What's new

v2.7.0 — Smart multi-device sync merge

Sync no longer uses "remote wins" full-replace. Devices now merge their token lists intelligently, so adding a token on one device while another is offline (or during a password mismatch) no longer causes data loss.

Merge strategy

• Union merge by token ID — tokens unique to either device are kept
• updatedAt timestamp on every token for conflict resolution (latest edit wins)
• Tombstones for deletions — when you delete a token, a 30-day tombstone prevents it from reappearing from other devices
• Backward compatible — old sync files (v2.1.0) import seamlessly, new files use v2.2.0 format

How it works

• syncToFile now reads the remote backup first, merges with local, then writes the combined result
• restoreFromFile merges instead of replacing when auto-syncing
• Password mismatch recovery also preserves local tokens via merge
• A merge guard prevents sync-triggered re-sync loops

Migration

• Existing tokens get updatedAt stamped on first launch
• Tombstone store initialized automatically
• Expired tombstones (>30 days) pruned on every app startup

Download

macOS — "App is damaged" warning

macOS Gatekeeper will block unsigned apps downloaded outside the App Store. Run this once after downloading:

xattr -d com.apple.quarantine /Applications/Yhtua.app

Or right-click the .dmg → Open → Open anyway on first launch.

Free code signing for distributed desktop apps requires an Apple Developer account ($99/yr). Yhtua is open-source and unsigned — the command above is the standard workaround.

Linux AppImage

The AppImage is patched for Wayland compatibility. If it doesn't launch, try:

chmod +x Yhtua_*.AppImage && ./Yhtua_*.AppImage

What's new

v2.6.2 — Sync reliability & polish

• Fix: skip sync when token list is empty (prevented overwriting backup on fresh install)
• Fix: encrypted backup import from the create page
• Fix: ensure encryption key exists before re-encrypting during restore
• Fix: backup setup banner now hides immediately after configuring sync (no restart needed)
• Polish: smoother page transitions and timer animation

v2.6.0 — Security & UX overhaul

Security

• Encryption key stored in OS-scoped localStorage (no longer in keychain — no UAC/admin prompts)
• HMAC-SHA256 signature on every sync backup, verified on restore
• Clipboard auto-clear after 500ms + on app blur
• Decrypted secret cache expires after 30s + cleared on blur

UX

• Sync page UI polish with import preview
• Duplicate label detection
• 7-day backup re-prompt (no more nagging)
• Better error messages across sync and import flows
• 7-digit code formatting support
• Onboarding fix for first-time setup

Performance

• Search debounce 150ms
• Sort optimization
• Retry backoff on sync failures

v2.5.0 — Full UI refresh & new features

• Dark vault theme with per-token avatar colors
• Circular SVG countdown timer on token detail
• "Restore from backup" option when encryption key is lost
• Backup setup prompt for first-time users
• PBKDF2 iterations aligned to 600,000 everywhere
• Minimum 8-character password enforced for sync and export
• `crypto.randomUUID()` replaces `Math.random()` for token IDs
• Astro landing page with animated TOTP mockup

Download

macOS — "App is damaged" warning

macOS Gatekeeper will block unsigned apps downloaded outside the App Store. Run this once after downloading:

```bash
xattr -d com.apple.quarantine /Applications/Yhtua.app
```

Or right-click the `.dmg` → Open → Open anyway on first launch.

Free code signing for distributed desktop apps requires an Apple Developer account ($99/yr). Yhtua is open-source and unsigned — the command above is the standard workaround.

Linux AppImage

The AppImage is patched for Wayland compatibility. If it doesn't launch, try:

```bash
chmod +x Yhtua_.AppImage && ./Yhtua_.AppImage
```

See the assets to download and install this version.

What's Changed

• 📦 release: v1.0.2
• feat: add remove all token by @iiAku in #2

Full Changelog: v1.0.1...v1.0.2