret to Applications and open it. If macOS says it cannot verify the app, open System Settings → Privacy & Security and click Open Anyway (on macOS 14 and older you can also right-click the app and choose Open). On Windows, SmartScreen may ask you to confirm (More info → Run anyway).
FreeBSD, OpenBSD, NetBSD and iOS: build from source, see the README.