Alle versies

• Verification codes in AutoFill: on iPhone and iPad with iOS 18 and on the Mac with macOS 15, Safari and other apps fill one-time codes from 2Secret after Face ID or Touch ID, from the logins that have a one-time password. Settings → General → AutoFill & Passwords then lists 2Secret for "Passkeys, passwords and codes" (if it does not after updating, turn 2Secret off and on there once). Open 2Secret once after updating, so AutoFill gets the one-time passwords.
• Setting up codes: 2Secret can be chosen under Set Up Codes In in the same settings. Setup links (otpauth://) on websites and QR codes scanned with the camera then open 2Secret, which adds the one-time password to the login you choose or starts a new login with it.

Downloads#

Server image for x86_64 and ARM64 (e.g. Raspberry Pi 4/5 with a 64-bit OS): docker pull ghcr.io/joostiphone/2secret:latest – see self-hosting.

On macOS, drag 2Secret to Applications and open it. If macOS says it cannot verify the app, open System Settings → Privacy & Security and click Open Anyway (on macOS 14 and older you can also right-click the app and choose Open). On Windows, SmartScreen may ask you to confirm (More info → Run anyway).

FreeBSD, OpenBSD, NetBSD and iOS: build from source, see the README.

• Dashboard: the apps open with an overview after unlocking: a greeting, search, the number of items, favourites and vaults, the Watchtower score with breached, weak and reused passwords, your favourites, recent changes, the vaults and the categories. It shows no passwords or other secrets. Settings → Appearance → Start screen chooses what you see after unlocking: the dashboard, all items, favourites or Watchtower. The browser extension keeps opening with the list, which suggests logins for the open website.
• iPhone and iPad: after typing the master password the app no longer stays shifted up under the status bar (iOS left the page scrolled when the keyboard closed), the app fits above the keyboard while you type, and text fields no longer zoom in when you tap them.

Downloads#

Server image for x86_64 and ARM64 (e.g. Raspberry Pi 4/5 with a 64-bit OS): docker pull ghcr.io/joostiphone/2secret:latest – see self-hosting.

On macOS, drag 2Secret to Applications and open it. If macOS says it cannot verify the app, open System Settings → Privacy & Security and click Open Anyway (on macOS 14 and older you can also right-click the app and choose Open). On Windows, SmartScreen may ask you to confirm (More info → Run anyway).

FreeBSD, OpenBSD, NetBSD and iOS: build from source, see the README.

• AutoFill on the Mac: Safari and other apps fill passwords and sign in with passkeys from 2Secret after Touch ID, without a browser extension, like on iPhone and iPad. Turn on unlocking with Touch ID in 2Secret, then 2Secret in System Settings → General → AutoFill & Passwords. Needs macOS 14 and a release signed with a Developer ID: the release workflow then adds the extension (macos/) with Developer ID provisioning profiles from the App Store Connect API, and can notarize with that API key instead of an Apple ID. Settings → Security says where to turn AutoFill on (also on iOS).
• The macOS app is signed with a Developer ID and notarized by Apple, so it opens without allowing it under Privacy & Security first (once Apple has notarized it: the first submissions of a new developer account can take Apple days, and the release no longer waits for that). macOS may ask once for your login password to let the new version use its keychain item for Touch ID unlock; choose Always Allow.
• Profiles: the apps keep up to two accounts side by side, for example your own and one for work on another server. Switch at the top of the sidebar or on the lock screen; the profile you leave stays unlocked in the background until the app locks, which locks both. Each profile has its own Secret Key and its own biometric unlock. Not in the web vault or the browser extension. On iOS and macOS AutoFill fills from the profile that last wrote its logins with biometric unlock on.
• Website icons: logins show the icon of their website. The apps fetch it straight from the website when you save a login (over HTTPS, public host names only, no icon service) and keep it encrypted with the login, so other devices, the web vault and the browser extension show it too. Settings → Appearance → Website icons turns it off and fetches icons for the logins you already have.
• Profile photo: Settings → Account → Add photo. The app makes a small square picture of it, encrypts it with your account key and syncs it to your other devices through the new PUT /account/avatar (servers from this version; with an older server it stays on the device).
• Vault icons: choose an icon when creating or editing a vault. It is part of the vault's encrypted details, so everyone with access sees it.
• Links in the app (an item's websites, What's new, the project page) open in the browser on macOS, iOS and Linux; clicking them did nothing there.
• Browser extension: a new passkey is stored before its window closes. The window could close first, and then the website had the passkey but 2Secret did not.
• Server: the limits forget client addresses and e-mail addresses as soon as their window has passed (a day for sign-ups, 15 minutes for failed sign-ins), instead of when the server restarts.
• deploy/proxmox/install.sh keeps the journal for 14 days.

Downloads#

Server image for x86_64 and ARM64 (e.g. Raspberry Pi 4/5 with a 64-bit OS): docker pull ghcr.io/joostiphone/2secret:latest – see self-hosting.

On macOS, drag 2Secret to Applications and open it. If macOS says it cannot verify the app, open System Settings → Privacy & Security and click Open Anyway (on macOS 14 and older you can also right-click the app and choose Open). On Windows, SmartScreen may ask you to confirm (More info → Run anyway).

FreeBSD, OpenBSD, NetBSD and iOS: build from source, see the README.

• The 2Secret server sync.2secret.app runs: the apps offer it again, and it is the default when creating an account, signing in or connecting.
• Server: --trusted-proxies (TWOSECRET_TRUSTED_PROXIES) believes the client address header from reverse proxies on other machines, such as cloudflared in another container, so limits per address keep working. deploy/proxmox/install.sh has --listen and --trusted-proxy for it.

Downloads#

Server image for x86_64 and ARM64 (e.g. Raspberry Pi 4/5 with a 64-bit OS): docker pull ghcr.io/joostiphone/2secret:latest – see self-hosting.

On macOS, drag 2Secret to Applications and open it. If macOS says it cannot verify the app, open System Settings → Privacy & Security and click Open Anyway (on macOS 14 and older you can also right-click the app and choose Open). On Windows, SmartScreen may ask you to confirm (More info → Run anyway).

FreeBSD, OpenBSD, NetBSD and iOS: build from source, see the README.

• The apps offer the 2Secret server (sync.2secret.app) once it runs. Until then a new account is kept only on this device by default, and signing in or connecting asks for your own server's address.

Downloads#

Server image for x86_64 and ARM64 (e.g. Raspberry Pi 4/5 with a 64-bit OS): docker pull ghcr.io/joostiphone/2secret:latest – see self-hosting.

On macOS, drag 2Secret to Applications and open it. If macOS says it cannot verify the app, open System Settings → Privacy & Security and click Open Anyway (on macOS 14 and older you can also right-click the app and choose Open). On Windows, SmartScreen may ask you to confirm (More info → Run anyway).

FreeBSD, OpenBSD, NetBSD and iOS: build from source, see the README.

• The 2Secret server: when creating an account, signing in or connecting, choose 2Secret server (sync.2secret.app, nothing to set up), your own server or only on this device.
• Backups: Settings → Backup & export shows when you last made a backup on this device, and 2Secret reminds you now and then (every month by default, adjustable) to make an encrypted backup of all vaults, so you keep your data even if a device or server is lost for good.
• Server limits for servers that are open to everyone: storage per account (what does not fit stays on the device, nothing is lost), new accounts per address per day, a maximum number of accounts, and the client's address from a local proxy (--account-storage-mb, --signups-per-ip, --max-accounts, --client-ip-header). The apps show your storage use.
• deploy/proxmox: creates a Proxmox LXC container with the server, a Cloudflare Tunnel, nightly database backups and signed automatic updates (docs/PUBLIC-SERVER.md). Releases now also list the server and web vault in the signed update.json.

Downloads#

Server image for x86_64 and ARM64 (e.g. Raspberry Pi 4/5 with a 64-bit OS): docker pull ghcr.io/joostiphone/2secret:latest – see self-hosting.

On macOS, drag 2Secret to Applications and open it. If macOS says it cannot verify the app, open System Settings → Privacy & Security and click Open Anyway (on macOS 14 and older you can also right-click the app and choose Open). On Windows, SmartScreen may ask you to confirm (More info → Run anyway).

FreeBSD, OpenBSD, NetBSD and iOS: build from source, see the README.

• Updates from within the app (Settings → Updates), off by default. On Windows (setup installation), macOS and the Linux AppImage, 2Secret can install new versions itself when it starts; elsewhere, including Android, it says when a new version is available and opens the download. Only updates signed with 2Secret's key, for a newer version and with the signed SHA-256 are installed (docs/UPDATES.md).

Downloads#

Server image for x86_64 and ARM64 (e.g. Raspberry Pi 4/5 with a 64-bit OS): docker pull ghcr.io/joostiphone/2secret:latest – see self-hosting.

On macOS, drag 2Secret to Applications and open it. If macOS says it cannot verify the app, open System Settings → Privacy & Security and click Open Anyway (on macOS 14 and older you can also right-click the app and choose Open). On Windows, SmartScreen may ask you to confirm (More info → Run anyway).

FreeBSD, OpenBSD, NetBSD and iOS: build from source, see the README.

• iOS AutoFill: fill passwords and sign in with passkeys in Safari and apps, after Face ID or Touch ID (needs Unlock with Face ID in the app).
• The iOS app can be published on the App Store: an Xcode project with the AutoFill extension (ios/), store texts and screenshots in English and Dutch, and automatic uploads to TestFlight (see docs/APP-STORE.md).
• Android app (Android 7 and newer), attached to releases as a signed .apk and an .aab for app stores. Its data stays out of Android's cloud backups.
• Passkeys: the browser extension offers to save new passkeys in 2Secret and signs in with them; you can always choose another device or security key instead. Passkeys are end-to-end encrypted and sync with the vault, and can be imported from Bitwarden. Firefox 128 or newer is needed.
• Unlock with Touch ID (macOS), Face ID or Touch ID (iOS) and Windows Hello (Settings → Security). The master password is still needed every 14 days.
• Removing someone from a shared vault gives the vault a new key: everything is re-encrypted, so what is added or changed afterwards is unreadable with the key they had. Managers can also replace a vault's key themselves (Share → Replace vault key, 2secret vault rotate-key).
• New items without a chosen vault go to your personal vault, never to a vault that is shared with others.
• Fresh screenshots in English and Dutch (scripts/screenshots.sh).

Downloads#

Server image for x86_64 and ARM64 (e.g. Raspberry Pi 4/5 with a 64-bit OS): docker pull ghcr.io/joostiphone/2secret:latest – see self-hosting.

On macOS, drag 2Secret to Applications and open it. If macOS says it cannot verify the app, open System Settings → Privacy & Security and click Open Anyway (on macOS 14 and older you can also right-click the app and choose Open). On Windows, SmartScreen may ask you to confirm (More info → Run anyway).

FreeBSD, OpenBSD, NetBSD and iOS: build from source, see the README.

Quantum-resistant sharing:

• Vault keys shared with other people are wrapped with a hybrid of X25519 and ML-KEM-768 (FIPS 203), so recorded traffic or a stolen server database cannot be decrypted later with a quantum computer. The recipient's device re-wraps the key with its own 256-bit account key on its next sync.
• Accounts publish their ML-KEM public key automatically on their first sync with this version; their fingerprint changes once when that happens.
• New Secret Keys have 130 bits of entropy (26 random characters instead of 25). Existing Secret Keys keep working.
• Update every device: 2Secret 1.0 cannot open a vault shared with the new scheme until the recipient has synced once with 1.1.

Security hardening, informed by the LastPass breaches:

• Browser extension: right before filling, the page and every frame are checked against the item's websites, so credentials never reach a frame from another site or a page the tab navigated to after the popup opened.
• Websites are matched by registrable domain using the Public Suffix List, https items are never filled into http pages, ports are respected.
• Master passwords need at least 12 characters and a "good" strength rating.
• Clients and servers refuse Argon2id parameters below 19 MiB / 2 passes.
• Encrypted data is padded to size classes, so the server no longer learns exact item sizes.

Downloads#

Server image for x86_64 and ARM64 (e.g. Raspberry Pi 4/5 with a 64-bit OS): docker pull ghcr.io/joostiphone/2secret:latest – see self-hosting.

On macOS, drag 2Secret to Applications and open it. If macOS says it cannot verify the app, open System Settings → Privacy & Security and click Open Anyway (on macOS 14 and older you can also right-click the app and choose Open). On Windows, SmartScreen may ask you to confirm (More info → Run anyway).

FreeBSD, OpenBSD, NetBSD and iOS: build from source, see the README.

• The Docker image is also available for ARM64 (Raspberry Pi, ARM servers).
• The release workflow can sign and notarize the macOS app with an Apple Developer ID (see CONTRIBUTING.md); without one it stays signed ad hoc.

Downloads#

Server image for x86_64 and ARM64 (e.g. Raspberry Pi 4/5 with a 64-bit OS): docker pull ghcr.io/joostiphone/2secret:latest – see self-hosting.

On macOS, drag 2Secret to Applications and open it. If macOS says it cannot verify the app, open System Settings → Privacy & Security and click Open Anyway (on macOS 14 and older you can also right-click the app and choose Open). On Windows, SmartScreen may ask you to confirm (More info → Run anyway).

FreeBSD, OpenBSD, NetBSD and iOS: build from source, see the README.