Changelog

Killswitch has always been worth recommending. Now recommending it pays you both.

• Your own referral link — active subscribers will find Refer a Friend in the sidebar. One tap to copy, share it anywhere, and the link remembers your friend for 30 days

• Give a month, get a month — when someone joins through your link and becomes a subscriber after their free trial, you each get a free month of the plan your friend chose. Refer a Pro signup, earn a Pro-sized month

• Nothing to redeem — free months are account credits applied automatically to your next bill after your friend's first payment. Monthly or yearly plan, it just works

• Watch it happen — your referral page shows link opens, friends joined, and free months earned, and you get an email the moment a friend converts

• Fair by design — referring requires an active subscription, each friend counts once, and referring yourself or someone who already subscribes doesn't count

There's no cap: every friend who converts earns you another month.

Killswitch works by reaching people — you, and the people you trust. Starting today you can see exactly how that's going, in Settings → Activity.

• Your communication log — every email and text we've sent to you, and to your beneficiaries on your behalf, in one place. Delivered, opened, or failed, each message shows its status at a glance
• Failures explained in plain language — if an address is bouncing, refusing our mail, or flagged us as spam, the log says so and tells you what it means. No more wondering why a reminder never arrived — and if something looks wrong, one email to hello@killswitch.app and we'll chase it down with our delivery provider
• Your account activity — a running log of your own actions: sign-ins, check-ins, and changes to your vault, each with its time and IP address. If you ever see something you didn't do, you'll know immediately — change your password and contact us

Nothing about how we deliver has changed — you can just finally see it. Transparency is the whole product: a switch you can't verify is a switch you can't trust.

Your switch only works if the other side is reachable. You get check-in reminders and receipts constantly — but until now, nothing proved that your beneficiaries' email addresses and phone numbers actually work. Now you can know, before it ever matters.

• Automatic checks, no email sent — the moment you add or edit a beneficiary, we quietly catch typos ("did you mean gmail.com?"), check whether their email domain can receive mail at all, and confirm their phone number is real and routable. Problems show up as badges on your beneficiary list
• One-click verification — click Verify next to a beneficiary and we send them a single email that leads with your name, explains what Killswitch is, and asks for nothing but a click. US and Canadian phone numbers can optionally be confirmed with a one-time code on the same page
• Quarterly reachability checks — your beneficiary can opt into a one-click "still reachable?" check every quarter. If they stop answering, you're warned before anything fires, while there's still time to sort it out
• Verification expires after a year — people change addresses. Answered reachability checks keep it fresh automatically
• Respectful by design — beneficiaries never signed up for email from us, so requests are strictly rate-limited, every message has a one-click decline or stop, and their choices are honored immediately. If someone asks to be removed entirely, you're alerted and guided to talk with them directly

Verification status also feeds each switch's health check — a switch whose recipients can't be reached now warns you on the switch page and in your health digests.

Recovery is just as automatic:

• Share links repair themselves — fixing a typo in a beneficiary's email used to strand the delivery links a switch had already prepared. Now they follow the edit automatically, and any missing links are re-created on their own — when you open the switch, and in a daily sweep even if you don't
• Verified phones are visible — a confirmed number shows a check next to it, and each switch now shows exactly who's verified, who isn't, and whether their delivery links are ready
• A decision maker for the worst case — mark one beneficiary as your decision maker. If a delivery ever fails after your switch fires, they're told something went wrong and pointed at our support team. They never receive anyone else's files — just the heads-up
• Support-side fixes are transparent — if a failed address can only be corrected through our support team, it requires proof the address is actually dead, you and every other beneficiary are notified the moment it happens, and delivery waits 72 hours before proceeding

Refer Killswitch, get paid. The partner program has returned — rebuilt in-house, with applications, referral links, and commission tracking all inside the app.

• Apply in minutes — the application lives right on the partners page: tell us who your audience is, and we review and reply by email.

• Your own links — approved partners get custom killswitch.app/r/ links, and the people you send get 10% off their subscription.

• 30-day credit window — someone who clicks your link has 30 days to sign up and still count as yours.

• Commission on real payments — your rate and terms are agreed when you join: the standard arrangement is 20% of a referral's first payment, and some partnerships earn on every payment. Every commission is verified against the actual payment, held for 30 days (the refund window), then owed until we pay out.

• A dashboard in your account — sign in to see your links, clicks, signups, and every commission's status — on hold, owed, or paid — under your exact terms. No third-party portal, no separate login.

Your files now travel through a new upload pipeline built for two things: surviving bad connections and defense in depth.

• Every file gets its own key — documents are now encrypted by our servers with a unique per-file key before they're written to storage, encrypted at rest and in transit, and a key for one file unlocks exactly one file. Files uploaded earlier are being re-encrypted the same way automatically.

• Malware scanning — new uploads are scanned for malware after they arrive; anything flagged is quarantined — it can't be downloaded or shared, by anyone. And a scanner outage never blocks access to your own clean files.

• Resumable uploads — large documents upload in parts, so a dropped connection picks up where it left off instead of starting over.

• Smoother playback and previews — downloads stream with real seek support for audio and video, and images and previews can now be cached by your browser, so pages with media load faster the second time.

• Stricter download hygiene — document downloads always arrive as attachments with locked-down content types, so a crafted file can never render as a web page from our storage domain.

Your deadman switches just got a second lock. Switch Protection is a new toggle in Settings → Security — off by default — that requires you to re-authenticate before anything about a switch can change.

• What it guards — editing, pausing, or deleting a switch; adding or removing its items; changing, editing, or deleting beneficiaries; and revoking shares. If someone gets hold of your open session, they still can't quietly disarm your plans.

• How you verify — your account password, or a one-time code texted to your verified phone (the same Twilio verification used at sign-in). Your choice, in settings.

• Checking in never asks — the keep-alive action stays one tap, always. Protection guards changes to your switches, never your ability to keep them from firing.

• No backdoor — turning Switch Protection off requires passing the same verification it enforces.

• The Claude connector is covered too — while protection is on, switch changes through the connector are refused entirely (it can't answer your verification challenge). Claude can still read your switches; changing them becomes app-only.

After you verify, the page stays unlocked for ten minutes so a batch of edits only asks once. Leaving the page locks it again.

The Library's look — color-coded rows, search, remembered sorting, nothing to scroll sideways — is now the whole app's look.

• Switches, Shares, Beneficiaries, and Tags all speak Library now — tinted icons, compact rows that work on a phone, search on every page, and a sort choice that's still there when you come back. The old tables (and the horizontal scrolling they forced on mobile) are gone; Check In is always one tap.

• Switches sort by what actually matters — the default order is "Closest to firing": anything in its grace period first, then whichever switch would trigger soonest, counting each switch's own grace window.

• Manage Shares has a home — it's in the side menu now. See every share in one place, search by recipient, sort by newest or recently accessed, and copy or revoke links without hunting.

• Library "All" really shows all — items inside folders appear too, each labeled with where it lives, and your chosen sort now applies everywhere: filtered views, cards, and the folder tree alike.

• Global search, rebuilt: one flat list ranked by recent activity — including things you've opened, not just edited. Colored type badges, tags on every result, and it searches inside entry content.
• Search & sort everywhere: Beneficiaries (plus add-to-switch right from the list), Trash, Manage Tags, and the Library — your sort choice is remembered.
• Library, remixed: the All view now mixes notebooks, folders, and items in one grid, ordered however you sort it — with the same colors as search. Prefer categories? "Grouped by type" brings them back.
• Mobile editing that behaves: the format bar sits right above the keyboard everywhere, you can always scroll to the end, and since everything auto-saves, one ✓ Done button replaces Save/Cancel.
• Switches at a glance: your switches lead the page, color-coded green / amber / red by state. Check-in links from email or SMS now work exactly once.
• Notebook calendar: entries show as clickable event chips on desktop, not just dots.
• Plus: comfortable reading width on shared notebooks, better toasts, and "Last Used" on tags finally works.

Deleting something in your Library used to be immediate and permanent. Now every delete — a document, note, journal entry, recording, folder, or whole notebook — moves to the Trash instead, where it stays until you decide otherwise.

• Restore anything — Deleted items keep their content and stored files, and a single click puts them back exactly where they were. Restoring a notebook or folder brings back everything inside it too.

• Empty Trash when you're sure — Permanent deletion (stored files included) happens only when you choose Empty Trash, behind a confirmation step. Until then, nothing is gone.

• Protected items stay protected — Anything attached to a deadman switch still can't be deleted, even to the Trash, until you remove it from the switch first.

• Claude connector safety — If you use the Claude connector, Claude can move items to the Trash and restore them, but can never permanently delete anything. Emptying the Trash is something only you can do, from the app.

You'll find the Trash in your Library sidebar.

Global search (⌘K) has always matched titles and tags. That worked fine for documents — but journal entries are usually titled by their date, so the entry where you actually wrote about something could be impossible to find unless you remembered when you wrote it.

Now search looks inside your writing:

• Note and journal-entry text — search for what you wrote, not just what you titled. A date-titled entry now shows up with a short snippet of the matching passage, so you can recognize it at a glance.

• Document descriptions — a file you described when you uploaded it ("Deed to the lake house" on a scan named scan_0042.pdf) now matches on that description, not just its filename.

• Every title, every type — documents, notes, recordings, journal entries, notebooks, and folders all still match by name, exactly as before.

Nothing new is stored or indexed to make this work. Your content stays encrypted at rest — search reads it only for you, only while you're searching, and the Tags-only toggle behaves exactly as it always has.

Email is how Killswitch reaches you: check-in reminders, switch alerts, the warning before anything fires. If your address stops accepting mail — a typo at signup, a mailbox that got shut down — all of that fails quietly. And the warning about the problem goes to the very address that's broken.

Two changes, so it can't stay quiet:

• A banner you can't miss — if mail to your address is bouncing, a notice sits at the top of every page in the app, with a link straight to the fix. There's no dismiss button; it clears itself the moment you confirm a working address.

• Change your email yourself — Settings → Account now has an email address form. We send a confirmation link to the new address, and nothing changes until you click it. A typo in the correction can't lock you out of your own account.

The banner is only for addresses that genuinely bounce. If you've opted out of our marketing email, your address still works fine — you'll never see it.

The dashboard has always shown how close your switch is to firing — a progress ring that drains from green to amber to red as your check-in comes due. But that signal lived on one page. Everywhere else, the Check-In button in the top bar looked exactly the same whether your next check-in was weeks away or hours.

Now the button carries the signal with you:

• Green when you're covered — most of your check-in window remains

• Amber as the window drains — one glance, on any page, tells you it's getting close

• Pulsing red when it matters — a switch near firing or in its grace period is impossible to miss, and one click resets it

• Always current — the color updates on whatever page you have open, and flips back to green the instant you check in, from anywhere

• Never out of step — the button and your dashboard ring read from the same source, so they can't disagree

Nothing about checking in changed: one click still resets every switch. The button just stopped keeping the deadline to itself.

A deadman switch can look perfectly healthy and still deliver nothing — no items attached, a beneficiary with no share link, a file you deleted months ago. Until now, you'd only find out by opening the switch and running a health check yourself.

Now we run it for you, every day.

• Every active switch is checked daily: items attached, beneficiaries configured, share links complete and valid, items still present, delivery jobs scheduled.

• Your switch page shows the latest result the moment you open it — no clicking required. Your switch list flags anything that needs attention.

• If a switch would deliver nothing, we tell you: a notification in the app, and an email so you find out even when you're not logged in.

• At most one email, covering every switch that needs attention — and only when something changes or stays broken. We won't nag you daily about the same problem.

• A switch with nothing attached is now called out clearly everywhere it appears.

You can still run a check yourself anytime from the switch page — that one also verifies every file is present in storage.

We shipped a full documentation portal at killswitch.app/docs — fifteen detailed, step-by-step guides covering every part of Killswitch, readable front to back with previous/next navigation on every page.

For your beneficiaries. The guide that matters most is What You'll Receive — written for someone who has never used Killswitch and just received a delivery email or text. What the notification looks like, how to tell it's legitimate, and exactly how to view, download, and keep what was left for them. No account, app, or password required.

For you. Guides for every core concept: deadman switches (both schedule types, the reminder ladder, test fires, and a walkthrough of the creation wizard), beneficiaries and check-ins, documents, notes, video & audio messages, notebooks & journal, folders & library, tags, passwords & account recovery — including the answer to the question we hear most: forgetting your password loses nothing — plus a dashboard walkthrough, a complete settings reference, and Using Killswitch with Claude.

Find the guides any time from the Docs link in the navigation, Guides & Documentation in the footer, or Guides & Docs under Help & Support in the app sidebar.

The email your beneficiaries receive is only as trustworthy as the sender it names. Until now, that was your email address. Now it's you.

• Add your name in Settings — one field, takes ten seconds, and every future delivery leads with it: "John Smith shared an item with you" instead of an email address they might not recognize

• New accounts start with it — signing up now asks for your name, so every switch is backed by a real identity from day one

• We'll nudge you, once — if you have switches but no name on file, a dismissible banner on your dashboard points you to the setting

• Works everywhere your switches speak — emails, text messages, and scheduled deliveries all use it, with your email shown alongside your name in the message body so recipients can verify it's really you

• Nothing breaks if you skip it — no name on file simply means deliveries continue exactly as they do today, from your email address

A small field with a big job: making sure the person opening that email knows, instantly, that it's from you.

When a switch fires, someone you love gets an email from us — quite possibly on one of the hardest days of their life, and it's the first they've ever heard of Killswitch. We rewrote every one of those messages from scratch, with that person in mind.

• Your words come first — the personal message you wrote is now the first thing they read, front and center, before any list of items or explanation of the service

• It sounds like you, not like software — no more "automated system" and "designated beneficiary" language. Your message, your items, a clear explanation of what to do next

• Clear guidance, not vague warnings — recipients are told plainly to download and save what you've left them, instead of an anxious "access may expire"

• Scheduled switches tell the right story — a birthday letter delivered on a chosen date now says exactly that. Only a missed-check-in switch implies you've gone quiet

• Questions go to us, not to you — replies and questions route to our support team, who can actually help, rather than to an address that may no longer answer

• Text messages got the same care — softer wording that leads with who sent it

Every variant — documents, messages, deletions, test previews — was rebuilt, reviewed against real renderings, and shipped behind our full automated test suite.

Until today, every switch was a countdown — keep checking in, and nothing happens. Now there's a second kind: choose an exact date and time, and your switch fires right then. A letter that arrives on her birthday. Instructions released the morning of the handover. A message for an anniversary you won't be there for. When the moment matters more than the silence, put it on the calendar.

• Two kinds of switches, one builder — when you create a switch, choose between the classic check-in countdown and the new specific date & time

• Your timezone, your clock — pick the time in your local timezone and that's when it fires. Daylight saving shifts are handled for you: 9:00 AM means 9:00 AM

• You'll never be surprised — warnings at 7 days, 3 days, 1 day, and 3 hours before it fires, by email, text, and push, each with a one-tap way to reschedule

• Editable until the very end — change the date, pause, or delete a scheduled switch any time before it fires. Rescheduling takes effect instantly

• No check-ins required — scheduled switches don't ask you to check in, and they stay untouched by auto and bulk check-ins on your other switches

• Rehearse it first — test mode runs the whole thing in minutes instead of days, warnings included, so you can watch a dry run before trusting it with the real date

• Works with Claude — create a scheduled switch or move its date right from a Claude conversation

Scheduled switches run on the same delivery machinery as every switch we've ever shipped — precisely scheduled, independently double-checked every hour, and they fire whether or not your subscription is active. Everything above shipped behind our full automated test suite. Same protection, now with perfect timing.

This release makes the journal a first class part of Killswitch. Write for the people you love, and if you ever stop checking in, they receive every entry, photo, and recording exactly as you left it.

• Journal entries now carry the day they're about. Backfill past days, document a trip after you're home, or transcribe an old paper journal — edit any entry's date right in the editor and everything lands on the right day
• New calendar view for journals. See your month at a glance, jump to any day's entries, and spot the days you wrote
• Export any journal as a PDF. Cover page, entries in order with their dates, photos included. Recordings and attachments link back to the real thing
• If your journal's share link is on, links inside the exported PDF work for anyone holding it. Revoke the share and every exported copy's links stop working. The export page tells you which mode you're in
• Search and sort inside a journal. Find that entry from months ago in seconds
• Preview exactly what your family will receive, any time, without turning on a share link
• Optional writing reminders on your schedule. Daily, every few days, or weekly — streak aware and off by default. One click unsubscribes
• Starting a journal entry from the dashboard now continues today's entry instead of creating a duplicate
• Create entries with a date or change an entry's date from a Claude conversation

This release is a top-to-bottom overhaul of the Library editor — the place you write notes, journal entries, and letters — with a focus on speed, mobile, and never losing a word.

What's new:

• Instant notes — tap New Note and you're typing immediately, with the cursor already in the title field. Untitled notes get a clean automatic name like Note · Aug 3, 2026 · 9:05 AM, just like journal entries
• Pages load dramatically faster — the editor now loads only when you actually edit, cutting the app's initial download by over 80%
• A toolbar that works on your phone — it stays pinned above the keyboard while you type, with the essentials up front and everything else one tap away
• Select text to format it — a small menu appears right over your selection with bold, italic, underline, and link
• Type / for commands — headings, lists, tasks, quotes, dividers, photos, and links without touching the toolbar
• Paste, drag, or snap — paste a screenshot, drag files straight into a note, or use the new camera button to capture photos and video on mobile
• Never lose a word — a live save indicator shows Saving, Saved, or Offline, and if your browser closes mid-thought, the editor offers to restore your unsaved draft when you return
• Journals that know it's today — the composer offers to continue today's entry instead of creating a duplicate, arrows move between entries, day labels show Today and Yesterday, and a subtle streak counter cheers you on
• Focus mode — one tap hides everything but the page, for when it's just you and the words
• Word count, at a glance, always current

Everything is still encrypted at rest and in transit, and every change above shipped behind our full automated test suite. Less friction, same protection.

Opening, previewing, and downloading files from your Library is now significantly faster. Your browser fetches files directly from secure storage over a short-lived signed link instead of routing every byte through our application servers.

• Large documents and PDFs start rendering sooner
• Video and audio recordings scrub smoothly — jump to any point without waiting for the whole file to load
• Vault exports and downloads are quicker and more reliable, especially on slower connections

Every request is still authorized by your account first, files remain encrypted at rest and in transit, and each link is single-purpose and expires within two minutes.

Your documents, notes, recordings, and notebooks now live in one place: the Library. This is the biggest update we've ever shipped — a ground-up rework of how you store, write, organize, and share everything you protect.

One Library for everything

• Browse everything in one view, or filter by Documents, Notes, Recordings, Notebooks, and Folders — from the page or straight from the sidebar.
• Switch between card and tree views, filter by tag, and expand items in place — notes and entries open right in the list, documents preview inline (including PDFs), and recordings play without leaving the page.
• Global search (⌘K) now covers your whole Library — including notebooks and folders — fast, server-powered, and matching the real names of your items.

A real writing experience

• Notes and notebook entries get a rich text editor — headings, lists, tasks, links, and formatting you can see — with a one-click toggle to raw Markdown. Under the hood your writing is still stored as portable Markdown, encrypted at rest.
• Autosave while you write, and if you open a new entry and change your mind, leaving without typing creates nothing.
• Insert images, video, and audio directly into notes and entries, or attach existing documents and recordings from your Library.

Notebooks are journals

• A notebook opens with the composer up top — start today's entry in one click.
• Share a notebook with a public link (short URL, on/off, regenerate anytime) or instantly by email — and see and revoke every share from the notebook page.
• Recipients get a beautiful journal view: searchable entries with inline photos, video thumbnails, and ready-to-play audio.

Folders, done right

• Folders are for storing: move documents, notes, recordings, and whole notebooks into them. No clutter, no ceremony.
• Attach one folder to a deadman switch and everything inside it is delivered — including nested notebooks and their entries.
• Deleting a folder never deletes what's inside; contents return to your Library. Deleting a notebook removes it and its entries, with a clear confirmation first.

Deadman switches, connected

• The switch builder now picks from your Library with search and type filters — the same fast picker everywhere you add items.
• Switch Health verifies your Library-backed shares end to end.

A faster dashboard

• Continue where you left off — your most recent items, one tap away.
• Quick-action tiles, slimmer storage and planning bars, and a compact switch card with Check-In front and center.

Better on your phone

Most of you use Killswitch from your phone, so this release was built for it: readable lists with actions that work on touch, a focused distraction-free editor, and every core screen verified at phone width.

Test coverage across the entire Killswitch codebase has passed 90% — 90.9% combined across 400 files, up from 77% earlier this year, then 80%, then 85%. The browser-side code — where your encryption, sharing, and key handling actually happen — sits at 94.4%, with the Elixir backend at 88.8%.

What that means for you:
• The guarantees that matter most — Sealed items stay unreadable, switches fire when they should and never when they shouldn't — are verified automatically on every single build
• Regressions get caught before a release ever reaches you, not after
• We can keep shipping every few days without trading speed for safety

Nothing about your security model has changed: Sealed items remain zero-knowledge, and these tests exist to prove that guarantee holds, build after build. More coverage, same privacy.

Killswitch now works as a connector for Claude Desktop (and other MCP clients) — set up and maintain your plan just by talking to Claude:

• Create and edit notes
• Create notebooks and add or edit text entries
• Upload documents and attach them to a note
• Add beneficiaries
• Configure deadman switches (you always confirm the important changes)

Add the connector in Claude Desktop using your Killswitch MCP URL and approve access. Claude can only read and change items you mark Standard, and only during a session you explicitly unlock in Settings → Connector — your Sealed items stay zero-knowledge and are never readable by Claude or Killswitch. You can seal or unseal a note or notebook anytime. Manage or revoke connector sessions whenever you like.

Killswitch now ships with over 85% automated test coverage across our entire codebase — both the Elixir backend and the browser-side encryption and sharing logic.

What that means for you:

• Greater confidence that encryption, sharing, and deadman switches behave exactly as designed
• Fewer regressions — every release runs thousands of automated checks before it goes out
• A safety net that lets us add features faster without putting your data at risk

Your security model hasn't changed: Sealed items stay zero-knowledge, and these tests verify that guarantee holds on every build. More coverage, same privacy.

Choose how each note, document, and notebook is encrypted — per item, or as your default:

• Sealed (zero-knowledge) — encrypted with a key that never leaves your device. Only you can read it — not Claude, not Killswitch staff. This is the new default for everything you create.
• Standard — encrypted at rest, so an AI assistant will be able to help you with these items once our Claude connector launches. Claude connector capability coming soon.

Set your default in Settings → Security → Default Encryption, or pick a mode when you create a note, upload a document, or start a notebook. You can re-seal (or unseal) a note, document, or notebook anytime from its detail page — sealing a notebook re-encrypts all of its entries too. Existing items remain Sealed.

See exactly what happens after your switch fires.

What's new
• Delivery status for every beneficiary — right on the switch page you can now see whether each person's notification was sent, delivered, opened, or bounced, confirmed by our email provider.
• Bounce alerts — if a beneficiary's email can't be delivered, you'll get an alert so you can reach them another way or fix the address.
• More reliable delivery — a triggered switch now delivers to each beneficiary independently and retries on its own, so no one is missed. Your switch-trigger emails always go out, even if you've turned off check-in reminders.

The notebook editor now feels right on a phone. The entries menu opens and closes with a single tap (no more double-tapping), and it slides away automatically as soon as you pick an entry — so you're never left staring at the menu covering your note.

Delete and share controls in the entries list are now tappable on touch instead of hidden behind a hover, the menu items have bigger tap targets, and the top bar shows which notebook you're in plus a quick save indicator. We also trimmed the redundant breadcrumb on small screens so the editor isn't buried under stacked headers.

Killswitch now makes sure your encryption key is unlocked the moment you open the app. If your session is locked, you'll be asked for your sign-in password right away — instead of only when you try to preview a document.

This means recordings, notebooks, and everything else are ready to decrypt without surprise password prompts mid-task. You're still asked at most once per browser session, and "Not now" is always an option.

Recording a video or audio message now takes over the whole screen — like the camera app on your phone. A big tap-to-record button, a live timer while you record, and a clean review step before you encrypt and upload.

On desktop it opens as a centered modal sized to match your camera (portrait or landscape) instead of a cramped side panel. The same experience powers both standalone recordings and notebook video/audio entries.

Faster ways to capture and a cleaner dashboard.

What's new
• Notes need only a body — leave the title blank and we'll name it for you (e.g. "Note · May 30, 2026 · 3:42 PM").
• Recording is faster: jump straight into video or audio, add an optional title, and tuck a description and tags behind an "Add details" toggle.
• New "Notebook" quick action creates an entry in one tap and remembers the last notebook you used.
• Tidied the dashboard — streamlined quick actions, clearer stat cards, and a cleaner mobile layout.

As always, everything stays end-to-end encrypted — titles are generated in your browser before encryption, so we never see them.

Fixed two problems with global search (the Cmd/Ctrl+K quick search).

What's fixed
• Encrypted notes and recordings used to show up as scrambled text in the search results. They now decrypt in your browser and show their real titles, the same way they do on their own pages. (If your vault is locked, search shows a neutral "Encrypted Note/Recording" label instead — it won't interrupt you to unlock.)
• Audio messages are now told apart from video. Audio results show a microphone icon, video shows a camera, and the section is labeled "Recordings" to cover both.

You can now record audio messages anywhere you could record video — as Video Messages and as Notebook entries. Leave a voice note for the people you trust without ever being on camera.

What's new
• A Video / Audio toggle in the recorder — choose voice-only, and your choice is remembered next time.
• Audio gets the same zero-knowledge encryption as everything else: your browser encrypts the recording before it leaves your device. We never see the audio or the key.
• Play it back inline with a built-in audio player — in your library, in shared links, and in deadman-switch previews.
• Attach audio to a deadman switch. The item picker, the switch detail page, and every share and trigger email now show a 🎤 "Audio Message" instead of mislabeling it as a video.

Fixed a timing bug in our automated reminder emails. Account deletion warnings and trial expiration reminders could say "tomorrow" when the deadline was actually a day or two away, and the displayed date sometimes didn't match the user's timezone.

Emails now compute the remaining time from your account's actual schedule and your local timezone, so a deletion 48 hours out reads "in 2 days" rather than "tomorrow," and the scheduled date matches your local calendar. Affects the 90-day-inactive deletion warning sequence and the trial-ending reminder pipeline.

Beneficiaries can now be added as witnesses — they get notified that your switch fired, but receive no file access. The notification email includes a transfer manifest showing what was transferred (and, if you opt in, who received each item), creating a third-party audit trail.

• New role per beneficiary: Recipient (gets file access, default) vs. Witness (notify-only).
• Per-switch privacy toggle: "Show recipient identities to witnesses" controls whether the audit-trail email names the recipients or only lists the items.
• Test mode preview: A new "Test Optional Witness" toggle lets you preview the witness email alongside the recipient email when testing.
• Live item titles: Document, Note, Notebook, and Video Message titles stay in sync — rename an item and the manifest reflects the new title automatically.
• Health check coverage: The Switch Health card now lists all four item types in its Storage Verification section.
• Better beneficiary UX: The name field is required (and reused everywhere) so the audit-trail manifest reads "Alice Smith (alice@example.com)" instead of bare emails.

When you update a note, notebook, or video message that has been shared, the changes now flow through to every existing share automatically. Recipients used to keep seeing the original title and description after a rename — no longer.

What now propagates to existing shares:
• Note title and body edits
• Notebook title and description renames
• Video message title and description renames
• Attachment changes on notes (add or remove)
• New video entries, text entries, and inline media in notebooks

The sync runs entirely client-side under your master key, so the existing share URLs keep working and zero-knowledge is preserved. The deadman trigger email subject and shared-items list also update.

Shares created before this release won't auto-update — use the new "Update & resend" button on those rows to create a fresh, syncing version.

Owners can now preview their deadman switch shares end-to-end without notifying the beneficiary.

When you click `Test Delivery` from a switch detail page, the test email/SMS now carries a signed, one-hour token in every share URL. Opening one of those links:

• Skips the beneficiary email verification gate (you don't need the beneficiary's email)
• Suppresses the access notification email that would normally go to the beneficiary
• Suppresses the owner alert email
• Leaves the share's last-accessed timestamp untouched
• Logs the access with a `_test` suffix so it never masquerades as a real beneficiary view in the audit trail

The token binds to the specific share and owner, so it can't be replayed against any other share. Real beneficiary access — including the email gate, receipts, and `last_accessed_at` — continues to behave exactly as before.

Strengthened the security of shared content links with three improvements:
• Share link codes are now longer and more resistant to guessing
• Access tokens are no longer visible in URLs, browser history, or server logs
• Recipients must verify their email address before viewing shared content
• Added rate limiting to the short link endpoint to prevent automated enumeration

These changes add defense-in-depth to our existing zero-knowledge encryption architecture, where all files are encrypted client-side before upload and the server never has access to decryption keys.

Encrypted file uploads now go straight from your browser to encrypted cloud storage — your files never pass through our app servers. Faster uploads, smaller server footprint, same zero-knowledge encryption.

What this means for you:

• Uploads start the moment you pick a file — no more waiting for an extra round-trip
• Click Save in the new drawer footer to commit; closing the drawer discards the upload cleanly
• Files over your plan's per-file size limit are now rejected instantly with a clear error
• Abandoned uploads are automatically swept from cloud storage on a 10-minute cycle, so nothing lingers

Behind the scenes this powers documents, video messages, notebook video entries, and inline notebook media — all four upload paths now share the same direct-upload pipeline.

A pure-cryptography update with no user-facing UX change.

We bumped the PBKDF2-SHA256 iteration count used to derive the password-derived key that wraps your master key from 100,000 to 600,000. That matches current OWASP guidance for SHA-256 and roughly 6x's the work an attacker would need to do to brute-force a stolen wrap. Brand-new accounts have always been on this value going forward; existing accounts are upgraded silently on your next successful login.

What "upgraded silently" actually means:

• Your master key — the random 256-bit key that protects all your files — does not change. Not one byte.
• Only the wrap derived from your password is re-derived at the new iteration count and saved back to our servers. That's a few hundred milliseconds of extra work on your next login. After that login, everything is back to instant.
• Zero files are re-encrypted. Zero S3 traffic. Zero per-file work.

This is the whole point of the wrapped master key architecture (the same pattern 1Password and Bitwarden use): cryptographic policy changes like this should be free, and they are. 1Password and Bitwarden have done it twice in the last decade; we just did it for the first time.

The server enforces strictly increasing iteration counts, so even a buggy or malicious client cannot accidentally weaken your security posture. The upgrade is also idempotent — if you log in from your phone and laptop at the same time, only one wins, the other no-ops.

Two changes to make shared content opens trustworthy on both sides.

When someone clicks a Killswitch share link, the file no longer decrypts automatically. The page now renders a confirmation gate. Only an explicit "View shared content" click runs the decryption and triggers the access pipeline. The reason: email-security scanners (Microsoft Defender, Mimecast, Proofpoint, etc.) follow links to inspect them. Until now, a scanner click could fire your owner-alert email and create an access log entry before the actual beneficiary had even seen the link. The gate stops that — scanners don't click buttons.

The second change is for beneficiaries: when a share is opened, the recipient now gets their own confirmation email at the same time the owner gets the alert. Time, IP, and approximate location, with copy that adapts to the share type. For deadman-triggered shares specifically, the email acknowledges that the original owner may no longer be reachable, and positions the recipient's record as the canonical access trail. When the owner is gone, the beneficiary is the watcher — and they now have the visibility to act on it.

Both emails fire after the click. Scanners trigger neither.

Patched a high-severity Phoenix advisory (GHSA-628h-q48j-jr6q) affecting long-poll NDJSON body handling. We were on 1.8.5; the fix landed in 1.8.6. We've bumped to 1.8.7 (one beyond minimum) and tightened the version floor in mix.exs so future dependency resolutions can't fall back below the patched version.

No user-visible changes. No action required on your end.

Monthly billing is here, and we made it work the right way.

Once your deadman switch is set up — items linked, beneficiaries chosen — it fires on schedule regardless of subscription status. That's the always-fires guarantee. It's enforced in code, not in marketing copy.

• New monthly tier: $7.99 (Starter), $19.99 (Pro), $39.99 (Legacy). Cancel any time at end of period.
• Starter yearly dropped from $99 → $79. 3-year locks in $67/yr (15% off).
• If your subscription lapses, your switches keep firing and your check-in links keep working. You lose the ability to upload new files or edit switches until you resubscribe — but the protection you've already configured is yours to keep.
• Settings page now reflects your actual billing cadence and shows your renewal date.

Why we waited so long to ship monthly: we refused to release it until we could guarantee that a missed payment couldn't break your family's protection. Now we can.

The app feels snappier on long-haul connections (Asia, Europe) where round-trips to our SF server used to add 200–360ms to every click.

• Modals and drawers now open and close instantly client-side. The server still runs cleanup in the background, but you no longer wait on the network for the UI to react.
• Notebook entry sidebar opens by default on desktop and toggles instantly.
• Form fields debounce typing across the deadman wizard, video form, tag rename / create, and admin maintenance message.
• Switching between notebook entries patches in place instead of fully remounting — saves ~1s per click on cross-Pacific links.
• Lightweight /health endpoint replaces home-page hits from uptime monitors and the proxy healthcheck.

The blog index just got a refresh:

• Search — find posts by title, summary, body, or tag with a single search box at the top of /blog. Results update as you type, and the URL reflects your query so you can share or bookmark a search.
• Pagination — 10 posts per page with numbered navigation and Previous / Next links. Each page is its own crawlable URL so older posts don't get buried.
• Cleaner tag filter — tags now sort by post count, the row is clipped to a single line, and a "Show all tags" toggle reveals the full list. Your active tag stays pinned so it's never out of sight.

Filters combine: search within a tag, jump between pages, share a link to any view.

The Tawk.to chat widget no longer loads on routes that can carry sensitive tokens in their URL, including authentication callbacks, email confirmation, account recovery, quick check-in, short links, and admin pages.

Backend hardening changes based on a responsible disclosure report:

• Hardened the master key write API to validate input, refuse to overwrite an existing wrapped key, and emit a security alert email on every write.
• Tightened our Content Security Policy — scoped third-party script allowances with Subresource Integrity and removed overly broad entries.
• Normalized error responses across anonymous sharing flows so they no longer reveal resource type or sharing state.

Notebooks are here. Capture your thoughts, journal your days, and record video messages alongside your most important documents — all protected by the same zero-knowledge encryption that guards the rest of Killswitch.

What's in the box
• Rich text entries — a full writing experience with headings, lists, task lists, quotes, code blocks, and alignment.
• Inline encrypted media — drop images and videos straight into an entry; they're encrypted client-side and decrypted only when you view them.
• Video entries — record a video message directly into a notebook with one click.
• Auto-save — changes persist every few seconds in the background; keep writing, we've got it.
• Sidebar navigation — jump between entries in a notebook without losing your place.

Sharing & delivery
• Share an entire notebook or a single entry with anyone via an email share link.
• Tie a notebook to a deadman switch so your beneficiaries receive it automatically if you miss a check-in.
• Every share is end-to-end encrypted — we never see the plaintext.

Zero-knowledge by default
• Titles, content, and inline media are encrypted in your browser before they ever touch our servers.
• The new shared unlock gate (shipped in v1.1.6) keeps your content safe if your session expires mid-edit.

Head to /notebooks to create your first one.

Fixed a rare but serious bug where a notebook entry could be auto-saved with placeholder content before decryption finished — overwriting your real encrypted data with blanks or the word "Decrypting…".

What we changed
• Added a single shared unlock modal that appears the moment we detect a missing master key — no more silent failures or browser password prompts.
• The notebook editor now stays locked (title read-only, editor hidden) until decryption succeeds. Typing is blocked while we're waiting on your password, so auto-save can't fire with stale or placeholder values.
• Decryption is never attempted without a master key. Every file, note, notebook entry, inline image/video, and share regeneration now funnels through the same unlock gate.
• Decryption failures preserve the ciphertext on disk instead of clearing the editor fields.

Why it matters
• Your encrypted notebook entries are safe — even edge cases like an expired browser session, a cleared cache, or a cancelled unlock prompt can no longer cause content loss.
• Unlocking is consistent across the app: one modal, one password prompt, one promise-based flow that every feature respects.

No action required on your end. Existing entries are untouched.

Killswitch now includes a full in-app notification center and polishes the mobile PWA experience end-to-end.

Notification Center
• New bell dropdown in the navbar shows your latest notifications with an unread count badge
• Real-time updates via PubSub — no page reload needed
• Mark individual notifications as read, clear a single notification, or clear all at once
• Inbox entries are created for check-in reminders, triggered switches, and test deliveries

Mobile & PWA Polish
• Check-in button is now always visible on mobile so you can reset any switch with one tap
• New bottom navigation bar on mobile for Dashboard, Documents, Switches, and Beneficiaries
• Install-to-home-screen prompt with a custom banner so you can add Killswitch to your home screen or dock
• Dark-background app icon for a cleaner look in your dock and home screen
• PWA session now persists for 60 days across app restarts — no more re-login every time you quit

New health check system for deadman switches that validates your entire delivery pipeline before you need it.

Health Checks
• Validates items, beneficiaries, shares, and storage integrity in one click
• Async per-document S3 storage verification with live-streaming status updates
• Sequential animated reveal UI with tooltips and pass/fail/warning indicators

Test Delivery
• Send yourself the exact same email a beneficiary would receive when a switch triggers
• Verify your share links work and files decrypt correctly end-to-end
• Now also sends an SMS/WhatsApp notification if you have a phone number and SMS reminders enabled
• Modal clearly shows whether you'll receive SMS based on your account settings

Killswitch now has over 80% automated test coverage across the codebase.

• Expanded test suites covering authentication flows, encryption edge cases, deadman switch scheduling, and share link logic
• CI coverage threshold raised to 80% — builds fail if coverage drops below this floor
• Focused on integration-level tests that reflect real user journeys, not just unit-level coverage inflation

This milestone reflects our ongoing commitment to shipping reliable, well-tested software for something as critical as protecting your family's most important documents.

We've strengthened our zero-knowledge encryption across Notes and Video Messages:

• Notes now use full client-side encryption for titles, content, and previews — previously some metadata was handled server-side
• Video Message titles and descriptions are now encrypted client-side before upload, matching the same standard as file data
• Sharing and deadman switch delivery now correctly preserve decrypted filenames — shared video downloads show the original title instead of a generic name
• Various improvements to the encryption flow when sharing notes and videos with beneficiaries

These changes ensure that every piece of your data is encrypted before it ever leaves your browser.

Killswitch now automatically manages inactive accounts to keep your data secure and our platform efficient.

What's new:
- Accounts without an active subscription are automatically scheduled for deletion after 90 days
- You'll receive email warnings at 30, 15, 7, and 1 day before deletion so you never lose data by surprise
- Resubscribing at any time cancels the scheduled deletion and restores full access immediately
- All associated data (encrypted files, notes, deadman switches, shares) is permanently removed upon deletion

Legal updates:
- FAQ updated to reflect the 90-day data retention policy
- Terms of Service sections 12 and 13 updated with automatic deletion details and warning schedule

This feature runs daily via an Oban cron job. Accounts with active, trial, beta, or past_due subscriptions are never affected.

Introducing Video Messages — a new way to leave personal, heartfelt messages for the people who matter most.

• Record videos directly in your browser — No apps or downloads needed
• Attach to notes or send standalone — Add video messages to your encrypted notes, or create standalone video messages delivered on their own
• Deliver to specific beneficiaries — Choose exactly who receives each video message when a deadman switch triggers
• Same zero-knowledge encryption — Videos are encrypted client-side before upload, just like your documents and notes

Video Messages are available on all paid plans. Head to your dashboard to start recording.

Documents, notes, and video messages that are attached to a deadman switch can no longer be accidentally deleted. Attempting to delete an attached item now shows a clear error message explaining why and how to remove it from the switch first.

Similarly, documents and video messages attached to a note are now protected from deletion until detached.

Additionally, deleting a document now shows a confirmation modal — matching the existing behavior for notes and video messages — so all delete flows are consistent across the app.

Killswitch now supports feature flags powered by FunWithFlags. This allows us to progressively roll out new features to specific users or groups before making them available to everyone. Feature flags give us fine-grained control over feature availability, enabling safer deployments and the ability to quickly disable features if issues arise.

Completely refreshed the landing page with new messaging, visuals, and layout focused on protecting your family.

• New hero messaging — "Protect What Matters. Automatically." with a family-focused value proposition
• Interactive feature carousel — Three core features showcased in a sliding carousel with video demos, swipe support on mobile, and auto-advance
• Simplified "How It Works" section — 3-step breakdown: Upload Your Documents, Add Your Beneficiaries, Set Your Check-In
• Family-focused personas — Highlighting who Killswitch is built for: parents, spouses, and small business owners
• Updated SEO & meta tags — All page titles, descriptions, and social cards match the new messaging
• Added Partner Program page to the sitemap

Improved the security of our master key API endpoints based on a responsible disclosure from a security researcher.

• Credential-based master key retrieval now uses POST requests exclusively, preventing sensitive data from appearing in URL query strings or server logs
• Added strict rate limiting (5 attempts per 15 minutes) on all credential-based API paths
• Added bot defense tracking for anomaly detection on authentication endpoints

Thank you to Pramod Kumar Ravela for the responsible disclosure.

Improved the resilience and security of several backend services.

• Hardened API input validation across sharing endpoints to properly reject malformed or incomplete requests instead of returning server errors.

• Fixed a race condition in an internal caching layer that could intermittently cause login failures under concurrent load.

• Raised test coverage to 77% with new validation and resilience tests. Coverage threshold is now enforced in CI.

You can now see and manage every device signed in to your account.

• Session tracking — Every login records the device, browser, OS, IP address, and approximate location
• Active session management — View all active sessions at a glance with "This device" indicator for your current browser
• Revoke individual sessions — See an unfamiliar session? Revoke it with one click to immediately sign out that device
• Sign Out Everywhere — One button to revoke all sessions across every device and browser
• Session verification on every page — Revoked sessions are checked on every LiveView navigation, not just full page reloads
• Past session history — Revoked and expired sessions kept for 90 days for login history review
• Admin session management — Admins can view and revoke sessions for any user from the admin panel

Fixed several infrastructure security vulnerabilities:

• Blocked direct IP access - Added nginx default server block to reject requests sent directly to the server IP address. Previously, these requests were redirected to the domain, exposing backend infrastructure accessibility.

• Secured PostgreSQL access - Removed public port exposure for the database. PostgreSQL is now only accessible within the Docker internal network, eliminating risk of brute-force attacks and unauthorized access attempts.

• Secured application port - Removed public port 4000 exposure. The Phoenix application is now only accessible through nginx, reducing attack surface.

These changes follow security best practices by ensuring only nginx (ports 80/443) is publicly accessible, while all other services communicate through Docker's internal network.

Fixed a critical vulnerability in the Two-Factor Authentication (2FA) flow that could allow authentication bypass.

What was fixed:
• The `/auth/2fa/complete` endpoint now requires a cryptographically signed verification token
• Tokens are only generated after successful code validation with our verification service
• Tokens are time-limited (5 minutes) and tied to the specific user
• Bypass attempts are now logged and blocked

Impact:
Previously, an attacker with knowledge of a user's password could bypass 2FA by directly navigating to the completion endpoint. This is now prevented.

• Enhanced logout to revoke all active session tokens, not just the current session
• Added no-cache headers to prevent browsers from storing authenticated pages
• Sessions are now fully invalidated when signing out, preventing session replay attacks

Enhanced the registration flow to protect user privacy and prevent email enumeration attacks.

• Email enumeration protection: Registration no longer reveals whether an email is already registered
• Security notification emails: If someone tries to register with your email, you'll receive a notification letting you know your account is secure
• Consistent user experience: Registration provides identical responses regardless of whether an email exists

Strengthened session security to ensure all active sessions are properly terminated when you change your password.

• All session tokens are now revoked when you change your password
• Trusted device cookies (used for 2FA bypass) are now revoked on password change
• Added comprehensive test coverage for session invalidation behavior

Added WhatsApp as a messaging channel and introduced device trust to reduce authentication friction.

WhatsApp Messaging:
• Added WhatsApp as a delivery channel for notifications and 2FA verification codes
• Unified messaging preference — one setting controls both notifications and 2FA delivery
• International numbers automatically use WhatsApp for reliable delivery
• US/Canada numbers default to SMS, with option to prefer WhatsApp in Settings → Notifications
• Automatic fallback: if WhatsApp delivery fails, domestic numbers fall back to SMS

Remember This Device (30-Day Trust):
• New "Remember this device" checkbox during 2FA verification
• Trusted devices skip 2FA for 30 days while maintaining session security
• Each device token is unique and tied to the specific browser/device
• Revoke device trust anytime via Security settings ("Sign out everywhere")

Strengthened security controls across several account management features.

• Added email verification requirements for sensitive account actions
• Enhanced protection for two-factor authentication setup
• Improved security controls for password management
• Added additional verification for recovery code generation
• Updated account deletion flow with enhanced verification

We've made several behind-the-scenes security improvements to strengthen account protection:

Enhanced Session Management:
• Improved how sessions are handled during sensitive account operations
• Sessions are now properly invalidated when security settings change
• Sign-out now fully revokes authentication tokens

Admin Session Controls:
• Admins can now force-revoke all sessions for any user from the admin panel
• Useful for responding to compromised accounts or security incidents
• All admin actions are logged in the activity feed

Infrastructure Hardening:
• Reduced information disclosure in server responses
• Improved input validation on authentication endpoints

These changes work silently in the background to keep your account more secure. No action is required on your part.

Get a summary of all product updates delivered to your inbox once a week.

• Weekly digest sent every Monday at 9 AM UTC
• Updates grouped by category: Security, Features, Improvements, Bug Fixes, Announcements
• Version badges for easy reference
• Only sent when there are updates to share
• Respects your Product Updates notification preferences

Stay informed when we publish new articles without needing to check the blog manually.

• Automatic notifications when new blog posts are published
• Email includes a preview excerpt of the article
• One-click link to read the full post
• Respects your Product Updates notification preferences

After months of development, testing, and refinement, Killswitch is officially out of beta.

• Version 1.0.0 — Our first stable, production-ready release
• Public launch — Killswitch is now open to everyone
• Stability improvements — Extensive testing and bug fixes across the entire platform
• Performance optimizations — Faster uploads, quicker page loads, smoother deadman switch scheduling

Thank you to everyone who tested during beta, reported bugs, and provided feedback.

Launch Offer: Use code PRODUCTHUNT for 20% off any plan. Valid for the next 2 weeks.

Smart reminder emails to help you complete your Killswitch setup journey.

• Confirmation Reminders: If you haven't confirmed your email after 2 days, we'll send a reminder with a fresh confirmation link
• Setup Progress Nudges: Targeted emails encourage you to upload your first file, add a beneficiary, create a deadman switch, or add your phone number
• Smart Timing: Emails respect a 3-day cooldown between nudges and each type is only sent once
• Short URLs: Confirmation links now use our URL shortener for cleaner email delivery
• Nudges follow a priority order based on setup progress
• Users can opt out via notification preferences

Killswitch is now easier to discover through search engines and AI assistants.

• Dynamic Sitemap: Added /sitemap.xml endpoint that automatically generates a sitemap including all public pages, blog posts, and documentation
• AI-Friendly Content: Added /llms.txt file following the emerging standard for AI assistants
• robots.txt Updates: Configured to allow search engine crawling while protecting private routes

Launched a public blog for sharing insights on digital estate planning, security best practices, and product updates.

• New /blog section accessible from the main navigation
• Full markdown support for rich content with images
• Tag filtering to browse posts by topic
• SEO-optimized with Open Graph meta tags for beautiful link previews
• Admin interface for creating and managing posts with image uploads

Added the ability to collapse the sidebar to an icon-only view for more screen space.

• Click the collapse button at the bottom of the sidebar to minimize it to icons only
• Hover over icons to see tooltips with menu item names
• Your preference is saved automatically and persists across sessions
• Desktop only — mobile continues to use the existing drawer overlay pattern

Fixed an issue where users who navigated away during the recovery codes step of registration would lose their progress when returning.

• Registration progress now persists if you leave to save recovery codes elsewhere
• Returning to /register after completing setup now shows the completion screen with a "Go to Dashboard" button
• Recovery codes are temporarily cached in your browser session so page refreshes don't reset the form
• Login credentials are preserved through the registration completion flow

Launched the Killswitch Partner Program, powered by Dub.co.

• 20% commission on referred subscriptions
• 10% discount for your referrals on their first year
• Real-time partner dashboard with click and conversion tracking
• 30-day cookie window for attribution
• Global payouts via Stripe
• Visit killswitch.app/affiliate from your dashboard to apply
• Available exclusively to existing Killswitch subscribers

Completely rebuilt how deadman switches are scheduled and triggered, moving from a polling-based system to pre-scheduled individual jobs for each switch.

• Each switch now has dedicated Oban jobs scheduled at exact trigger and reminder times
• Reminders sent at strategic intervals: 1 day before due, grace period start, halfway through grace, and 3/2/1 days before trigger
• Jobs are automatically rescheduled when you check in
• Added hourly backup monitoring with admin alerts if scheduled jobs fail
• Improved test mode to use the same scheduling system as production (just with minutes instead of days)

Expanded subscription options with multi-year plans for more flexibility and savings.

• 1-Year Plan: Standard annual billing at base price
• 2-Year Plan: Lock in your rate and save 10% compared to yearly billing
• 3-Year Plan: Maximum savings with 15% off compared to yearly billing

Added SMS-based two-factor authentication to protect your encrypted vault with an extra layer of verification.

• SMS Verification at Login — After entering your password, you'll receive a 6-digit code via text message
• Easy Setup — Enable 2FA from Settings → Security with just your phone number
• Flexible Control — Disable 2FA anytime from security settings (requires password confirmation)
• Session Timeout — Verification codes expire after 10 minutes with easy resend option

Overhauled how tags work to make organizing your encrypted documents and notes faster and more intuitive.

• Personalized Tags — Tags are now unique to each user instead of generic across the platform
• Quick Add Suggestions — Your most-used tags appear as one-click buttons based on actual usage patterns
• Create Tags Directly — Add new tags from the Manage Tags page without needing to attach them to a document first
• Tag Merging — Combine duplicate or similar tags into one, automatically reassigning all linked items
• Live Usage Counts — See exactly how many documents and notes use each tag
• Smart Sorting — Tags sorted by usage frequency

Migration Note: Due to architectural changes for personalized tags, existing tags will need to be re-added to your documents and notes.

Implemented an in-app URL shortener to make sharing links cleaner and more privacy-friendly.

• Compact share URLs using a short /s/abc12XYZ format instead of long URLs with embedded tokens
• Shorter SMS messages that fit easily in a single text message
• Encrypted at rest using our Cloak vault, maintaining zero-knowledge security
• Access tracking with counts and last-accessed timestamps
• Automatic expiration respecting underlying share or check-in dates

All system emails now use a cleaner, modern design with better dark mode support.

• New card-based layout with clean white card design and centered logo
• Full dark mode support across Apple Mail, Gmail, and Outlook
• Green accent buttons for primary actions using our brand color

A guided onboarding experience to help you plan your digital estate, with an interactive checklist and helpful email reminders.

• Planning Guide Checklist: An interactive checklist on your dashboard with 30 items across 6 categories (Essential Documents, Financial Information, Digital Assets, Business & Work, Personal Wishes, and Access & Security)
• 8-Email Drip Campaign: Helpful emails over 60 days with guidance on each category
- Day 0: Welcome to planning your digital estate
- Day 3: Essential Documents (will, POA, healthcare directives)
- Day 7: Financial Information (accounts, investments, debts)
- Day 14: Digital Assets (passwords, emails, social media)
- Day 21: Personal Wishes (messages, funeral, pets)
- Day 30: Ready for your first deadman switch
- Day 45: Progress check-in
- Day 60: Completion and final tips
• Your grid/list view preference is now saved across sessions for Documents, Notes, and Deadman Switches
• New "Dashboard Reminders" section in Settings → Notifications to control which reminder banners appear

• Added "New Switch" button to the Dashboard Quick Actions section
• The deadman switch creation wizard now opens directly from the dashboard as a slide-out drawer
• Streamlined button labels (Upload Doc, Note, Switch, Check-In) for a cleaner 4-button layout
• Full wizard functionality available without navigating away from the dashboard

• One-click check-in from email/SMS — Check-in links now automatically reset your deadman switch timer without requiring login
• IP geolocation with timezone detection — Activity logs now capture geographic location and automatically detect your timezone
• Fixed document/note filtering — Documents and notes now properly filter to show only unassigned items when creating a new deadman switch
• Other minor UI fixes and improvements

Test switches have been completely unified with production switches. You are now treated as a real beneficiary when testing, receiving the exact same emails your beneficiaries would receive when a switch triggers.

• Unified test/production code path — Test switches now use the same TriggerWorker logic as production switches
• Self-beneficiary for test switches — You're automatically added as a beneficiary marked with "YOU" so you receive real triggered emails
• Consolidated emails — Instead of separate emails for each shared item, beneficiaries receive a single email listing all shared documents and notes with individual access links
• Document names in emails — Triggered emails now display your document's actual name instead of generic "Document" text
• Note attachment support — Notes with attachments now properly include attachment metadata when sharing through deadman switches

Killswitch now has a complete payment system. Subscriptions, upgrades, downgrades, and billing management are fully integrated.

• Stripe Checkout: Subscribe to Starter, Pro, or Legacy plans through secure Stripe-hosted checkout
• Plan switching: Upgrade or downgrade between plans at any time with automatic proration
• Free trials: New users get a 7-day trial on the Starter plan (one trial per user)
• Billing Portal: Manage payment methods, view invoices, and cancel subscriptions through Stripe's portal
• Webhook integration: Real-time subscription status sync when payments succeed, fail, or subscriptions change
• Settings billing info: View your current plan, next billing date, and trial status on the Settings page

Added infrastructure to seamlessly transition from beta testing to a paid subscription model at launch.

• New users registering during beta automatically receive full access as beta testers
• When beta mode is turned off at launch, beta users will be prompted to subscribe
• Admin settings now control the beta mode toggle for the entire platform
• Subscription status properly tracks beta vs. paid user states

Invested in testing infrastructure for a more reliable experience.

• Added comprehensive automated test suites across the application
• Implemented CI quality gates to catch issues before release
• Fixed several edge cases discovered during testing

Improved how document sharing is displayed so you can instantly understand how each share works.

• Share types are now clearly labeled with badges:
• Instant (green badge) — Recipients have immediate access
• Deadman Switch (blue badge) — Recipients will only receive access if the switch triggers

Killswitch has a brand new logo! We got tired of the current trend of flat, minimalist logos that all blur together—so we went the opposite direction. The new isometric padlock design gives off Tron vibes (or 90s vibes, depending on who you ask) with both the "K" and "S" from Killswitch integrated into the lock's geometry—K on the left, S on the right.
It's bold, it's different, and it actually looks like something worth remembering. Security software doesn't have to look boring.

All dates and times throughout Killswitch now display in your local timezone. No more mental math converting from UTC!

Times are also now shown in 12-hour format (e.g., 2:30 PM) for easier reading.

Bug Fixes
• Flash messages now automatically disappear after a few seconds
• Fixed beneficiary avatar alignment
• Improved button visibility in light mode
• Fixed printing recovery codes on some browsers
• Various admin panel stability improvements

Fixed several issues affecting notification delivery when deadman switches trigger.

• Trigger checks now run every 15 minutes (was hourly) — notifications arrive faster after grace period ends
• Fixed duplicate emails being sent to beneficiaries
• Fixed SMS notifications not being sent despite valid phone numbers
• Owner trigger alerts now always send regardless of email preferences
• Beneficiaries with phone numbers now receive SMS when you share documents

Fixed an issue where users who experienced an interruption during account registration (particularly on mobile browsers) could end up with an account but without encryption set up.

• Added automatic detection of accounts missing encryption setup
• Users without encryption are now gracefully redirected to complete setup when accessing encrypted features
• New streamlined setup flow for existing users — just enter your password once to enable encryption
• Server-side password verification ensures secure setup completion
• Improved error handling prevents silent failures during encryption setup

Redesigned reminder notification schedule to be less frequent while ensuring you never miss a critical check-in.

• Before check-in deadline: Now just a single reminder 1 day before (previously sent at 5, 2, and 1 days)
• Grace period reminders now scale with length:
- Notification when grace period starts
- Reminder at the halfway point
- Daily reminders only in the final 3 days
- Result: A 14-day grace period now sends ~6-7 reminders instead of 14 daily messages

Fixed several issues with the deadman switch share repair functionality:

• Fixed duplicate shares being created when clicking "Repair Shares" button - the repair modal was being rendered twice, causing shares to be created in duplicate
• Fixed note shares created with wrong trigger_type - notes shared via deadman switch were incorrectly getting trigger_type: "immediate" instead of trigger_type: "deadman_switch"
• Fixed notes with attachments failing to create shares - the attachment data wasn't being properly loaded before JSON encoding
• Added missing duplicate prevention to the note share controller API endpoint, matching the existing logic in the document share controller

We've made share links for deadman switches more reliable and self-healing. Your beneficiaries will always get access to your files when it matters most.

• Automatic share repair — If share links are ever missing, we'll detect and recreate them automatically when you add items or beneficiaries
• No more duplicates — Adding the same item multiple times won't create duplicate share links cluttering your switch
• Cleaner document deletion — When you delete a document, any orphaned share links and switch associations are automatically cleaned up
• Visual status indicators — See at a glance which items and beneficiaries have their share links ready with new "Secured" badges

Behind the scenes, we've also added comprehensive test coverage for all the new share link logic to ensure everything works reliably.

SMS notifications are now live!

Get text message reminders for your deadman switches:
• All Reminder Levels - Receive SMS for every check-in reminder (5 days, 2 days, 1 day before due)
• Grace Period Alerts - Critical notifications when you miss a check-in
• One-Click Check-In - Tap the link in the SMS to check in instantly
• Easy Setup - Just add your phone number in Settings > Notifications

SMS works alongside email notifications to ensure you never miss an important check-in. Enable it in your notification settings today!

We've completely redesigned the landing page with a modern, conversion-focused layout. The new design puts product videos front and center to show you exactly what Killswitch does.

• New scroll-triggered animations that bring the page to life
• Auto-playing feature videos that play as you scroll through each section
• Responsive glass/shimmer effects on video placeholders
• Redesigned problem/solution messaging focused on peace of mind
• Streamlined "How It Works" section with step-by-step cards

Added four new product demonstration videos to the landing page, walking through each core feature:

• Hero video: "See Killswitch in Action" - full product overview
• Feature 1: "Zero-Knowledge Encryption" - shows the upload and encryption process
•Feature 2: "Secure Notes Demo" - demonstrates rich text notes with attachments
• Feature 3: "Deadman Switch Setup" - configuring check-in schedules
• Feature 4: "What Happens When..." - automatic transfer flow to beneficiaries
• "How It Works" video: complete walkthrough of the signup experience

Updated the navigation bar with scroll-aware behavior and improved accessibility across all pages.

• Navbar now hides when scrolling down and reappears when scrolling up
• Added aria-labels to interactive elements (toggle buttons, collapse menus)
• Improved form field labeling for screen readers
• Fixed color contrast issues on avatar badges and error text
• Added proper heading hierarchy throughout the site

The Under the Hood (/under-the-hood) page now shares the same navigation and footer styling as the rest of the site for a consistent experience. Technical details about our encryption architecture remain unchanged.

Resolved issues preventing deadman switch shares from being created properly when the master key wasn't cached in session.

• Added password prompt when master key is not available in session storage
• Fixed password trimming to prevent authentication failures from copy-paste whitespace
• Applied whitespace fix across all password input flows (sharing, note encryption/decryption)

Improved the file upload experience to make encryption more visible and trustworthy. During file uploads, a new animated encryption indicator shows a glowing lock icon with spinning rings while your files are being encrypted in-browser, followed by a bouncing upload indicator during the secure transfer.

• Animated encryption stage with glowing lock icon and dual spinning rings
• Animated upload stage with pulsing glow and bouncing arrow
• Visual progress bar tracks both encryption and upload phases
• Lock icons added to files and notes in collection views indicate encryption status
• Documents and notes now sort with most recent items first
• Increased file upload limit to 200MB for Business plan users
• Fixed dashboard crash when selecting documents for notes
• Fixed deadman switch countdown timer display in urgent mode

Deadman switches now support a second trigger action: permanent file deletion. Previously, all switches would share files with beneficiaries when triggered. Now you can choose what happens when you don't check in.

• Share (default) — Files are securely shared with your designated beneficiaries
• Delete — Files are permanently deleted from both the database and cloud storage
• Choose trigger action when creating a switch — "Share with beneficiaries" or "Delete permanently"
• Beneficiaries are optional for delete switches — add them if you want others notified that files were deleted
• Owner receives confirmation email listing all deleted files
• Delete switches show a red "Delete" badge throughout the UI
• Full dark mode support for all notification emails

Note: Delete switches in test mode will actually delete your files. We recommend uploading test files specifically for testing delete switches.

SMS notifications are coming soon! We're currently waiting for A2P 10DLC carrier approval.

• "SMS Coming Soon" banner in the sidebar to keep you informed
• Direct link to notification settings at /settings/notifications
• Add your phone number now so you're ready when we launch
• Full opt-in documentation for carrier compliance
• Improved phone number validation using Google's libphonenumber
• Consolidated phone validation code for better maintainability
• New CDN support for product screenshots

Fixed crash when pausing/resuming deadman switches. When resuming a switch that has been paused past its trigger date (grace period expired), the timer is now automatically reset to give you a fresh countdown instead of triggering immediately. You'll see a message confirming the timer was reset. Switches resumed while still within the grace period will continue their countdown from where they left off.

Implemented complete account deletion functionality that permanently removes all user data from the system. When a user deletes their account, all associated data including files, notes, shares, deadman switches, and recovery codes are automatically cascaded and permanently deleted. An audit log entry is created before deletion to maintain a record that the account existed and was removed by the user.

We've added a changelog feature so you can stay up-to-date with all the latest improvements and updates to Killswitch.

• Browse all product updates in one place
• Filter by category (features, improvements, bug fixes, security, announcements)
• Version badges for easy reference
• Accessible from the sidebar and footer

Check out the full history of updates to see how far we've come!

Fixed an issue where updating beneficiaries on existing deadman switches wasn't saving correctly. Changes to beneficiary email addresses and names now persist properly when editing a switch.

Never lose your work again! We've added automatic form state recovery across the application.

Key features:
- Auto-save form data every few seconds to browser storage
- Automatic recovery after page refresh or browser crash
- Works on file uploads, notes, deadman switches, and settings
- Recovery prompt appears when unsaved data is detected
- One-click restore or dismiss options

Fixed several issues with the mobile experience:
- Improved responsive layouts
- PWA installation support
- Service worker for socket connection
- Touch-friendly navigation

Welcome to the Killswitch beta! We're excited to have you testing our zero-knowledge encrypted document storage with deadman switch functionality.

Core features in this release:
- Zero-knowledge encrypted document storage
- Secure notes with rich text editing
- Deadman switch system with automatic beneficiary notifications
- Recovery code system for account recovery
- PWA support for mobile devices

Thank you for being part of our beta program!

New admin tools for better platform management:
- Comprehensive activity logging with filtering
- User management dashboard
- Beta whitelist management
- Deadman switch monitoring
- System settings control

Account recovery is now possible even with zero-knowledge encryption:
- Generate recovery codes during setup
- Regenerate codes at any time from settings
- Use codes to recover access if you forget your password
- Each code can only be used once for security

Several security improvements have been implemented:
- Honeypot defense against automated attacks
- IP-based rate limiting
- Maintenance mode for planned downtime
- Improved CSP (Content Security Policy)
- Paraxial security monitoring integration

Share encrypted documents securely with anyone:
- Generate password-protected share links
- Set expiration dates for shares
- Email notifications to recipients
- Revoke access at any time
- Track when shares are accessed

The core deadman switch functionality is now live:
- Create switches with custom check-in intervals
- Attach documents and notes to switches
- Add multiple beneficiaries
- Automatic email notifications when triggered
- Countdown timer with grace period

Industry-standard encryption for your documents:
- Client-side AES-256-GCM encryption
- Wrapped master key architecture (same as 1Password, Bitwarden)
- Server never sees your encryption keys
- Fast password changes without re-encrypting files
- PDF and image preview for encrypted files

Rich text notes with full encryption:
- Trix editor for formatting
- Attach documents to notes
- Tag organization
- Share notes as encrypted files