Web PKI changelog

Component	Latest version	Date
JavaScript library	2.19.0	2026-10-17
Web extension	2.19.1	2026-10-17
Native component for Windows	2.16.0	2026-07-27
Native component for macOS	2.16.0	2026-07-27
Native component for Linux	2.16.1	2026-10-17
Mobile app	5.0.6	2026-10-13
IE add-on (legacy)	2.9.2	2024-04-05

JavaScript library

The Web PKI JavaScript library, distributed on the CDN as lacuna-web-pki.js and on npm as the web-pki package (same version).

2.19.0 (2026-10-17)

• Add support for Safari on macOS through the Web PKI Safari extension.
• Add API version 1.8.7 (native components 2.15.0 for Windows, macOS and Linux).
• [WPG-70] Require native components 2.15.0 for Windows, macOS and Linux.
• [WPG-70] Require web extension 2.16.0.

Older versions

2.18.0 (2026-02-03)

• [WPG-67] Return the system user name and machine name (userName, machineName) in the generateSoftwareRsaKeyPair and generateTokenRsaKeyPair responses.
• [WPG-67] Add API version 1.8.6 (native components 2.14.0 for Windows, macOS and Linux).
• [WPG-67] Require native components 2.14.0 for Windows, macOS and Linux.
• Add the missing pkcs11ModuleUsed field to the GenerateTokenKeyPairResponse TypeScript definition.

2.17.0 (2026-01-26)

• [WPG-66] Add the caCertificates option to importCertificate and importTokenCertificate to also import the CA certificate chain into the system CA store and into the token or PFX file (Windows only).
• [WPG-66] Add API version 1.8.5 (Windows native component 2.13.2).
• [WPG-66] Require Windows native component 2.13.2.

2.16.5 (2025-11-10)

• Add API version 1.8.4 (Windows native component 2.12.7).
• Require Windows native component 2.12.7.

2.16.4 (2025-10-02)

• Add API version 1.8.3 (Windows native component 2.12.6, macOS native component 2.13.5).
• Require Windows native component 2.12.6 and macOS native component 2.13.5.

Web extension

The Web PKI browser extension for Chrome, Edge, Firefox and Safari.

2.19.1 (2026-10-17)

• Add Safari support (Safari 14 or later on macOS), distributed as a macOS app on the App Store.
• Declare in Firefox that the extension transmits personal information, location information and website content (certificate contents and the data to sign or encrypt), as required by Mozilla.

Older versions

2.18.3 (2026-08-08)

• [WPG-80] Bundle the popup fonts in the extension instead of loading them from external servers.

2.18.2 (2026-08-06)

• [WPG-73] Reject commands from web pages that the extension does not handle explicitly (error code command_unknown) instead of forwarding them to the native component.
• Shorten the waiting time after the user denies certificate access: the first denials block new requests for about 2 seconds, later ones up to 5 minutes, and the count resets after 10 minutes without requests.
• Disable usage analytics in the popup on all browsers, and in the Edge extension.

2.18.0 (2026-07-20)

• [WPG-73] Ask the user's permission, per website, before a page can list the user's certificates or read a certificate (listCertificates, readCertificate), with an option to not ask again for that website. Repeated denials are answered automatically for a while, so a page cannot flood the user with dialogs. Older native components without the dialog keep working without asking.
• [WPG-73] Ignore PKCS#11 module paths supplied by web pages unless they are a library file name or a library under a system or program directory. Modules configured by the user are not affected.
• [WPG-73] Fix the detection of the website hostname for some URL formats.
• [WPG-70] Fix commands sent with a different letter case bypassing the extension's own command handling.
• [WPG-71] Fix an unchecked browser error when the native component disconnects after the page is closed.
• [WPG-76] Require Firefox 140 or later, and declare the extension's data collection in Firefox.
• Update the Edge extension to Manifest V3.
• Return the complete native response from generateTokenRsaKeyPair and importTokenCertificate.

2.17.3 (2025-07-16)

• [WPG-53] Require Firefox 58 or later.

2.17.1 (2024-07-21)

• Fix the setup site not being refreshed after the extension is installed from the store.

2.17.0 (2024-07-04)

• Update the Chrome extension to Manifest V3.
• Add the signHashes command, which signs several hashes in a single call.
• Add support for decrypting with a certificate on a paired mobile device.
• Add the enableUsedPkcs11Module option to generateTokenRsaKeyPair and importTokenCertificate, to not save the PKCS#11 module used in the user's settings.
• Add support for the new signature options: PDF reason, location, signer name, custom signature field name and metadata; CAdES co-signing from content and signing description; XML signing description; timestamp requester; and returning the encapsulated content when opening a CAdES signature.
• Fix the PKI Paraguay "Responsable" field being shown for certificates that are not issued to a legal entity.
• Fix the popup staying blocked after removing a mobile device.

Native component for Windows

The Windows application that the Web PKI browser extension uses to access certificates, tokens and local files.

2.16.0 (2026-07-27)

• [WPG-73] Add the consent dialog (Allow, Always allow, Deny) that the web extension shows before a website can list or read the user's certificates.
• [WPG-73] importPkcs12 now opens the certificate import wizard only when invoked from the extension popup (or localhost); requests from other websites return false without showing it.

Older versions

2.15.0 (2026-06-16)

• [WPG-75] Fix downloadToFolder not saving to the requested folder, a regression in 2.14.2.

2.14.2 (2026-05-18)

• [WPG-70] Require a valid license (outside localhost) for showFolderBrowser, showFileBrowser, downloadToFolder, openFile, openFolder, listTokens and encrypt.
• [WPG-70] Sanitize file names given by websites in downloadToFolder and when saving signed files and PKCS#12 (PFX) backups: path traversal, invalid characters, Windows reserved names and overlong names are neutralized.
• [WPG-70] Save files downloaded with downloadToFolder that have an executable, script or installer extension (such as .exe, .bat, .ps1, .msi, .lnk) with a .bin extension instead.

2.14.0 (2026-02-03)

• [WPG-67] Add userName and machineName to the responses of generateKeyPair and generateTokenKeyPair.
• [WPG-67] Fix the PKCS#12 (PFX) password dialog opening behind other windows.

2.13.3 (2026-01-27)

• Fix the PKCS#12 (PFX) password dialog rejecting an empty password when the website sets no password requirements (regression in 2.13.2).

2.13.2 (2026-01-26)

• [WPG-66] Add the caCertificates parameter to importCertificate and importTokenCertificate: the CA chain is added to the Windows CA store and to the PKCS#12 (PFX) backup or the token.
• Improve the PKCS#12 (PFX) password dialog: each password requirement is listed and checked as the user types, and the password can be shown or hidden.

2.12.7 (2025-11-10)

• [WPG-65] Require .NET Framework 4.6 or later (previously 4.0).

2.12.6 (2025-10-02)

• [WPG-59] [WPG-60] Treat *.localhost domains (RFC 6761) as localhost, so they can use Web PKI without a license.
• [WPG-61] Fix importCertificate failing when an unrelated key container could not be opened while searching for the certificate's private key.
• Fix saving the PKCS#12 (PFX) backup in importCertificate, and report imported as false when the certificate could not be added to the Windows store.

Native component for macOS

The native application that the Web PKI extension uses on macOS to access certificates, tokens and local files.

2.16.0 (2026-07-27)

• [WPG-73] Add a consent dialog that asks the user before a website lists or reads their certificates, with a "don't ask again for this website" option.
• [WPG-73] Restrict importing PKCS#12 files and removing certificates to the Web PKI extension popup.
• [WPG-79] Improve the look of all dialogs.
• [WPG-79] Require macOS 10.15 (Catalina) or later on Intel Macs.

Older versions

2.15.0 (2026-06-16)

• Add native support for Apple Silicon (arm64) Macs, with a dedicated installer.
• [WPG-72] Hide the app from the Dock while it runs in the background; it appears only while a dialog is open.
• [WPG-75] Fix downloadToFolder failing for some folder paths (regression in 2.14.2).

2.14.2 (2026-05-18)

• [WPG-70] Require a license for the commands that access local files and folders (file and folder browsers, downloadToFolder, openFile, openFolder), and for listTokens and encrypt.
• [WPG-70] Improve the safety of downloadToFolder: the file name is sanitized against path traversal and invalid characters, and files with an unsafe extension are saved as .bin.

2.14.0 (2026-02-03)

• [WPG-67] Add the user name and machine name to the generateKeyPair and generateTokenKeyPair responses.
• [WPG-67] Add support for importing the CA certificates of the chain together with the user certificate in importCertificate and importTokenCertificate.
• Improve the protection of private keys generated by generateKeyPair while they wait for the certificate to be imported.

2.13.5 (2025-10-02)

• [WPG-59] [WPG-60] Improve the detection of localhost domains, which can use Web PKI without a license.
• Fix listCertificates failing entirely when a PKCS#11 token cannot be read.
• Fix importCertificate offering to save the PKCS#12 backup without a password when the user cancels the password dialog.

Native component for Linux

The native application that the Web PKI extension uses on Linux to access certificates, tokens and local files, distributed as .deb and .rpm packages.

2.16.1 (2026-10-17)

• [WPG-82] Fix the package failing to install on Ubuntu 26.04 and Debian 12/13 (newer libicu versions).
• [WPG-85] Fix the .rpm package not registering the browser integration on systems without sudo (such as minimal Fedora, RHEL and Rocky Linux installs), and not removing it on uninstall.

Older versions

2.16.0 (2026-07-27)

• [WPG-73] Add a consent dialog that asks the user before a website lists or reads their certificates, with a "don't ask again for this website" option.
• [WPG-73] Restrict importing PKCS#12 files and removing certificates to the Web PKI extension popup.
• [WPG-73] Fix the app crashing when opening a file or folder dialog on Ubuntu 24.04 and newer.
• [WPG-73] Fix the .deb package not registering the browser integration on systems without sudo.
• [WPG-73] Declare the required system libraries (ICU, OpenSSL, X11, fontconfig) as dependencies of the .deb and .rpm packages, so they are installed with the package.
• [WPG-79] Improve the look of all dialogs.

2.15.0 (2026-06-16)

• [WPG-75] Fix downloadToFolder failing for some folder paths (regression in 2.14.2).

2.14.2 (2026-05-18)

• [WPG-70] Require a license for the commands that access local files and folders (file and folder browsers, downloadToFolder, openFile, openFolder), and for listTokens and encrypt.
• [WPG-70] Improve the safety of downloadToFolder: the file name is sanitized against path traversal and invalid characters, and files with an unsafe extension are saved as .bin.

2.14.0 (2026-02-03)

• [WPG-67] Add the user name and machine name to the generateKeyPair and generateTokenKeyPair responses.
• [WPG-67] Add support for importing the CA certificates of the chain together with the user certificate in importCertificate and importTokenCertificate.
• Improve the protection of private keys generated by generateKeyPair while they wait for the certificate to be imported; the key files are now readable only by the user.
• [WPG-59] [WPG-60] Improve the detection of localhost domains, which can use Web PKI without a license.
• Fix listCertificates failing entirely when a PKCS#11 token cannot be read.
• Fix importCertificate offering to save the PKCS#12 backup without a password when the user cancels the password dialog.

Mobile app

The Web PKI app for Android and iOS, which lets web pages sign with the certificates on the phone, by QR code, deep link or a paired computer.

5.0.6 (2026-10-13)

• [WPG-78] Rewrite the app in Flutter for Android and iOS, replacing the previous app. Upgrading keeps your certificates, paired computers and favorite signer.
• [WPG-78] Add dark mode.
• [WPG-78] Improve biometric authentication: a successful prompt now covers further signatures for 2 minutes only for the same site and paired computer, and only while the app is open on screen.
• [WPG-78] Ask for notification permission on first launch and on every computer pairing, and offer to open the app settings when it was denied, so signature requests from paired computers are not missed.
• [WPG-78] Allow unpinning the favorite signer (the star button is now a toggle).
• [WPG-78] Fix the QR code scanner possibly failing without showing an error.

IE add-on (legacy)

The legacy Web PKI add-on for Internet Explorer on Windows.

2.9.2 (2024-04-05)

• Maintenance release.

Earlier releases are not documented in this changelog.