The interactive file manager requires Javascript. Please enable it or use sftp or scp.
You may still browse the files here.

Name	Modified	Size	InfoDownloads / Week
Parent folder
teampass-teampass_sha-aab5c74.spdx.json	2026-06-01	2.4 MB	0
3.2.0.1 source code.tar.gz	2026-06-01	52.2 MB	0
3.2.0.1 source code.zip	2026-06-01	60.7 MB	0
README.md	2026-06-01	3.2 kB	0
Totals: 4 Items		115.3 MB	0

What's Changed

This is a maintenance and security release on top of 3.2.0.0. It removes a third-party password library in favour of native PHP hashing, fixes the API token lifetime used by the browser extension, and includes installer and cleanup improvements.

Upgrading from 3.2.0.0 is recommended for all installations.

🚀 Pre-release Disclaimer: Version 3.2.0.1 is currently a pre-release. It has been heavily tested, but it now needs a real-world "baptism by fire" by the community. We strongly advise testing it in a non-production environment first.

Security

PasswordLib third-party dependency removed. Password hashing now relies exclusively on native PHP bcrypt through the built-in PasswordManager (Symfony PasswordHasher). This removes a large, unmaintained dependency (~68,000 lines of code) and reduces the supply-chain attack surface.

Fixes

API token duration is now interpreted in minutes. api_token_duration is computed as now + duration × 60, matching the browser extension's long-standing expectation. With the default value of 60, tokens now live 60 minutes instead of 60 seconds. A fallback of 60 and a 1440-minute (24 h) cap prevent instantly-expired tokens when the setting is missing or zero. This fixes browser-extension sessions that expired almost immediately after the 3.2.0.0 API hardening.
Clearer API authentication errors. The API now returns two distinct 401 responses: "Missing Authorization header" when no bearer token is sent, and "Invalid or expired token" when the JWT fails validation — letting clients tell a web-server/proxy configuration problem apart from a genuine token expiry.
Installer group ownership. (#5228) migrate_3.2.x.php now resolves the real web server group name via posix_getgrgid() on systems where the user and group names differ, and adds a new --web-group=GROUP option for explicit control.

Maintenance

Removed the obsolete password-migration tracking widget from the admin dashboard, the pw_legacy_bcrypt alias and warning icon from the users table, and the now-unused needs_password_migration database column (dropped via the 3.2.0 upgrade script).
Minor code cleanup in backups.queries.php and utilities.queries.php, and documentation updates (docs/install/upgrade.md --web-group option, ownership guidance).