What’s in Passbolt 5.17.0?
Passbolt 5.17.0 “Mad World” introduces passkeys for multi factor authentication, improves autofill reliability across websites, makes permission changes easier to review when moving resources, and brings PIN code resources to QuickAccess. This release also includes security fixes and performance improvements.
Passkeys for MFA
Passbolt 5.17 adds passkeys as a second authentication factor, alongside the TOTP, Yubikey OTP and Duo providers that are already supported. It answers a requirement that many organisations now include in their procurement processes: multi-factor authentication that resists phishing, which one-time codes cannot provide.
Built on the WebAuthn/FIDO2 standard, it is bound to the domain of the Passbolt instance, and the browser refuses to use it anywhere else, so a lookalike site has nothing to capture. Basically, one-time code can be typed into a fake login page and relayed to the real site by an attacker. Passkeys cannot be used this way and protects against this kind of phishing.
Passkeys are available in every edition. Once an administrator enables them in Administration > Multi-factor authentication, each user can register up to ten passkeys from Profile > Multi-factor authentication, using a security key such as a YubiKey or the biometrics built into their laptop, phone, such as Touch ID or Windows Hello.
From then on, Passbolt asks for the passkey right after sign-in, as it does for the other providers. Users can tick “Remember this device for a month” to skip the check on a trusted device, or leave it unticked to verify every time. Organisations using Passbolt Pro edition, and wanting a stricter posture can disable this option in the Multi-factor authentication policy settings, so that every sign-in requires the passkey.
This first step covers multi-factor authentication. Storing passkeys for third-party websites as a resource type and Passwordless sign-in to Passbolt will follow in upcoming releases.
A new autofill detection engine
Autofill is a core part of the Passbolt browser experience, and version 5.17 rebuilds its detection engine from scratch. It tackles two familiar frustrations: no autofill on a form that clearly needs it, and an autofill icon in a field that has nothing to do with credentials.
Getting this right is harder than it looks, because no two websites build their forms the same way. Field names differ, labels come in many languages, and the underlying code varies widely from one site to the next. A handful of regular expressions could only go so far, and the previous engine had reached its limits.
The new engine understands the context of each field, from the structure of the form to the labels around it, before deciding whether to step in. The first benchmarks are very promising: on our internal test set, form detection rises from 74% with the previous engine to 93.4%, while processing cost stays low.
A test set is not the web, though, and this is where the community comes in: we are eager to hear how the engine behaves on the websites our users rely on every day. For those curious about the inner workings, a detailed blog post will follow.
Safer permission handling during resource moves
Passbolt 5.17 brings the permission review introduced in 5.14, to moves of resources and folders. Creating a resource in a shared folder, editing a shared resource and now moving items all ask for the same explicit confirmation.
A move needs this step because placing a resource in a shared folder, or taking it out of one, can change who has access to it. Previously, users chose between keeping the current permissions and applying those of the destination folder, without seeing what either option would produce. Getting it right meant anticipating the outcome, which could be confusing.
From this version, every move follows the destination folder strategy: permissions inherited from the origin parent folder are removed, and those of the destination folder take their place. Before saving, Passbolt shows who will gain, lose or keep access, and this proposal can be refined with the usual granular control, one user or group at a time. Nothing changes until the user confirms, and the operation can still be cancelled.
Access PIN Codes through QuickAccess
This release brings PIN codes to QuickAccess. Users no longer need to switch to the web workspace to retrieve door codes or device PINs.
PIN codes also inherit offline availability, using the same security and synchronization controls as other secrets, as described in the Offline Mode blog post.
This is part of a broader effort to expand QuickAccess and Offline Mode support to all remaining resource types in upcoming releases.
Large organization group management performance
The release also tackles one of the most requested improvements on adding a user to a large group with many shared resources. This operation is now more than twice as fast and is achieved through optimizing the underlying database queries. This cuts the wall time for adding a user to a group having access to 300 resources from 1.19 seconds to 514 milliseconds. Now, administrators can spend less time waiting when onboarding users or reorganizing access in large groups with many shared resources.
Security Improvements
Passbolt 5.17.0 brings targeted security improvements and hardening measures resulting from internal assessments and external research.
-
Safer Cookie Handling in Safari: Cookie management within the Safari extension is strengthened following insights from the recent Cure53 audit. Cookies are now more strictly isolated preventing them from being unintentionally exposed to other hosts
-
Clipboard Auto-Clear Protection: Thanks to a report from external researcher Alex J, an edge case has been fixed where a malicious website could intercept, copy or cut events to cancel the clipboard-clearing timer. Copied secrets are now reliably cleared from the clipboard as intended.
-
SCIM Token Enforcement (Pro Edition): Expired SCIM bearer tokens are now strictly rejected to prevent unauthorized ongoing access to provisioning endpoints. Administrators also receive proactive health checks and daily notifications, when the token is used and nearing expiration.
A dedicated security bulletin will be published soon. It will provide more details on each of the resolved issues, including their potential impact and how they were addressed.
Updating to Passbolt 5.17.0 is recommended to benefit from these security improvements.
Conclusion
Many thanks to everyone who provided feedback, reported bugs and contributed to making Passbolt better.
Changelog
Platform: Browser Extension & API
Name: Mad World | Browser Extension & API
Release notes: https://www.passbolt.com/changelog/api-bext/mad-world-browser-extension-api
Release Date: October 20, 2026
Song: 
Mad World
Enjoy Passbolt? Leave us a 
review:
Chrome | Firefox | Edge | Safari | iOS | Android | Windows
Thank you to everyone who tested, reported, and shaped this release.
Your feedback helps keep Passbolt simple, secure, and open. 