🔐 GESLAR VAULT — End-to-end encrypted password manager (E2EE)
Geslar keeps your passwords, cards and TOTP keys encrypted on your device. It works locally, no account needed — and when you want, add sync and family sharing over an encrypted cloud that cannot read your data.
🆕 NEW IN v3.1.2

Family account recovery — if a family member loses their master password, an organizer can restore their access. Opt-in (the owner enables it, the member consents), end-to-end encrypted — the server never sees your keys.
Two-factor sign-in (2FA) — sign in and sync with a TOTP (authenticator) code or a backup code, in both the extension and the web vault.

RECENTLY: Shared Vault (Family), cross-device sync (Premium), the my.geslar.app web console, entry tags, and in-app purchase of Premium/Family — all E2EE.
✅ WHY GESLAR?

Local-first — works with no account and no internet
Cloud is optional — sync and sharing when you need them (Premium/Family), still E2EE
No telemetry — zero tracking, zero cookies
Free for basic use; Premium and Family for sync and sharing
Fully localized (English & Croatian)

🔑 FEATURES

AES-256-GCM encryption with PBKDF2 (600,000 iterations)
One-click password autofill, or Ctrl+Shift+L
Password and passphrase generator
Two-factor account sign-in — TOTP + backup codes
Family account recovery — an organizer can restore a member's access (opt-in, E2EE)
TOTP 2FA generator for your saved sites (SHA-1, SHA-256, SHA-512)
Wi-Fi, cards, notes, SSH keys, identities, bank accounts
Entry tags + search
Biometric unlock (Windows Hello / Touch ID)
Passkey support (WebAuthn)
Import from CSV and other managers, export in 3 formats
Send — share a password via an encrypted link
Password breach check against HIBP (k-Anonymity)
Sync and Shared Vault (Premium/Family)

🔤 PASSPHRASE GENERATOR

Passphrases from English or Croatian words — easy to remember, hard to crack
English EFF Diceware (7776 words) + idioms; 8 Croatian dialects + metaphors
EN/HR switching with automatic option adjustment
Password generator with 4 complexity levels

🛡️ SECURITY

Zero-knowledge architecture (E2EE) — the server cannot read your data
Master key kept in RAM only
Closed shadow DOM isolation
Content Security Policy protection
GDPR compliant — data controller based in Croatia (EU)

⌨️ SHORTCUTS

Ctrl+Shift+G — open Geslar
Ctrl+Shift+L — autofill on the current page

Made in Croatia, for people to whom privacy is a right, not an option.

v3.0.4 — Optional end-to-end encrypted cloud sync

NEW SINCE 2.5.x
- Cloud sync (opt-in): register an account to sync your vault across devices. End-to-end encrypted — the server stores only ciphertext, never your master password or plaintext data. Works fully offline if you never sign in.
- Master-key recovery: reset a forgotten master password using the recovery key issued at signup (vault data preserved via envelope encryption).
- Right-click menu: fill login, generate password, copy TOTP from any field.
- Autofill now requires an explicit host-permission grant (no broad access at install).

FIXED (3.0.1-3.0.4)
- Reliable add/edit of entries after the background worker idles.
- Toolbar icon clarity: greyscale when locked; a per-site badge shows how many saved logins match the current page.

🆕 NEW IN v2.5.8: IN-PAGE GENERATOR, AUTOFILL ON REDDIT
• Click a password field to open a generator overlay — fill without copy-paste
• Toggle passphrase/password, regenerate, auto-fill the confirm field (green outline confirmation)
• Autofill now works on Reddit and web-component login forms (open shadow DOM)
• TOTP QR paste — Ctrl+V a QR image from clipboard in TOTP setup (bypasses popup-closing on drag)
• TOTP QR drag directly from Google/GitHub/GitLab 2FA setup pages

🆕 NEW IN v2.5: USERNAME GENERATOR AND BANK ACCOUNT
• Username generator — third tab in generator: word + number, random string, catch-all email
• Bank account — new record type with IBAN validation (ISO 13616), auto-formatting and SWIFT/BIC field
• Smart autofill — lock icon only appears on pages with saved entries

🌐 v2.3.0 — Multilingual Support

• NEW: Interface in Croatian and English — manual language selection in settings
• NEW: Generator supports Croatian and English word pools with automatic switching
• NEW: English EFF Diceware wordlist (7,776 words) and 329 English idioms
• NEW: Dynamic dialect pills per language (HR: 8 dialects + metaphors, EN: Standard + Idioms)

🔐 GESLAR 2.0 — BESPLATNI PASSWORD MANAGER S HRVATSKIM KORIJENIMA

Geslar je potpuno besplatni password manager koji sve tvoje lozinke, kartice i TOTP ključeve čuva enkriptirane na tvom uređaju. Bez oblaka. Bez računa. Bez praćenja.

⬆ NOVO U v2.0: ŠKRINJA (VAULT)
Verzija 1.5 bila je samo generator fraza. Verzija 2.0 donosi potpuni password manager:

🔑 ŠKRINJA ZA LOZINKE
• AES-256-GCM enkripcija s PBKDF2 (600.000 iteracija)
• Lozinke, kreditne kartice, TOTP ključevi i bilješke — sve na jednom mjestu
• Mape, favoriti, pretraga i povijest lozinki
• Master ključ ostaje samo u RAM-u — nikada se ne zapisuje na disk
• Automatsko zaključavanje nakon neaktivnosti

🤖 AUTOFILL
• Automatsko popunjavanje login formi jednim klikom ili prečacem (Ctrl+Shift+L)
• Pametna detekcija formi — uključujući Google i Microsoft multi-step login
• Prepoznavanje payment formi za kreditne kartice
• Save prompt — Geslar prepoznaje kad uneseš novu lozinku i ponudi spremanje

🔑 TOTP AUTENTIKACIJA (2FA)
• RFC 6238 kompatibilno generiranje kodova (SHA-1, SHA-256, SHA-512)
• Unos putem kamere (QR skeniranje), drag & drop slike ili ručno
• Kružni countdown timer s vizualnim upozorenjem prije isteka

🛡 BIOMETRIJA I PASSKEY
• Otključaj škrinju otiskom prsta ili prepoznavanjem lica (Windows Hello / Touch ID)
• Passkey podrška — Geslar kao WebAuthn credential provider

📥 IMPORT / EXPORT
• Uvoz iz 12 izvora: Bitwarden, Chrome, Edge, Firefox, KeePass, LastPass, 1Password, Safari, Dashlane, NordPass, Proton Pass, Enpass
• Izvoz u 3 formata: Geslar (enkriptirani), Bitwarden JSON, CSV

🔤 GENERATOR LOZINKI I FRAZA
• Passphrase od hrvatskih riječi — lako pamtljive, teško probojne
• 4 hrvatska rječnika (uključujući dijalekte)
• Password generator s 4 razine složenosti
• HIBP provjera curenja (k-Anonymity — nikada se ne šalje cijela lozinka)

📨 SIGURNO SLANJE
• Podijeli lozinku putem enkriptiranog linka (AES-GCM)
• PIN zaštita, ograničen broj pregleda, automatski istek

🔒 SIGURNOST I PRIVATNOST
• Zero-knowledge arhitektura — sve ostaje na tvom uređaju
• Nema korisničkih računa, nema telemetrije, nema kolačića, nema analitike
• Open audit: potpuna pravila privatnosti na geslar.app/privatnost.html
• GDPR compliant — voditelj obrade: Daniel Legin, Hrvatska
• Closed shadow DOM — web stranice ne mogu čitati Geslar UI
• Content Security Policy zaštita

⌨ PREČACI
• Ctrl+Shift+G — otvori Geslar
• Ctrl+Shift+L — autofill na trenutnoj stranici

Geslar je napravljen u Hrvatskoj, za korisnike koji cijene privatnost i sigurnost.
Potpuno besplatan. Bez skrivenih troškova.

Ispravke kozmetičkih pogrešaka

Broj pregleda = 1 se ponaša kao jednokratna potvrda
Zadani istek promijenjen na 3 dana
"Korak potvrde" proimenovan u "Zatraži 1-klik potvrdu"
PIN polja smanjeno, sve opcije slanja u izgledu kartice
Gumb za hrvatske dijakritike (s→š / šđčćž)
Nije potreban račun - cjelokupna enkripcija na strani klijenta, nikakvi podaci se ne prikupljaju ili spremaju

Manji kozmetički popravci