4.0.1 — fixes
• The account menu (avatar click) responds to clicks again. Previously it dimmed the popup and nothing could be selected.
• Password generator: the "Croatian letters" option now works correctly. When off, passwords contain no č, ć, đ, š, ž; when on, they contain at least one. Saved passwords are unchanged.

Version 4.0 is a complete rewrite of the Škrinjar extension: autofill for logins on any site, a password generator, quick-save for new logins straight from the browser, editing and deleting items without leaving the extension, PIN lock, TOTP two-factor code support, keyboard shortcuts, and a fully localized Croatian/English interface.

Better autofill and safer copying

The autofill popup is redesigned and follows the extension theme, with keyboard navigation. 2FA codes and passwords copy more safely — the clipboard auto-clears, and you can turn off unwanted save prompts.

🎨 Redesigned autofill popup — follows the extension theme (light/dark/follow system)
⌨ Keyboard: ↑↓ to select, Enter to fill, Esc to close
🌐 Site favicon next to each suggestion
🔐 2FA code copied automatically after a login is filled
🧽 Clipboard auto-clears after copying a password or code — with a countdown
🚫 "Never for this site" — turn off the save prompt on chosen sites
🤫 Quieter display when a site has no saved logins

New: Search and autofill now respect the two-worlds model — your private space (Personal + Family) and business space (companies) no longer mix. When a login for the current page exists only in the other space, you get a discreet notice without revealing any details. Fixed: family and business vaults load reliably (including after browser idle), default vaults show correct contextual names, first sync on a new device is more robust with automatic self-healing, and sync errors are now visible in the status indicator.

🔐 Permissions are consistently enforced — the extension shows and enables only what you're entitled to.
👪 Family vault — moving, copying and deleting now work correctly from the extension.
🔒 More reliable unlocking according to your lock setting.
✨ Clearer account/device messages and minor UI polish.

Faster syncing of large vaults (3000+ entries) and clear real-time progress during a manual sync.

Improved shared vault security: support for encryption key rotation in shared vaults and collections. Internal change — no new permissions and no change to how you use the extension.

What's new in 3.2.0
- Business (shared) vaults — full support: view and edit (add/edit/delete) while respecting your permissions.
- New context switcher — two-level (organization → vault), Family in the personal section, search across all vaults at once.
- Folders in shared vaults and collections + move-to-folder from the menu.
- Bulk actions — multi-select, copy/move between vaults, favorites, select-all.
- Per-entry password health + guided password change from the report.
- More precise autofill — multiple URLs per login with per-URL matching.
- New filters — "Favorites" and "Has TOTP".
- Clear access messages when org policy blocks an action (2FA required, plan, restriction).
- More private site icons (Geslar proxy, respects your setting).
- More reliable sync — safe cross-device deletion, faster bulk sync, full password history, shared-vault key self-heal.

🔐 GESLAR VAULT — End-to-end encrypted password manager (E2EE)
Geslar keeps your passwords, cards and TOTP keys encrypted on your device. It works locally, no account needed — and when you want, add sync and family sharing over an encrypted cloud that cannot read your data.
🆕 NEW IN v3.1.2

Family account recovery — if a family member loses their master password, an organizer can restore their access. Opt-in (the owner enables it, the member consents), end-to-end encrypted — the server never sees your keys.
Two-factor sign-in (2FA) — sign in and sync with a TOTP (authenticator) code or a backup code, in both the extension and the web vault.

RECENTLY: Shared Vault (Family), cross-device sync (Premium), the my.geslar.app web console, entry tags, and in-app purchase of Premium/Family — all E2EE.
✅ WHY GESLAR?

Local-first — works with no account and no internet
Cloud is optional — sync and sharing when you need them (Premium/Family), still E2EE
No telemetry — zero tracking, zero cookies
Free for basic use; Premium and Family for sync and sharing
Fully localized (English & Croatian)

🔑 FEATURES

AES-256-GCM encryption with PBKDF2 (600,000 iterations)
One-click password autofill, or Ctrl+Shift+L
Password and passphrase generator
Two-factor account sign-in — TOTP + backup codes
Family account recovery — an organizer can restore a member's access (opt-in, E2EE)
TOTP 2FA generator for your saved sites (SHA-1, SHA-256, SHA-512)
Wi-Fi, cards, notes, SSH keys, identities, bank accounts
Entry tags + search
Biometric unlock (Windows Hello / Touch ID)
Passkey support (WebAuthn)
Import from CSV and other managers, export in 3 formats
Send — share a password via an encrypted link
Password breach check against HIBP (k-Anonymity)
Sync and Shared Vault (Premium/Family)

🔤 PASSPHRASE GENERATOR

Passphrases from English or Croatian words — easy to remember, hard to crack
English EFF Diceware (7776 words) + idioms; 8 Croatian dialects + metaphors
EN/HR switching with automatic option adjustment
Password generator with 4 complexity levels

🛡️ SECURITY

Zero-knowledge architecture (E2EE) — the server cannot read your data
Master key kept in RAM only
Closed shadow DOM isolation
Content Security Policy protection
GDPR compliant — data controller based in Croatia (EU)

⌨️ SHORTCUTS

Ctrl+Shift+G — open Geslar
Ctrl+Shift+L — autofill on the current page

Made in Croatia, for people to whom privacy is a right, not an option.

v3.0.4 — Optional end-to-end encrypted cloud sync

NEW SINCE 2.5.x
- Cloud sync (opt-in): register an account to sync your vault across devices. End-to-end encrypted — the server stores only ciphertext, never your master password or plaintext data. Works fully offline if you never sign in.
- Master-key recovery: reset a forgotten master password using the recovery key issued at signup (vault data preserved via envelope encryption).
- Right-click menu: fill login, generate password, copy TOTP from any field.
- Autofill now requires an explicit host-permission grant (no broad access at install).

FIXED (3.0.1-3.0.4)
- Reliable add/edit of entries after the background worker idles.
- Toolbar icon clarity: greyscale when locked; a per-site badge shows how many saved logins match the current page.

🆕 NEW IN v2.5.8: IN-PAGE GENERATOR, AUTOFILL ON REDDIT
• Click a password field to open a generator overlay — fill without copy-paste
• Toggle passphrase/password, regenerate, auto-fill the confirm field (green outline confirmation)
• Autofill now works on Reddit and web-component login forms (open shadow DOM)
• TOTP QR paste — Ctrl+V a QR image from clipboard in TOTP setup (bypasses popup-closing on drag)
• TOTP QR drag directly from Google/GitHub/GitLab 2FA setup pages

🆕 NEW IN v2.5: USERNAME GENERATOR AND BANK ACCOUNT
• Username generator — third tab in generator: word + number, random string, catch-all email
• Bank account — new record type with IBAN validation (ISO 13616), auto-formatting and SWIFT/BIC field
• Smart autofill — lock icon only appears on pages with saved entries

🌐 v2.3.0 — Multilingual Support

• NEW: Interface in Croatian and English — manual language selection in settings
• NEW: Generator supports Croatian and English word pools with automatic switching
• NEW: English EFF Diceware wordlist (7,776 words) and 329 English idioms
• NEW: Dynamic dialect pills per language (HR: 8 dialects + metaphors, EN: Standard + Idioms)

🔐 GESLAR 2.0 — BESPLATNI PASSWORD MANAGER S HRVATSKIM KORIJENIMA

Geslar je potpuno besplatni password manager koji sve tvoje lozinke, kartice i TOTP ključeve čuva enkriptirane na tvom uređaju. Bez oblaka. Bez računa. Bez praćenja.

⬆ NOVO U v2.0: ŠKRINJA (VAULT)
Verzija 1.5 bila je samo generator fraza. Verzija 2.0 donosi potpuni password manager:

🔑 ŠKRINJA ZA LOZINKE
• AES-256-GCM enkripcija s PBKDF2 (600.000 iteracija)
• Lozinke, kreditne kartice, TOTP ključevi i bilješke — sve na jednom mjestu
• Mape, favoriti, pretraga i povijest lozinki
• Master ključ ostaje samo u RAM-u — nikada se ne zapisuje na disk
• Automatsko zaključavanje nakon neaktivnosti

🤖 AUTOFILL
• Automatsko popunjavanje login formi jednim klikom ili prečacem (Ctrl+Shift+L)
• Pametna detekcija formi — uključujući Google i Microsoft multi-step login
• Prepoznavanje payment formi za kreditne kartice
• Save prompt — Geslar prepoznaje kad uneseš novu lozinku i ponudi spremanje

🔑 TOTP AUTENTIKACIJA (2FA)
• RFC 6238 kompatibilno generiranje kodova (SHA-1, SHA-256, SHA-512)
• Unos putem kamere (QR skeniranje), drag & drop slike ili ručno
• Kružni countdown timer s vizualnim upozorenjem prije isteka

🛡 BIOMETRIJA I PASSKEY
• Otključaj škrinju otiskom prsta ili prepoznavanjem lica (Windows Hello / Touch ID)
• Passkey podrška — Geslar kao WebAuthn credential provider

📥 IMPORT / EXPORT
• Uvoz iz 12 izvora: Bitwarden, Chrome, Edge, Firefox, KeePass, LastPass, 1Password, Safari, Dashlane, NordPass, Proton Pass, Enpass
• Izvoz u 3 formata: Geslar (enkriptirani), Bitwarden JSON, CSV

🔤 GENERATOR LOZINKI I FRAZA
• Passphrase od hrvatskih riječi — lako pamtljive, teško probojne
• 4 hrvatska rječnika (uključujući dijalekte)
• Password generator s 4 razine složenosti
• HIBP provjera curenja (k-Anonymity — nikada se ne šalje cijela lozinka)

📨 SIGURNO SLANJE
• Podijeli lozinku putem enkriptiranog linka (AES-GCM)
• PIN zaštita, ograničen broj pregleda, automatski istek

🔒 SIGURNOST I PRIVATNOST
• Zero-knowledge arhitektura — sve ostaje na tvom uređaju
• Nema korisničkih računa, nema telemetrije, nema kolačića, nema analitike
• Open audit: potpuna pravila privatnosti na geslar.app/privatnost.html
• GDPR compliant — voditelj obrade: Daniel Legin, Hrvatska
• Closed shadow DOM — web stranice ne mogu čitati Geslar UI
• Content Security Policy zaštita

⌨ PREČACI
• Ctrl+Shift+G — otvori Geslar
• Ctrl+Shift+L — autofill na trenutnoj stranici

Geslar je napravljen u Hrvatskoj, za korisnike koji cijene privatnost i sigurnost.
Potpuno besplatan. Bez skrivenih troškova.