Song: https://www.youtube.com/watch?v=gI6fQ2IXMjE
Passbolt 5.16.0 introduces Offline Mode, allowing users to access their credentials when the Passbolt server is unreachable.
Offline mode (Beta)
During server maintenance, data center interventions, or network outages, teams lose access to critical credentials needed to restore systems, if those credentials are locked inside an unreachable Passbolt server.
Offline mode closes this availability gap by providing secure read-only access to essential credentials when the server is unreachable. This ensures business continuity, satisfies compliance mandates for disaster recovery, and eliminates the need for insecure, stale manual exports.
The administrator enables Offline Mode in the administration settings and can use Role-Based Access Control (RBAC) to refine which roles have access.
Individual users allowed to access the capability can then select and mark specific resources within the application to make them available offline. Once marked for offline use, credentials can be accessed directly via the QuickAccess menu in the Passbolt browser toolbar.
Offline storage is limited to a maximum of 1,000 resources per user. The feature currently supports only password and TOTP resource types with encrypted metadata. Upcoming releases will add support for other resource types and the ability to mark resources offline in bulk.
Security Considerations
Offline resources are accessible for 5 minutes per session by default and encrypted information persists in browser storage for up to 7 days without server connectivity. Passbolt Pro allows administrators to adjust both session durations and data retention limits to align with organisational compliance requirements.
Once synchronised, credentials marked for offline access are cached on every browser connected to the same Passbolt account making them available across all devices.
Beta Testing
Because Offline Mode is in Beta and will be undergoing a third-party security review, it should be used for testing purposes only. A follow-up blog post covering its mechanics, limitations, and additional security considerations will be published soon.
We welcome your feedback if you test it on a non-production instance.
Maintenance and security
As usual, this release ships a round of third-party dependency upgrades and security advisory fixes, with no user-visible impact. It also addresses minor bugs reported by the community. Check out the changelog for more information.
Conclusion
Many thanks to everyone who provided feedback, reported bugs, and contributed to making Passbolt better!
Changelog
Added
- PB-52633 Add support for Offline Mode
Fixed
- PB-54100 Fix account recovery notifications are sent to deleted admins
- PB-54504 Fix MissingTemplateException on .json endpoints when X-Requested-With: XMLHttpRequest is set
- PB-54574 Fix lock-wait-timeout on DELETE during group edit that removes a user
Security
- PB-54489 Upgrade phpseclib/phpseclib to 3.0.57 (CVE-2026-84308, AIKIDO-2026-730961)
- PB-54532 Small upgrade for js-yaml
Maintenance
- PB-49136 Update cakephp/migrations package to improve compatibility with PHP 8.5
- PB-53658 Use Request to DTO Mapping to automatic mapping of request data
- PB-53925 Add tests to assert session data do not trigger any code
- PB-54144 Update the Passbolt logo
- Renovate: Update adminer:standalone Docker digest
- Renovate: Update dependency cakephp/cakephp to v5.4.2
- Renovate: Update dependency composer/composer to v2.10.3
- Renovate: Update dependency league/flysystem to v3.35.3