Geslar
What's new
Changes, improvements and fixes by version.
What's coming next
Cloud sync
Optional Škrinjar sync between devices — end-to-end encrypted, zero-knowledge server.
Geslar Ključar
Mobile TOTP/HOTP authenticator (Android + iOS) — local encryption, biometric unlock.
Family & Teams
Shared vault for families and teams — each member has their own key, admin manages access.
All changes
Biometrics hardening + fixes security
- Biometrics — PRF support check, HKDF random salt, origin validation, cleanup on key change security
- Biometrics hidden on Firefox (PRF not supported) fix
- Preventing duplicate ceremony window fix
- Škrinjar Health — navigation fix and last check display fix
- HIBP — added User-Agent header fix
Geslar Škrinjar — password manager major upgrade
- Password vault — AES-256-GCM encryption, PBKDF2 (600,000 iterations), everything local on device new
- Autofill — automatic login and payment form filling, save prompt, multi-step login (Google, Microsoft) new
- TOTP 2FA — generate authentication codes, QR scanning, countdown timer new
- Credit cards — save and auto-fill card details new
- Biometric unlock — Windows Hello / Touch ID (WebAuthn PRF) new
- Passkey support — Geslar as WebAuthn credential provider new
- Import from 12 sources — Bitwarden, Chrome, Edge, Firefox, KeePass, LastPass, 1Password, Safari, Dashlane, NordPass, Proton Pass, Enpass new
- Export — Geslar encrypted JSON, Bitwarden JSON, CSV new
- Škrinjar Health — analysis of weak, reused, old and compromised passwords new
- Secure Send — encrypted links with PIN, expiry and view limit new
- Lucide icon system — 28 uniform SVG icons improved
- Performance optimizations — virtual scroll, search debounce, HIBP batch check improved
- Accessibility audit — WCAG AA, aria attributes, keyboard navigation, focus management improved
English language + multilingual website generator
- English website — complete EN version of all 15 pages with dedicated URLs (
/en/), multilingual engine implemented and EN version deployed new - English phrase dictionary — EFF 7,776 words + 329 English idioms for passphrase generation new
- Language picker — HR/EN toggle in the accessibility panel with automatic preference saving new
- Automatic language detection — system automatically detects browser language and redirects to the appropriate version new
Croatian letters in phrases and passwords generator
- New s→š option in Settings — replaces Croatian letters with ASCII equivalents in phrases (š→s, đ→d, č→c, ć→c, ž→z) and enables more dictionary words new
- Same šđčćž option for passwords — adds Croatian letters to the character set for password generation new
Metaphors + browser extension generator
- New Dictionaries → Metaphors option — generates passphrase from 1500+ Croatian idioms, phrases and poetic expressions new
- Metaphors are exclusive with dialect dictionaries — selecting them automatically unchecks others new
Secure message + contact + improvements
- Secure message — send encrypted text via one-time link, zero knowledge new
- New Contact page — LinkedIn profile and contact form for direct message to author new
- Word count shows direct number of words (2–6) instead of abstract level improved
- PWA shortcuts — quick access to Generator, Security and Contact from home screen new
Dialect dictionaries — Croatian dialects
- New Dictionaries section in settings — select active dictionaries new
- Added 8 dialect dictionaries: Chakavian, Dalmatian, Dubrovnik, Istrian, Kajkavian, Međimurje, Slavonian, Zagorje new
- Each dictionary can be independently enabled/disabled in Settings → Dictionaries new
- Standard and dialect dictionaries can be combined or used separately new
UI redesign + confirmation step for sharing
- New interface: minimalist "Clean & Spacious" style — Inter font, navy/white palette with more space, rounded shadows and cards new
- Inline navigation in header on desktop; hamburger menu on mobile devices new
- Modes (Phrases / Passwords / Check Password) shown as full-width pill tabs — "Check Password" visually highlighted as separate function improved
- Confirmation step: "Confirmation step" option in modal — recipient must click "Show password" button before content is revealed new
- Separate "What's new" page with complete changelog new
Publicly released version publicly released
- PIN protection: optional 4–8 digit PIN when sending — recipient must enter PIN to see password new
- Zero-knowledge PIN: PBKDF2 (200,000 iterations, SHA-256) + AES-GCM enveloping — PIN never leaves device, server never sees it new
- One-time link: toggle in modal — deletes link immediately on first view; "⚡ One-time" badge in result new
- Notification on receive page that link has been deleted (last allowed view) new
- Timeout (8–10s) on all network requests — specific error message on timeout new
- Security HTTP headers on API responses: X-Content-Type-Options, Cache-Control, CORS, Referrer-Policy new
- Modal dialogs got
role="dialog",aria-modal,aria-labelledby; SVG elementsaria-hiddenimproved - XSS protection in error messages on receive page fix
- File size limit for custom dictionary — maximum 2 MB new
- Rate limiting for secure link retrieval (120 requests/hour per IP) new
- QR code for secure link: ▦ QR button in share modal shows QR code for scanning — no need to type the link new
- Automatic link regeneration: changing expiry, view count, one-time link or PIN immediately generates new link without re-clicking new
Generator foundations July to December 2025
- Phrase generator — 1500+ Croatian words, word count stepper (2–6), separators, uppercase, numbers, special characters new
- Password generator — random passwords with guaranteed character sets, levels from 8 to 32 characters new
- Bulk generation — up to 20 passwords at once with individual copy and QR code new
- Secure Send — AES-256-GCM encryption, zero-knowledge server, short links with view limit and expiry new
- Breach check — HIBP k-anonymity password compromise check new
- Sharing — QR code, Web Share API, password description visible on receive new
- Keyboard shortcuts — C copy, L link, 1/2 mode, ? help new
- PWA — device installation, offline mode, service worker new
- Accessibility — panel with theme, font size, high contrast and reduced motion new
- Clipboard protection — 60s countdown with "Clear now" and "Keep" options new
- Security & Tips page — password guide, 2FA, recommended managers new
- Dark and light theme, generation animations, responsive design, logo and visual identity improved
- XSS protection, rate limiting, security HTTP headers, CORS protection fix
Take control of your passwords
Military-grade encryption, local, free with no limits.