More reliable refresh of your organization's rules, a smaller part of the extension loaded on every page, and security updates to bundled libraries.

Family and shared Vaults look the same as in the web app (Shared, "shared · from whom", Read only), and the Vault list refreshes by itself. The generator works without signing in, is more compact and offers an exact password length. Choose the language with the HR | EN switch. Security improvements and fixes.

4.0.1 — fixes
• The account menu (avatar click) responds to clicks again. Previously it dimmed the popup and nothing could be selected.
• Password generator: the "Croatian letters" option now works correctly. When off, passwords contain no č, ć, đ, š, ž; when on, they contain at least one. Saved passwords are unchanged.

Version 4.0 is a complete rewrite of the Škrinjar extension: autofill for logins on any site, a password generator, quick-save for new logins straight from the browser, editing and deleting items without leaving the extension, PIN lock, TOTP two-factor code support, keyboard shortcuts, and a fully localized Croatian/English interface.

Better autofill and safer copying

The autofill popup is redesigned and follows the extension theme, with keyboard navigation. 2FA codes and passwords copy more safely — the clipboard auto-clears, and you can turn off unwanted save prompts.

🎨 Redesigned autofill popup — follows the extension theme (light/dark/follow system)
⌨ Keyboard: ↑↓ to select, Enter to fill, Esc to close
🌐 Site favicon next to each suggestion
🔐 2FA code copied automatically after a login is filled
🧽 Clipboard auto-clears after copying a password or code — with a countdown
🚫 "Never for this site" — turn off the save prompt on chosen sites
🤫 Quieter display when a site has no saved logins

New: Search and autofill now respect the two-worlds model — your private space (Personal + Family) and business space (companies) no longer mix. When a login for the current page exists only in the other space, you get a discreet notice without revealing any details. Fixed: family and business vaults load reliably (including after browser idle), default vaults show correct contextual names, first sync on a new device is more robust with automatic self-healing, and sync errors are now visible in the status indicator.

🔐 Permissions are consistently enforced — the extension shows and enables only what you're entitled to.
👪 Family vault — moving, copying and deleting now work correctly from the extension.
🔒 More reliable unlocking according to your lock setting.
✨ Clearer account/device messages and minor UI polish.

Faster syncing of large vaults (3000+ entries) and clear real-time progress during a manual sync.

Improved shared vault security: support for encryption key rotation in shared vaults and collections. Internal change — no new permissions and no change to how you use the extension.

What's new in 3.2.0
- Business (shared) vaults — full support: view and edit (add/edit/delete) while respecting your permissions.
- New context switcher — two-level (organization → vault), Family in the personal section, search across all vaults at once.
- Folders in shared vaults and collections + move-to-folder from the menu.
- Bulk actions — multi-select, copy/move between vaults, favorites, select-all.
- Per-entry password health + guided password change from the report.
- More precise autofill — multiple URLs per login with per-URL matching.
- New filters — "Favorites" and "Has TOTP".
- Clear access messages when org policy blocks an action (2FA required, plan, restriction).
- More private site icons (Geslar proxy, respects your setting).
- More reliable sync — safe cross-device deletion, faster bulk sync, full password history, shared-vault key self-heal.

🔐 GESLAR VAULT — End-to-end encrypted password manager (E2EE)
Geslar keeps your passwords, cards and TOTP keys encrypted on your device. It works locally, no account needed — and when you want, add sync and family sharing over an encrypted cloud that cannot read your data.
🆕 NEW IN v3.1.2

Family account recovery — if a family member loses their master password, an organizer can restore their access. Opt-in (the owner enables it, the member consents), end-to-end encrypted — the server never sees your keys.
Two-factor sign-in (2FA) — sign in and sync with a TOTP (authenticator) code or a backup code, in both the extension and the web vault.

RECENTLY: Shared Vault (Family), cross-device sync (Premium), the my.geslar.app web console, entry tags, and in-app purchase of Premium/Family — all E2EE.
✅ WHY GESLAR?

Local-first — works with no account and no internet
Cloud is optional — sync and sharing when you need them (Premium/Family), still E2EE
No telemetry — zero tracking, zero cookies
Free for basic use; Premium and Family for sync and sharing
Fully localized (English & Croatian)

🔑 FEATURES

AES-256-GCM encryption with PBKDF2 (600,000 iterations)
One-click password autofill, or Ctrl+Shift+L
Password and passphrase generator
Two-factor account sign-in — TOTP + backup codes
Family account recovery — an organizer can restore a member's access (opt-in, E2EE)
TOTP 2FA generator for your saved sites (SHA-1, SHA-256, SHA-512)
Wi-Fi, cards, notes, SSH keys, identities, bank accounts
Entry tags + search
Biometric unlock (Windows Hello / Touch ID)
Passkey support (WebAuthn)
Import from CSV and other managers, export in 3 formats
Send — share a password via an encrypted link
Password breach check against HIBP (k-Anonymity)
Sync and Shared Vault (Premium/Family)

🔤 PASSPHRASE GENERATOR

Passphrases from English or Croatian words — easy to remember, hard to crack
English EFF Diceware (7776 words) + idioms; 8 Croatian dialects + metaphors
EN/HR switching with automatic option adjustment
Password generator with 4 complexity levels

🛡️ SECURITY

Zero-knowledge architecture (E2EE) — the server cannot read your data
Master key kept in RAM only
Closed shadow DOM isolation
Content Security Policy protection
GDPR compliant — data controller based in Croatia (EU)

⌨️ SHORTCUTS

Ctrl+Shift+G — open Geslar
Ctrl+Shift+L — autofill on the current page

Made in Croatia, for people to whom privacy is a right, not an option.

v3.0.4 — Optional end-to-end encrypted cloud sync

NEW SINCE 2.5.x
- Cloud sync (opt-in): register an account to sync your vault across devices. End-to-end encrypted — the server stores only ciphertext, never your master password or plaintext data. Works fully offline if you never sign in.
- Master-key recovery: reset a forgotten master password using the recovery key issued at signup (vault data preserved via envelope encryption).
- Right-click menu: fill login, generate password, copy TOTP from any field.
- Autofill now requires an explicit host-permission grant (no broad access at install).

FIXED (3.0.1-3.0.4)
- Reliable add/edit of entries after the background worker idles.
- Toolbar icon clarity: greyscale when locked; a per-site badge shows how many saved logins match the current page.

🆕 NEW IN v2.5.8: IN-PAGE GENERATOR, AUTOFILL ON REDDIT
• Click a password field to open a generator overlay — fill without copy-paste
• Toggle passphrase/password, regenerate, auto-fill the confirm field (green outline confirmation)
• Autofill now works on Reddit and web-component login forms (open shadow DOM)
• TOTP QR paste — Ctrl+V a QR image from clipboard in TOTP setup (bypasses popup-closing on drag)
• TOTP QR drag directly from Google/GitHub/GitLab 2FA setup pages

🆕 NEW IN v2.5: USERNAME GENERATOR AND BANK ACCOUNT
• Username generator — third tab in generator: word + number, random string, catch-all email
• Bank account — new record type with IBAN validation (ISO 13616), auto-formatting and SWIFT/BIC field
• Smart autofill — lock icon only appears on pages with saved entries

🌐 v2.3.0 — Multilingual Support

• NEW: Interface in Croatian and English — manual language selection in settings
• NEW: Generator supports Croatian and English word pools with automatic switching
• NEW: English EFF Diceware wordlist (7,776 words) and 329 English idioms
• NEW: Dynamic dialect pills per language (HR: 8 dialects + metaphors, EN: Standard + Idioms)