Bugfixes

• Saving an entry no longer loses what was typed when it fails. The password
  dialog closed as soon as OK was pressed and gpg ran afterwards, so a missing
  or expired recipient key or an unusable .gpg-id lost the entry. The dialog
  now stays open until the entry is written, locked and showing "Saving…"; on
  failure the fields come back with the reason. Cancel, Esc and closing the window
  still work while it waits, after asking, so a save that never reports (an
  unanswered PIN prompt) cannot trap you
  (#1944, ported from
  #1951)

Qt 5.15 and Qt 6 are both still supported. 2.0 (Qt 6.8+) is in release-candidate testing (2.0.0-rc2); 1.8 remains the maintenance line.

Second release candidate for QtPass 2.0. Please test it and report problems in #1812 or as new issues. Translations are in string freeze on Weblate until the final release.

Downloads: Windows installer (.exe), macOS (.dmg), Linux AppImage (x86_64, glibc 2.39+), and source archives. 2.0 needs Qt 6.8 or newer; the 1.8 line (1.8.3) stays available for Qt 5 and older Qt 6.

Worth testing in particular: the first-run wizard, switching profiles and initialising a new store, re-encryption, Ctrl+Q / Ctrl+W and the tray, the AppImage on a Wayland desktop, the Windows WSL setup, and macOS.

Changes since rc1

• A failed save no longer loses what you typed. The password dialog
  stays open until the entry is written, showing "Saving…"; if encryption
  fails (an expired or untrusted recipient key, an unusable .gpg-id), the
  fields come back with the reason. Cancel, Esc and closing the window still
  work while it waits, after asking, so a save that never finishes (an
  unanswered PIN prompt) cannot trap you
  (#1951, #1965).
• The Users dialog shows the keys a folder is really encrypted to,
  including expired, revoked or missing ones, which "Show unusable keys" used
  to hide, so they can be seen and unticked
  (#1962).
• "Unusable public key" is explained, instead of being reported as a
  missing key (#1961).
• Enter in a field-name editor confirms the new name instead of saving and
  closing the whole entry.
• Re-encryption refuses to run when it cannot check the store for unmerged
  files after a pull; removing a linked folder reports when git could not
  record it (#1960).
• macOS: the app bundle declares itself an application with its full version
  (#1953), and
  scripts/release-mac.sh can sign and notarize, opt-in, for a future
  notarized build (#1943).
• Builds without warnings on GCC 16; CI back on the newest Qt 6.11 patch.
• Translations: Weblate updates, and best-effort fillers for the new strings
  for Weblate's reviewers (#1967).

Upgrade notes

• Qt 6.8 or newer. Qt 5 support ended with 1.8; qmake refuses older Qt
  with a clear message. Packagers building 1.8.x against Qt 5 need the
  1.8 branch for that.
• Ctrl+Q quits. It used to close the window, which with "hide on close"
  meant hiding to the tray; that is Ctrl+W (File ▸ Close window) now. The
  window close button and Alt+F4 behave as before.
• The menu bar is off by default so the window looks as it did. Alt
  shows it for as long as it is used, so Alt+F and the other mnemonics work;
  Ctrl+M, Settings ▸ Show menu bar or the tray menu keep it on, and the
  choice is remembered. On macOS the bar is the system's and always there.
• Settings moved, stored values did not. Clipboard and panel autoclear
  are one number each (0 is "Never"), the two template checkboxes are one
  choice, and "Show menu bar" / "Show process output" are toggles in the
  Settings menu instead of the settings dialog. Existing configuration files
  are read and written with the same keys.
• Generating a GPG key asks for a passphrase. Leaving the fields empty
  used to produce an unprotected private key silently; now OK waits until a
  passphrase is typed twice or "No passphrase" is ticked on purpose.
• A link inside the store is not part of it. A symbolic link or NTFS
  junction found in the store (a shared repository can carry one) is skipped
  by re-encryption and search and refused by show, edit, add, move, copy and
  re-key, with a message; deleting one removes the link. The configured
  store root itself may still be a link. See SECURITY.md.
• Debug output comes from the qtpass logging category in every build:
  QT_LOGGING_RULES="qtpass.debug=true" turns it on, no debug build needed
  (see the FAQ). The #ifdef QT_DEBUG tracing is gone.
• Linux AppImage: new, attached to every release; needs glibc 2.39 or
  newer (Ubuntu 24.04, Debian 13, Fedora 40). It bundles Qt only and uses the
  system's pass, gpg and git.
• Packagers: the AppStream metainfo installs as
  org.qtpass.QtPass.metainfo.xml (was qtpass.appdata.xml); main/main.pro
  installs the desktop file, metainfo, icons and man page; the RPM spec
  follows; the Flatpak manifest drops rename-appdata-file with the 2.0 tag.
• Still true from 1.8: the macOS .dmg is not signed or notarized (see the
  macOS page, #1542)
  and the Windows installer is not code-signed (#1643).

The full list of changes is in CHANGELOG.md.

Release candidate for QtPass 2.0. Please test it and report problems in #1812 or as new issues. Translations are in string freeze on Weblate until the final release.

Downloads: Windows installer (.exe), macOS (.dmg), Linux AppImage (x86_64, glibc 2.39+), and source archives. 2.0 needs Qt 6.8 or newer; the 1.8 line (1.8.2) stays available for Qt 5 and older Qt 6.

Worth testing in particular: the first-run wizard, switching profiles and initialising a new store, re-encryption, Ctrl+Q / Ctrl+W and the tray, the AppImage on a Wayland desktop, the Windows WSL setup, and macOS.

Upgrade notes

• Qt 6.8 or newer. Qt 5 support ended with 1.8; qmake refuses older Qt
  with a clear message. Packagers building 1.8.x against Qt 5 need the
  1.8 branch for that.
• Ctrl+Q quits. It used to close the window, which with "hide on close"
  meant hiding to the tray; that is Ctrl+W (File ▸ Close window) now. The
  window close button and Alt+F4 behave as before.
• The menu bar is off by default so the window looks as it did. Alt
  shows it for as long as it is used, so Alt+F and the other mnemonics work;
  Ctrl+M, Settings ▸ Show menu bar or the tray menu keep it on, and the
  choice is remembered. On macOS the bar is the system's and always there.
• Settings moved, stored values did not. Clipboard and panel autoclear
  are one number each (0 is "Never"), the two template checkboxes are one
  choice, and "Show menu bar" / "Show process output" are toggles in the
  Settings menu instead of the settings dialog. Existing configuration files
  are read and written with the same keys.
• Generating a GPG key asks for a passphrase. Leaving the fields empty
  used to produce an unprotected private key silently; now OK waits until a
  passphrase is typed twice or "No passphrase" is ticked on purpose.
• A link inside the store is not part of it. A symbolic link or NTFS
  junction found in the store (a shared repository can carry one) is skipped
  by re-encryption and search and refused by show, edit, add, move, copy and
  re-key, with a message; deleting one removes the link. The configured
  store root itself may still be a link. See SECURITY.md.
• Debug output comes from the qtpass logging category in every build:
  QT_LOGGING_RULES="qtpass.debug=true" turns it on, no debug build needed
  (see the FAQ). The #ifdef QT_DEBUG tracing is gone.
• Linux AppImage: new, attached to every release; needs glibc 2.39 or
  newer (Ubuntu 24.04, Debian 13, Fedora 40). It bundles Qt only and uses the
  system's pass, gpg and git.
• Packagers: the AppStream metainfo installs as
  org.qtpass.QtPass.metainfo.xml (was qtpass.appdata.xml); main/main.pro
  installs the desktop file, metainfo, icons and man page; the RPM spec
  follows; the Flatpak manifest drops rename-appdata-file with the 2.0 tag.
• Still true from 1.8: the macOS .dmg is not signed or notarized (see the
  macOS page, #1542)
  and the Windows installer is not code-signed (#1643).

The full list of changes is in CHANGELOG.md.

Changed

• The AppStream metainfo installs as org.qtpass.QtPass.metainfo.xml, the
  filename the spec derives from the component ID, instead of
  qtpass.appdata.xml (ported from #1804). Packagers who install the
  file themselves need the new name; the Flatpak manifest drops
  rename-appdata-file with this tag

Bugfixes

• "Automatically push" and "Automatically pull" in the settings did nothing
  since 1.8.0: #1140 started
  storing them per profile and stopped writing the global keys that the
  backends and the pull-on-start actually read. Both are saved again, and
  switching profiles now applies that profile's Git flags along with its path
  and signing key (ported from #1792)
• The Edit dialog turned every key: value line into a label-locked field
  since 1.8.0, also with templates off, so those keys could no longer be
  edited as text (#1138 forced "all fields" on for #132). Which lines become
  fields follows the settings again: the template's fields when templates are
  on, every key: value line only with "Template all fields", closes
  #1766 (ported from #1767)

Qt 5.15 and Qt 6 are both still supported. 2.0 (Qt 6.8+) is in release-candidate testing; 1.8 remains the maintenance line.

The security and data-loss fixes from the 2.0 branch, backported to the 1.8
line (#1709). Qt 5.15 and Qt 6 are both still supported.

Security

• Windows/WSL: commands run through wsl --exec instead of the distribution's
  login shell, so entry paths, .gpg-id recipients and commit messages are no
  longer word-split or $()-expanded (a hostile shared store could run code
  inside WSL). Binaries reachable only through PATH additions in shell rc
  files are no longer found #1723 (ported from #1686)
• The key-generation dialog no longer shows the passphrase in clear text in
  the batch template box; it is spliced in only when the key is generated, and
  batch keywords are matched the way gpg does, so an expert-mode template
  cannot produce an unprotected key by accident #1718 (ported from #1687, #1694)
• The re-encryption backup commit stages tracked files only, so a stray
  plaintext export or editor swap file in the store is no longer committed and
  auto-pushed; Init stages a new folder's untracked .gpg-id itself
  #1713 (ported from #1685, #1698)
• Every gpg encrypt call passes --no-encrypt-to and --compress-algo=none,
  as pass does, so an encrypt-to line in the user's gpg.conf can no
  longer add a recipient the .gpg-id never listed #1725 (ported from #1720)
• Only launchable http(s) URLs become clickable links in the password pane
  and the text browser; ssh://, ftp://, sftp://, webdav:// and URLs
  with embedded credentials are shown as text #1726 (ported from #1719)
• Single-instance IPC: a stale socket left behind by a crash no longer
  disables it permanently (launcher clicks did nothing), the socket is
  restricted to the owning user, and a launch whose forward fails opens a
  window instead of exiting silently #1728 (ported from #1721)
• An out-of-range passwordCharsSelection in the settings file is clamped to
  "All characters" when loaded instead of indexing the character-set table
  out of bounds when the Settings dialog opens #1724 (ported from #1715)

Bugfixes

• "New folder" wrote a zero-byte .gpg-id, shadowing the parent recipients
  and breaking every insert in that folder; it is now seeded from the parent
  recipients, and never left unsigned when a signing key is configured (the
  folder then inherits the parent's signed list) #1714 (ported from #1688, #1695)
• .gpg-id recipients gpg would accept (v6 fingerprints, user IDs, =exact
  selectors) were dropped silently and then erased on the next UsersDialog
  save; refused lines are now logged instead #1710 (ported from #1684)
• The password pane showed &, ", > for values containing
  &, ", >, and the open-in-browser tooltip did the same for URLs with
  query strings; the tooltip also stays on one line #1712 (ported from #1683, #1693)
• Edits typed in the password dialog before the decrypt landed were silently
  discarded or overwritten; the dialog now stays inert until the content is
  in, and a failed decrypt shows the gpg error instead of closing the dialog
  #1722 (ported from #1690)
• Cancelling the first-run wizard quits instead of showing a half-configured
  window, and an accepted-but-invalid configuration re-asks instead of
  starting on a broken store #1717 (ported from #1689, #1696)
• "Use Git" with no Git executable configured no longer wedges the command
  queue; delete, rename, insert, copy, init, pull and push fall back to plain
  filesystem operations with a status message instead of silently doing
  nothing #1716 (ported from #1691)
• A configured GPG home that no longer exists is ignored with a status message
  instead of making every gpg call fail with "No secret key" (the 1.7.0 test
  suite left its temporary keyring path in the live settings when make check
  ran as the user), closes #1711 #1741 (ported from #1740)
• make check no longer kills the developer's own gpg-agent
  #1739 (ported from #1738)
• Ctrl-drag copying an entry onto a folder failed with "Copy failed" in the
  native (gpg2/git) backend because the folder path was handed to the file
  copy; the destination is now resolved like a move (<folder>/<entry>.gpg,
  no overwrite without force, never onto the entry itself)
  #1748 (ported from #1735)

New Features

• Built-in TOTP (RFC 6238): one-time passwords are now generated inside QtPass
  instead of shelling out to the pass-otp extension, so OTP works on every
  platform and with both the pass and direct gpg2/git backends. Store the
  configuration as an otpauth:// URI in the OTP template field; bare
  otpauth:// lines written by pass-otp are still read. The selected entry
  shows a live code with a copy button and a countdown, and
  SHA-1/SHA-256/SHA-512 plus Steam Guard codes are supported #1625
• Share submenu on folders: re-encrypt, export your public key, add
  recipients, and a "What is this?" explainer #1144, #1162,
  closes #422
• Import GPG keys from file or clipboard via the Users dialog #1170,
  closes #1167
• Process output panel (dockable) with command labels, colour-coded errors,
  auto-scroll with hysteresis and a 1000-line cap #1172, #1193,
  closes #252
• "Open in browser" button for URL fields in the password panel #1517,
  closes #1516
• Manual SSH_AUTH_SOCK override with gpgconf auto-probe fallback
  #1438, closes #543
• Opt-in content search across decrypted entries (regular expression)
• Multiple templates via .templates files, auto-applied to new entries,
  Ctrl+T cycles between them #1141, #1142, #1143
• Git options are stored per profile #1140, closes #112
• All fields of an entry can be edited, not only the password #1138,
  closes #132
• Status bar feedback while creating a profile #1136, closes #1034

Upgrade Notes

• OTP support is now on by default, so upgrading shows live one-time-password
  codes for entries that contain an otpauth:// secret, even if you had it off
  before. The old setting only ever gated the Unix-only pass-otp extension,
  so its stored value was meaningless on Windows and macOS. To turn it off,
  uncheck Enable one-time password (OTP) support on the Settings tab of
  the configuration dialog; the choice is remembered and is not re-enabled on
  later launches. The upgrade changes only this setting — no stored passwords
  are read, rewritten, or re-encrypted.
• macOS: the release .dmg is not signed or notarized, and the Homebrew cask
  was disabled by Homebrew on 2026-09-01 for that reason. Install the .dmg
  from the GitHub release and clear the quarantine flag
  (xattr -d com.apple.quarantine /Applications/QtPass.app). Status and how
  to help: the macOS page on qtpass.org and #1542.
• Windows: the installer is not code-signed; SmartScreen asks for
  More info → Run anyway on first start #1643.
• 31 single-variant locales were renamed to language-only codes (e.g.
  ar_MA → ar); Qt's locale fallback picks them up automatically
  #1328, #1350

Security

• Path-traversal hardening for new file, rename and drag-and-drop targets
  #1464
• .gpg-id is written with mode 0600 #1465
• URLs are HTML-escaped in the password panel #1584
• A TOTP shared secret is never rendered in cleartext, also when stored as an
  OTP: field, and Ctrl+C on an otpauth://-only entry no longer copies the
  seed #1625

Bugfixes

• ConfigDialog no longer silently corrupts saved settings #1602
• PasswordDialog: no content duplication or data loss on premature save
  #1605
• ImitatePass Git re-encryption used the wrong recipients and working
  directory, and its copy operation was broken #1604
• Executor could stall when a stdin-less command failed to start #1606;
  crashed subprocesses no longer hang the UI #1570
• Use-after-free of the key-generation dialog pointer #1603; keygen start
  failures are reported instead of hanging #1599, closes #1598
• Clipboard autoclear kept tracking the right entry when navigating #1607
• The window follows light/dark theme switches at runtime (KDE day/night),
  including the toolbar, which Breeze kept in the previous theme
  #1669, #1661
• A missing qrencode binary is reported instead of showing an empty QR
  dialog #1659
• Close button quits when hide-on-close is off and a tray icon is present
  #1580
• WSL: wslpath translation is a real call instead of a broken shell
  substitution #1569, closes #1509
• Segfault chain on first launch (focusInput before init) #1187–#1191
• Process output panel obscured the central widget #1192
• Locale-aware QTranslator::load() so regional variants fall back correctly
  #1362
• Plural agreement in the grep status message #1133, closes #1042
• Coverity and clang-tidy findings (one real bug, bulk modernize/performance)
  #1096, #1100, #1432, #1435

Code Quality (umbrella #1508)

• Split the Util grab-bag into PathValidator, SshAuthSock and TemplateIO, and consolidated StoreModel drag-drop #1514
• Tightened the Pass interface: beforeExecute() hook, Move/Copy dedup, documented Grep regular-expression dialect, and PassBackendFactory #1513
• Decomposed MainWindow into GrepSearchController, PasswordDisplayPanel, a UI watchdog, and StoreModel::rootIndexFor #1512
• Introduced AppSettings + SettingsSerializer with a QtPassSettings::load()/save() facade, injected through the Pass/dialog layers; 70 dead getter/setter wrappers removed #1511
• P1 audit sweep: executor crash, StoreModel guard, getKeysFromFile, profile sort order, reencryptPath init #1570, #1571, #1572

Tests

• Test suites grew from 11 to 25: widget tests for MainWindow, ConfigDialog,
  KeygenDialog, TrayIcon, UsersDialog, PasswordDisplayPanel, Import/Export key
  dialogs; unit suites for Base32, TOTP, PassBackendFactory, UserInfo,
  ProfileInit; GPG end-to-end coverage for multi-recipient encryption,
  per-folder re-encryption and the decrypt-and-edit GUI flow
• Tests run against an isolated settings directory instead of the user's live
  config #1662

Localization

• 64 locales, 14 of them new since 1.7.0: Bengali, Hindi, Indonesian,
  Latvian, Lithuanian, Marathi, Persian, Punjabi, Slovenian, Swahili, Telugu,
  Thai, Urdu and Vietnamese. Most locales are complete apart from the strings
  added late in this cycle
• Hundreds of reviewer-driven corrections across sr_Cyrl, hu, cy, et, pl,
  zh_CN, gl, sv, nl and others; mnemonic and placeholder audit tooling added
• The strings added this cycle were pre-filled in 46 locales and left
  unfinished for native review on Weblate
  #1665, #1666, #1667,
  #1670
• Weblate remains the place to translate: https://hosted.weblate.org/projects/qtpass/

Build / CI

• macOS builds on Qt 6.11; Linux/Windows stay on Qt 6.8 LTS; Qt 5.15 still
  builds #1600
• Doxygen download resilient to doxygen.nl outages #1538; zero-warning
  Doxygen enforced
• super-linter v8 (clang-format 21), commitlint, .editorconfig, REUSE
  compliance badge
• Dead Coverity integration remove...

Changelog

1.7.0 (2026-04-20)

• Qt 6.10 beginFilterChange/endFilterChange support #1052
• Spanish regional variants #1040
• More integration tests + CI GPG signing fix #1059
• Guard against out-of-bounds index in password character set #1084
• WSL case-insensitive path handling #1065
• Replace isDir/isFile bools with ItemKind enum in drag-and-drop #1066
• Redundant as_const cleanup #1063
• Reduced cyclomatic complexity in complex methods #1055
• Extract isGrepHeaderLine helper in pass.cpp #1073
• Rename single-letter parameters in setLength/setPasswordCharTemplate #1086
• Doxygen style standardized across headers and main.cpp #1087
• Stale @todo comments removed #1081
• Skill documentation for OpenCode/Claude agents #1088
• Translations updated (Swedish, Turkish, Ukrainian, Spanish)

Full Changelog

Spring zelf e's in the air

QtPass v1.6.0 (2026-04-13)

Highlights

• Auto-detect git in existing password-store #804
• Use ed25519 for GPG key generation when available #790
• Improved GPG key parsing with new gpgkeystate module

New Features

• Added auto-detect git in existing password-store
• Use ed25519 (ECC) for GPG key generation when GPG supports it
• Added compile_commands.json generation script for IDE tooling

Improvements

• Improved GPG key parsing with new gpgkeystate module #979
• Improved WSL path handling for gpgconf resolution
• Re-encryption security improvements #815
• Kill stale GPG agents before key generation #815
• Consolidated release scripts into scripts/ folder
• UsersDialog performance optimizations #977

Bug Fixes

• Fixed path separator check in gpgconf resolution
• Fixed .gpg-id path construction for cross-platform #780
• Fixed re-encryption security issues
• Fixed GPG key generation timeout handling #815
• Fixed clipboard history password exclusion #970
• Fixed transparent context menu in dark mode #967
• Fixed window positioning with window manager #947
• Fixed theme colors for button icons #949
• Fixed hardcoded black text in dark mode #946

Testing

• Added gpgkeystate test suite (8 test suites total) #979
• Added GPG colon output fixtures
• Improved test assertions and coverage #978, #981, #982

Documentation & Maintenance

• Added AGENTS.md for AI agent guidance
• Added security policy (SECURITY.md)
• Extensive doxygen documentation improvements
• CI/CD improvements and optimizations

Localization

• Updated translations via Weblate

Release, CI and Maintenance

• Consolidated release scripts into scripts/ folder
• Added compile_commands.json generation script
• Extensive code quality improvements via AI-assisted review
• CI/CD workflow optimizations

Full Changelog

Big Pickle 🐓

Stability hotfix release with Wayland and CLI improvements.

Fixes

• Crash on Wayland when screenAt() returns null (#706, #663)
• CLI arguments being parsed as password search (#652)
• OTP error handling with better messages (#677)
• Window icon not showing on dialog boxes (#671)
• Slovak translation GPG keygen script (#667)
• Suppress qApp deprecation warnings on Qt6

Full Changelog

v1.5.0...v1.5.1

Highlights

• Modernized C++/Qt build pipeline with clang-tidy and wider lint/test hardening.
• Windows release pipeline reliability improvements for AppVeyor and Inno Setup packaging.
• 1.5.0 release metadata and packaging preparation across the desktop app, installer, and CI configuration.

Fixes & Improvements

• Fixed profile handling issues in Qt6 compatibility scenarios and improved profile selection behavior #681, #695.
• Preserved existing application behavior when launching qtpass without parameters #704.
• Removed a regression where gpg_id comments could be altered #658.
• Added missing include path fixes and small reliability hardening in core code paths #690, #716.

Release, CI and Maintenance

• Added/updated PublicCode and CI workflows, including release-time validation and action upgrades #701, #709, #710, #711, #712.
• Completed the AppVeyor/Inno Setup modernization and packaging updates #722.
• Updated readme status badges and branch links to current workflow targets #724.

Localization

Synchronised a large set of translation updates through Weblate and translation automation.

New Contributors

@Vascom, @shemeshg, @ruimaciel, @vdchuyen, @souk4711, @principis, @stkw0, @basil

Full Changelog