Upgrade Password Manager

Upgrade Password Manager

Always make a backup before upgrading.

Recommended pre-upgrade checklist:

1. Log in to the old installation.
2. Generate a backup from Settings -> Back Up.
3. If you use file attachments, check Include Files.
4. Save a copy of the old application files.
5. Save a copy of the database.
6. Save a copy of the old config file.
7. Confirm the backup can be unlocked from the recovery page.

Upgrade from v11.00 or later to v11.08+

For v11.00 and later, the database format is expected to remain compatible for normal upgrades.

Basic process:

1. Download the latest stable release.
2. Do not re-import initial.sql.
3. Deploy the new src/backend.
4. Deploy the new src/frontend.
5. Move configuration values from the old config into the new split config files.
6. Clear browser cache or hard-refresh the frontend.
7. Log in and test backup/recovery.

Important path changes in v11.08

Old layout:

src/function/config.php

New layout:

src/backend/function/config.php
src/frontend/config.js

The new backend config contains:

src/backend/function/config.php

Use it for:

• database host/name/user/password
• $FRONTEND_URL
• $ALLOW_NO_ORIGIN_REQUESTS
• timezone
• server-side salt
• signup/file/custom-field/PIN/session settings

The new frontend config contains:

src/frontend/config.js

Use it for:

• apiBaseUrl
• globalSalt1
• globalSalt2
• frontend behavior such as browser timeout and default generated password length

Salt migration

Do not change salts for existing data.

When upgrading an existing installation:

• Copy the old client-side salt values from the old src/function/config.php to src/frontend/config.js.
• Copy the old server-side salt value to src/backend/function/config.php.
• Back up both new config files.

If the salt values are changed after data has been created, existing encrypted data may become unreadable.

E-mail 2FA migration

v11.08 removed e-mail based 2FA for the Password-Manager master account.

After upgrading, log in and configure TOTP-based 2FA:

Settings -> Turn on 2FA

Save the TOTP secret shown during setup.

Frontend/backend split migration

v11.08 separates static frontend code from backend REST API code.

Recommended production deployment:

Frontend: https://pm.example.com/
Backend:  https://api.example.com/passwordmanager/backend/

Configure the frontend:

apiBaseUrl: "https://api.example.com/passwordmanager/backend/",

Configure the backend:

$FRONTEND_URL = 'https://pm.example.com/';

Do not use wildcard CORS headers.

Upgrade from v10 or older

Older versions may use different cryptographic flows, layouts, and migration steps. Treat the upgrade as a migration rather than a simple overwrite.

Recommended path:

1. Keep the old installation working.
2. Log in to the old installation.
3. Generate a backup.
4. Include files if you need file attachments.
5. Open the recovery page from the same old version and unlock the backup.
6. Export RAW if available.
7. Install a fresh v11.08+ instance.
8. Create a new user.
9. Import the RAW file from Settings -> Import.

If RAW export is not available for your old version, export CSV from the old version or from its recovery page, then import CSV into the new instance.

Very old versions may require stepping through older releases. Use Release Archive to download the version that matches an old backup.

After upgrading

After a successful upgrade:

1. Log in.
2. Confirm entries decrypt correctly.
3. Confirm attached files download correctly, if used.
4. Configure TOTP-based 2FA.
5. Generate a fresh backup.
6. Test the fresh backup with the recovery page.
7. Disable signup for private instances:

$ALLOW_SIGN_UP = false;

Common mistakes

Re-importing initial.sql

Do not import initial.sql over an existing database unless you are creating a new installation.

Changing salts

Do not change existing salts during upgrade.

Pointing apiBaseUrl to rest/

Wrong:

apiBaseUrl: "https://api.example.com/passwordmanager/backend/rest/",

Correct:

apiBaseUrl: "https://api.example.com/passwordmanager/backend/",

Keeping old installation instructions

Do not follow old instructions that reference:

• src/function/config.php
• signup.php
• reg.php at the old root
• SendGrid
• e-mail verification
• old client-side source-file MD5 checking