QtPass

Third release candidate for QtPass 2.0. Please test it and report problems in #1812 or as new issues. Translations continue on Weblate; strings added since rc2 have best-effort fillers that Weblate's reviewers can refine.

Downloads: Windows installer (.exe), macOS (.dmg), Linux AppImage (x86_64, glibc 2.39+), and source archives, each with a detached signature (.asc) and a SLSA build provenance file (.intoto.jsonl). 2.0 needs Qt 6.8 or newer; the 1.8 line (1.8.4) stays available for Qt 5 and older Qt 6.

Worth testing in particular: "Hide password" with entries that hold a PIN, CVV or API key; clipboard autoclear (it now puts the previous clipboard back); a store inside a larger Git repository or with pass.signcommits set; signed .gpg-id stores with the pass backend; the Windows installer; and, as before, the first-run wizard, profiles, re-encryption and the AppImage on Wayland.

Changes since rc2

• "Hide password" hides the other secrets too. Fields named like a PIN, CVV, API key, recovery code or passphrase get the eye button, matched as whole words; the word list is in Settings ▸ Display (#2054, #2092).
• Autoclear puts the previous clipboard back, as pass -c does (#2090). Text copied out of a shown entry, a revealed password or the password editor now carries the same "secret" hints as the copy buttons and is cleared by autoclear too (#2117).
• Git stays inside the store, as with pass: a store inside a larger repository (dotfiles in the home folder, say) is no longer committed to and pushed with it unless Settings ▸ Git says so; inherited GIT_DIR and friends are ignored; new folders and .git are private (umask 077 or PASSWORD_STORE_UMASK) (#2057, #2086, #2091, #2102, #2119).
• Commits are signed when the store asks (pass.signcommits), as pass does; a commit that cannot be signed fails and says the entry is saved but not committed (#2070, #2079).
• Signed .gpg-id with the pass backend gets the native backend's checks before pass inserts, moves, copies or re-initialises; a signature by a revoked key no longer counts; profiles warn when two stores share a signing key (#2014, #2059, #2084, #2087, #2099, #2100).
• A shared store cannot exhaust QtPass: decrypted entries stop at 64 MiB, huge entries are shown in bounded parts, .gpg-id, .templates, signatures and key files are read as regular files with size limits (a FIFO or /dev/zero link used to hang the GUI), and names from the store are shown as plain text (#2051, #2060, #2061, #2075).
• Deleting an entry named with glob characters removes only that entry; a new folder named link/../x can no longer land outside the store; an entry saved into a new folder is encrypted to the nearest folder's recipients, as pass does.
• Init refuses a folder ou

Bugfixes

• Saving an entry no longer loses what was typed when it fails. The password dialog closed as soon as OK was pressed and gpg ran afterwards, so a missing or expired recipient key or an unusable .gpg-id lost the entry. The dialog now stays open until the entry is written, locked and showing "Saving…"; on failure the fields come back with the reason. Cancel, Esc and closing the window still work while it waits, after asking, so a save that never reports (an unanswered PIN prompt) cannot trap you (#1944, ported from #1951)

Qt 5.15 and Qt 6 are both still supported. 2.0 (Qt 6.8+) is in release-candidate testing (2.0.0-rc2); 1.8 remains the maintenance line.

Second release candidate for QtPass 2.0. Please test it and report problems in #1812 or as new issues. Translations are in string freeze on Weblate until the final release.

Downloads: Windows installer (.exe), macOS (.dmg), Linux AppImage (x86_64, glibc 2.39+), and source archives. 2.0 needs Qt 6.8 or newer; the 1.8 line (1.8.3) stays available for Qt 5 and older Qt 6.

Worth testing in particular: the first-run wizard, switching profiles and initialising a new store, re-encryption, Ctrl+Q / Ctrl+W and the tray, the AppImage on a Wayland desktop, the Windows WSL setup, and macOS.

Changes since rc1

• A failed save no longer loses what you typed. The password dialog stays open until the entry is written, showing "Saving…"; if encryption fails (an expired or untrusted recipient key, an unusable .gpg-id), the fields come back with the reason. Cancel, Esc and closing the window still work while it waits, after asking, so a save that never finishes (an unanswered PIN prompt) cannot trap you (#1951, #1965).
• The Users dialog shows the keys a folder is really encrypted to, including expired, revoked or missing ones, which "Show unusable keys" used to hide, so they can be seen and unticked (#1962).
• "Unusable public key" is explained, instead of being reported as a missing key (#1961).
• Enter in a field-name editor confirms the new name instead of saving and closing the whole entry.
• Re-encryption refuses to run when it cannot check the store for unmerged files after a pull; removing a linked folder reports when git could not record it (#1960).
• macOS: the app bundle declares itself an application with its full version (#1953), and scripts/release-mac.sh can sign and notarize, opt-in, for a future notarized build (#1943).
• Builds without warnings on GCC 16; CI back on the newest Qt 6.11 patch.
• Translations: Weblate updates, and best-effort fillers for the new strings for Weblate's reviewers (#1967).

Upgrade notes

• Qt 6.8 or newer. Qt 5 support ended with 1.8; qmake refuses older Qt with a clear message. Packagers building 1.8.x against Qt 5 need the 1.8 branch for that.
• Ctrl+Q quits. It used to close the window, which with "hide on close" meant hiding to the tray; that is Ctrl+W (File ▸ Close window) now. The window close button and Alt+F4 behave as before.
• The menu bar is off by default so the window looks as it did. Alt shows it for as long as it is used, so Alt+F and the other mnemonics work; Ctrl+M, Settings ▸ Show menu bar or the tray menu keep it on, and the choice is remembered. On macOS the bar is the system's and always there.
• Settings moved, stored values did not. Clipboard and panel autoclear are one number each (0 is "Never"), the two template checkboxes are one choice, and "Show menu bar" / "Show process output" are toggles in the Settings menu instead of the settings dialog. Existing configuration files are read and written with the same keys.
• Generating a GPG key asks for a passphrase. Leaving the fields empty used to produce an unprotected private key silently; now OK waits until a passphrase is typed twice or "No passphrase" is ticked on purpose.
• A link inside the store is not part of it. A symbolic link or NTFS junction found in the store (a shared repository can carry one) is skipped by re-encryption and search and refused by show, edit, add, move, copy and re-ke

Release candidate for QtPass 2.0. Please test it and report problems in #1812 or as new issues. Translations are in string freeze on Weblate until the final release.

Downloads: Windows installer (.exe), macOS (.dmg), Linux AppImage (x86_64, glibc 2.39+), and source archives. 2.0 needs Qt 6.8 or newer; the 1.8 line (1.8.2) stays available for Qt 5 and older Qt 6.

Worth testing in particular: the first-run wizard, switching profiles and initialising a new store, re-encryption, Ctrl+Q / Ctrl+W and the tray, the AppImage on a Wayland desktop, the Windows WSL setup, and macOS.

Upgrade notes

• Qt 6.8 or newer. Qt 5 support ended with 1.8; qmake refuses older Qt with a clear message. Packagers building 1.8.x against Qt 5 need the 1.8 branch for that.
• Ctrl+Q quits. It used to close the window, which with "hide on close" meant hiding to the tray; that is Ctrl+W (File ▸ Close window) now. The window close button and Alt+F4 behave as before.
• The menu bar is off by default so the window looks as it did. Alt shows it for as long as it is used, so Alt+F and the other mnemonics work; Ctrl+M, Settings ▸ Show menu bar or the tray menu keep it on, and the choice is remembered. On macOS the bar is the system's and always there.
• Settings moved, stored values did not. Clipboard and panel autoclear are one number each (0 is "Never"), the two template checkboxes are one choice, and "Show menu bar" / "Show process output" are toggles in the Settings menu instead of the settings dialog. Existing configuration files are read and written with the same keys.
• Generating a GPG key asks for a passphrase. Leaving the fields empty used to produce an unprotected private key silently; now OK waits until a passphrase is typed twice or "No passphrase" is ticked on purpose.
• A link inside the store is not part of it. A symbolic link or NTFS junction found in the store (a shared repository can carry one) is skipped by re-encryption and search and refused by show, edit, add, move, copy and re-key, with a message; deleting one removes the link. The configured store root itself may still be a link. See SECURITY.md.
• Debug output comes from the qtpass logging category in every build: QT_LOGGING_RULES="qtpass.debug=true" turns it on, no debug build needed (see the FAQ). The #ifdef QT_DEBUG tracing is gone.
• Linux AppImage: new, attached to every release; needs glibc 2.39 or newer (Ubuntu 24.04, Debian 13, Fedora 40). It bundles Qt only and uses the system's pass, gpg and git.
• Packagers: the AppStream metainfo installs as org.qtpass.QtPass.metainfo.xml (was qtpass.appdata.xml); main/main.pro installs the desktop file, metainfo, icons and man page; the RPM spec follows; the Flatpak manifest drops rename-appdata-file with the 2.0 tag.
• Still true from 1.8: the macOS .dmg is not signed or notarized (see the macOS page, #1542) and the Windows installer is not code-signed (#1643).

The full list of changes is in CHANGELOG.md.