Claspt v2 is
live today

Today is the day. The v2 wave that has been building since mid-April is now public. The browser extension v2.1.4 just passed Chrome Web Store review and is live for Chrome, Edge, Brave, and Arc. Desktop v2.0.3 is downloadable for macOS, Linux, and Windows right now — the Microsoft Store build is the recommended path on Windows, with direct .msi / .exe as a fallback. Mobile builds are still queued with Apple and Google.

This is the largest release Claspt has ever shipped. The browser extension turned from a pure auto-fill tool into a full credential manager. The desktop app stopped asking you to think about saving. Mobile became a real first-class platform instead of a viewer. And the parts that always mattered — the encryption model, the markdown-first vault, the no-account-required default — did not change one bit.

Browser extension v2.1.4 — full credential management in the popup

Until v2, the extension was an auto-fill front-end for the desktop vault. With v2.1.4 it is a credential manager you can drive end-to-end without ever opening the desktop app.

• Edit credentials inline. Username, password, TOTP, URL, and custom fields are all editable directly in the popup. Saving one field never disturbs the others — the data model is field-scoped, not blob-scoped.
• Auto-detect password rotation. Fill a credential, submit a form with a different password, and a save bar offers "Update password for X" with one click. No more silently overwriting and no more wondering whether the old password is still anywhere.
• Password generator with presets. Easy 12 · Strong 20 · Long 32 · Passphrase · PIN, plus exclude-ambiguous and exclude-problematic toggles. Per-login generation history is hashed locally with Web Crypto so the previous values are recoverable for a configurable window (1–30 days, default 7) and never leave your device.
• Reused-password warning. Per-row badge plus a banner with the total count when one password covers more than one login. All hashing happens locally; nothing about your passwords leaves the browser.
• Multi-credential workflow. Mark one as primary (the ☆ auto-fill prefers it), retire legacy logins as deprecated, and pin / last-used sort across the popup and the inline picker. If your bank shows you ten old logins on the saved-passwords list, this is the feature that finally cleans that up.
• Per-item URL match policy. Base domain · Exact hostname · Exact URL · Never auto-fill, picked per credential. Subdomain login? Set it to Exact hostname. Internal admin tool you never want auto-filled? Set it to Never.
• Clickjacking-hardened inline picker. Closed shadow DOM, isolated styles, and a refusal to render in cross-origin iframes — the kind of hardening that addresses the password-manager research published in 2025.

One install link gets the same build for every Chromium browser:

Desktop v2.0.3 — automatic sync, real save states, no more guessing

Desktop v2.0.3 is the version where saving stops being your job. Before today, you had to remember Sync now. After today, every change you make reaches the server in roughly twenty seconds and you can watch it happen in the title bar.

• Automatic sync after every change. Edit a page, your change reaches the server in around twenty seconds — no manual Sync now. Rapid edits collapse into a single server version, so version history stays clean instead of ballooning into one entry per keystroke.
• Three save states in the title bar. Unsaved (grey dot), Saving (pulsing gold), Saved (green check). The "is it actually saved?" anxiety that every notes app has somehow inherited from Word 2003 is just gone.
• Editor stays in sync with external writers. If the browser extension or sync changes a credential while the page is open, the editor re-reads it cleanly so autosave can never silently undo someone else's write. This was the single most reported source of "where did my edit go?" reports across mobile, desktop, and extension — resolved in v2.
• Multi-device unlock, rock solid. Every unlock path — password or biometric — restores the full key material needed to read and sync. Other devices will always decrypt what you push, regardless of which path you used to unlock.
• Portable exports. Vault exports are now plain, portable markdown. Open them in any other markdown editor without conversion, walk away from Claspt at any time and your notes still work.

Mobile v2.0.0 — nested folders, real search, auto-lock

Mobile gets the biggest jump. The 1.x line on iOS and Android could read a vault but always felt one step behind desktop. v2.0.0 closes that gap. The builds are queued with Apple and Google — we will post here when they roll out.

• Auto-pull on foreground — the app pulls new changes when you bring it forward and again every 60 seconds while open. Open the app on the train, your morning desktop edits are already there.
• Full nested folder hierarchy. Pages, Tags, Secrets, and Search all walk the vault tree recursively, so nothing inside a subfolder is hidden any more.
• Search overhaul. Unicode-aware tokenizer, AND→OR fallback for partial matches, substring toggle, scope picker (notes / secrets / both), and a reindex tool when something looks off.
• Auto-lock with configurable timeout + foreground / background-aware idle timer, so the vault locks correctly whether you switched apps or just stopped typing.
• Auto-enable biometric unlock on first password unlock (opt-out available) so subsequent unlocks are a single touch.
• Caps-lock hint and password visibility toggle on the unlock screen — the most common causes of mobile "wrong password" surprises, finally addressed.

Reliability and safety

Beyond the headline features, this wave fixes a handful of issues worth calling out specifically:

• Windows: invisible-window-after-restore is fixed. The saved window rect is now validated against the current monitor set before being restored, and the window re-asserts focus reliably on every code path.
• Windows: unlock no longer deadlocks on multi-device sync — full-vault sync after first unlock is now reliable.
• Vault.key and license.token are excluded from git, fixing a path where they could leak to a third-party git remote on a git-synced vault. If you have ever pushed a Claspt vault to GitHub or a similar host, rotate that remote's credentials. This is the one item in this post worth reading twice.

Where to download Claspt today

What did not change

The vault format is unchanged across the v1 → v2 line. There is no migration on first launch from any earlier 1.x build — your existing vault just opens. AES-256-GCM encryption with per-block nonces and Argon2id key derivation is exactly the same. Free is still free on desktop forever, no account, no cloud unless you turn it on. The thing you trusted in v1 is the thing you are trusting in v2.

What changed is that the rough edges around it are gone. Browser-side editing works. Desktop sync just happens. Mobile is a real surface for using your vault, not just reading it. If you have been waiting for Claspt to be the thing you replace 1Password with, today is the day to take another look.

The full v1.7.45 → v2.0.3 changelog is on the changelog page if you want every detail.