Changelog

What changed, and when.

Customer-visible changes only.

October 2026

• Kionel is open source. The code is published on GitHub under AGPL-3.0; the record verifiers stay Apache-2.0. Every feature is now available without a licence file: signed records, reports, the audit chain, the fast recording mode, 60 printed pages and the serial cable. Purchases, licence files and subscriptions have ended; a commercial licence is available for closed-source products. Entries below describe the product as it was at the time.
• Files that travel by USB can be signed for. A file sealed on the sending PC can now be checked and signed for on the receiving device when it arrives another way: on a USB stick, over a share, by hand. Add the sealed record and the file under Receive; if the file matches, the device signs the same delivery receipt as for an optical transfer, and if it differs it signs nothing. The file itself is not encrypted on the way, and the result says so. Keep the USB stick, add the proof.
• The receiver can accept only pinned senders. Until now a receiving device verified the signature on every file and recorded which key signed it, but did not decide who may send. After a delivery it can now pin that sender: from then on a file signed by any other key is refused, with the key named, and nothing is saved. Further senders can be added from the refusal message, and the list can be cleared. There are no certificates; this is key pinning, as in SSH. On a serial link, a transfer that is replayed byte for byte is recognised from the transfer log and not delivered a second time. Thanks to the reader who asked how the sender is authenticated.
• NIST SP 1334, control by control. A new guide goes through NIST's 2025 list of controls for portable storage media in OT and says which a transfer without a medium covers, which stop applying, and which it does not cover: NIST SP 1334 and moving files without a USB stick.
• One-way links: did everything arrive? A one-way cable or a data diode cannot tell the sending side that a file arrived. The verifier now takes the signed records of both sides and lists every file the sender signed with its verified receipt, or without one. It runs in the browser, offline, and needs no licence to check.
• Faster live reading. The receiving device used to decode one camera picture at a time and skip the pictures that arrived meanwhile. It now decodes several at once, on separate processor cores, so more of the codes the screen shows are actually read. Nothing changes on the sending side. Phone measurements will be added to the measurement page when we have them.
• A test anyone can repeat. How fast is file transfer by QR code? describes a repeatable test, lists what we have measured ourselves, including a failure, and keeps it apart from the figures other projects report for themselves.
• Kionel Link, and a USB parts list. The one-way serial link can be built between two USB ports from two adapters and two wires; the guide lists the parts. 1,500,000 and 3,000,000 baud are offered as experimental speeds, not yet measured on hardware.
• Free tool: what is inside a QR code. Drop a picture of a QR code and see what it would give away: a Wi-Fi password, the secret behind one-time login codes, a link with a token, or data that only looks encrypted. It is read in the browser and nothing is uploaded. The tool does not try to undo any scrambling, and says so when it cannot tell scrambled from encrypted. Open the tool.
• Delivery receipt by sound. A sending PC without a camera could not read the delivery receipt back, so the proof stayed on the receiving device. Now the file goes by light and the proof comes back by sound: with a business licence, the receiving device plays the signed receipt as about four seconds of tones, and the PC checks the receiver's signature against the file it sent and shows Delivery verified. Only the signature, its time and the transfer number travel by sound; a recorded or imitated receipt does not match and is refused. How it works.
• Pair by sound. A sending PC with a microphone but no camera no longer needs a typed code: the receiving device plays its pairing offer as about six seconds of tones, the PC hears it and shows a reply code, and both screens show the comparison code as usual. Only the public pairing offer travels by sound; the secret transfer code is never played. The microphone is used on that page only and nothing is recorded. How it works and when it will not.
• Colour code: honest about where it works. Tested on a real phone filming a 24-inch monitor, the colour code read none of 429 images, while the same transfer from a clean screen recording read 94%. The app now says so when you choose it, tells the sender to go full screen, and reports how many images were tried and read. A recording that collected part of the file is no longer reported as "no codes found"; what was collected is kept.

September 2026

• Unattended folder link over a serial cable. With a business licence, a PC can watch a folder and send every new or changed file over a one-way serial cable, encrypted to the receiving computer's card and signed; the receiver keeps listening and writes each file with its receipt into its folder. Files already in the folder are left alone unless you ask. This is the first step towards a software one-way link for OT; priced per link, ask us.
• Printed pages in the free edition. The personal edition prints and reads up to 5 pages of codes (about 19 KB standard, 57 KB dense); a business licence raises this to 60 pages and opens photos and scans of the pages. When a file does not fit, the app says whether Dense would fit it.
• Which side am I on? Sending is teal and receiving is sky blue, on the tab, the section and its buttons, and a bar at the top of the screen says This device is SENDING or RECEIVING while you scroll.
• Printed pages: the code can come last, and a wrong code no longer costs a rescan. In a real test the receiver still held the code of an earlier transfer, collected the whole file, and could only report that the code did not open it. Now choosing Printed pages never reuses an old code; the pages can be scanned first and the code entered when Kionel asks for it; and a wrong code keeps everything read, so entering the right one opens the file at once. The same applies to a screen recording read later: type the right code and it opens without reading the video again. Each page of codes now fits on one sheet of A4 or Letter, with or without the browser's header and footer.
• Step-by-step guide on both screens. Choose how the file leaves the PC (screen, paper or serial cable) and the steps for that route are listed in order; finished steps are ticked, the next one is highlighted, and Show me scrolls to the control it needs. The receiving screen does the same, and has its own choice for printed pages.
• Printing fixes from the first real test. Pages could come out without their codes when the print dialog opened before the images were ready; printing now waits for them. The code for the pages is shown in large letters with a button to hide it, and after the code is entered on the receiver the camera view is brought on screen.
• Faster live reading. After the first code is found, the camera reads only the part of the picture around it, with a full-picture check every ten frames. In our slowed-down test (a phone-speed processor, 200 KB) delivery went from 35 to 27 seconds. We will publish phone measurements when we have them.
• Print a file as codes. A PC with only a printer can now send: the file is printed as pages of encrypted QR codes, and any phone reads them back in any order. About 30% of the codes are spares chosen so that any smudged code can be replaced. With a business licence, photos or scans of the pages can be opened too. The same pages work as a paper backup. The receiver also finishes sooner on every route: when only a few blocks are missing, it now solves them from what it already has instead of waiting for more codes.
• Send over a serial cable. With a business licence, a PC can send to another computer over an RS-232 or USB serial cable instead of the screen. With the return wire left out, nothing can travel back: a low-cost one-way link, up to about 80 KB/s. Same encryption, same signed records; it works from the offline package. See the serial data diode guide for wiring and speeds.
• Excel damage check. A free page that finds what Excel leaves in a CSV: gene names and decimals turned into dates, IDs in scientific notation, digits lost after the 15th, removed leading zeros and garbled characters. With the original file as well, it lists every changed cell and why. The file is read in the browser and never uploaded. English and Turkish.
• Honest speed figures. Pages that said "about 30 KB/s live" now give our measured result instead: a 117 KB file in 10 to 24 seconds live and about 7 seconds from a screen recording, with the speed calculator for other sizes.
• File names from the signed record. When received files are saved to a folder, they can be named from the record instead of the sender's name, for example {workorder}_{name} gives WO-004213_results.csv. Fields: name, work order, classification, operator, date and time. The receipt follows the file's name, and nothing is overwritten.
• Operator in the signed record. The sender can enter who is doing the transfer, a name or an ID. It is signed into the dispatch record with the work order, shown on the receiver and on the verify page, and kept in the transfer log, its CSV and the review report. A site policy can make it mandatory. It is what the person declared, not a login. A record that carries an operator needs Kionel from this version on the receiving side; older versions refuse it rather than show it without the name.
• Site policy. A quality or IT unit can load a small policy file that refuses files outside the allowed types or size, and work orders or classifications that do not match its rules, before anything is sent. The transfer log records which policy applied. See the site policy page for the fields and an example.
• Transfer log and periodic review. With a business licence, every file a device sends, receives or seals is kept in the browser with its signed record. Choose a period to export it as CSV (safe to open in Excel), print a review report with fields for the reviewer's signature, or download the signed records themselves.
• Speed calculator, and an honest name. A calculator on the site uses the app's own formulas. Doing the sums showed the colour code is not faster on paper than the dense QR recording; its strength is how reliably it reads from a phone video, so it is now called Robust instead of Fastest.
• A clearer hint when the code is missing. If the receiving camera sees a Kionel transfer it has no code for, it now says which option to choose instead of waiting silently. The offline package also carries its own fonts, so it looks the same with no connection.
• Guides in one place. All guides are listed on a new Guides page, and English and Turkish versions of the same guide now point to each other.
• Colour code in the offline package. The colour code now works in the offline package too, from a PC that never goes online. libcimbar's files are embedded unchanged; the package still makes no outside connection.
• Reading a recording survives switching tabs. Browsers stop handing video frames to a page in the background, while the video keeps playing; a reading at 99% failed that way when the user switched tabs. Reading now pauses while the page is in the background and continues when you return. A recording opened without the transfer's code now says the code is missing, instead of that no codes were found.
• Clearer help when a recording cannot be read. Messaging apps shrink videos (one test video arrived at 478×850); dense codes cannot be read at that size. Kionel now says so as soon as such a video is opened and suggests copying the original. When only a few codes are read, it no longer suggests filming for minutes longer, since the picture, not the length, is the problem. The stopwatch now also stops when a recording ends without a delivery.
• Fixed: our host added an analytics script. Cloudflare's free plan inserts its own analytics script into HTML pages at the edge, without it being in our code. On our pages the site's security policy stopped it from running, but it was also inserted into offline packages downloaded with a browser, which is why their SHA-256 did not match. Every response is now marked so it cannot be changed on the way, and the offline package carries its own security policy that blocks any outside script or connection. If you downloaded version 1.0.3 in a browser before this fix, check its SHA-256 and download it again.
• Several files at once. Select several files together and they travel as one ZIP, with MANIFEST-SHA256.txt inside listing each file's SHA-256; the signed records cover the whole ZIP, so the list is signed too. It opens with any unzip tool, and sha256sum -c checks the files.
• Validation pack. A printable IQ/OQ protocol for the offline package: scope and SHA-256, requirements with traceability, test scripts with blanks for results and signatures. The offline package also works as a receiving computer with a webcam, so both sides of a validated setup can run the same fixed version.
• Trusted timestamps. On the receiving device, each receipt can carry an RFC 3161 timestamp from DigiCert. Only the receipt's fingerprint is sent; the token is verified in the browser, on the verify page and by the offline verifier.
• Save straight to a folder. On a receiving computer with Chrome or Edge, received files and their signed receipts are written into a folder you choose, such as one your LIMS imports from. Nothing is ever overwritten.
• Colour code reading fixed. Camera frames were sometimes handed to the decoder before they had been copied, so they arrived empty; this hit phones hardest and made colour codes read on some attempts and not on others. Live reading of colour codes remains experimental.
• Start over, and a stopwatch. While sending for a recording, Start over restarts the countdown for a receiver who missed the start. Both sides show elapsed time; the receiver's stops at delivery and is repeated in the message.
• Offline package. Kionel as one HTML file for PCs that never go online: checked by its SHA-256, opened in the browser, never updates itself. Each version keeps its own file.
• SHA-256 checker. A free page that gives a file's SHA-256 in the browser without uploading it, with the equivalent command for each system.
• Clear message on old browsers. Kionel needs Chrome or Edge 137 or later, Firefox 130 or later, or Safari 17 or later. On an older browser it now says so when it opens, instead of failing when you press Send.
• Seal on paper. A sealed record can be printed together with its code. The code on paper can be scanned later with any device running Kionel, so the proof leaves the offline PC without a second device being there at that moment. The file itself is never in the code.
• Film now, read later. The two devices do not have to work at the same moment: film the sending screen with the receiving device's camera app, then open the video hours later — on the same or another device — and type the code. Checked end to end, including a wrong code being refused.
• Animated guides. Each way of sending, receiving, sealing and moving the licence is shown as a short animation of its steps, in the app and on the How it works page.
• Colour code. A third sending option, "Fastest — colour code", carries the same encrypted envelope in libcimbar colour barcodes (MPL-2.0). In our browser test almost every recorded image was readable (98–99.5%), against about half for dense QR codes; the receiver recognises the colour code by itself and decodes on several threads, so a recording is read as fast as it plays.
• Flashing-image warning. Sending shows rapidly changing images; a warning about photosensitive epilepsy now appears before a transfer starts.
• Full screen on the sending device, for larger, easier-to-read codes.
• Read from a screen recording. The phone records the sending screen with its own camera app; Kionel reads the recording at its own pace. In a browser test with ideal recordings a 1 MB file needed 16 seconds at 60 codes a second; on real phones, which usually record at 30 fps, the default is now 20 codes a second and the sending screen counts down how long to film. A recording that ends early is not wasted: the next one continues from there. Two presets on the sender — "Phone reads live" and "Phone records the screen" — set the code density and frame rate.
• Honest progress bar. Progress now counts the codes received, not only the blocks already solved, so it no longer sits near zero until the last moment.
• Machine-checked protocol models. The two-way, typed-code and receiver-card modes are modelled in ProVerif; results, assumptions and the models themselves are on the security page.
• PC without a camera: send with a typed code. The receiving phone shows a one-time code; the PC sends by screen only. Receiver cards remain for fixed device pairs, and a phone can retire its card key.
• Compression. Files are compressed before encryption when it helps; CSV and text shrink four to ten times. One-way transfers no longer carry base64 overhead.
• Printable report. Every dispatch record and receipt can be printed or saved as PDF, re-verified at print time.
• Browser verifier. kionel.com/verify.html checks a receipt or dispatch record, and optionally the file, without uploading anything.
• Clearer messages. Success, warnings and errors appear at the top of the screen; loaded files show as loaded; the time a file will take is shown before sending.
• Camera on/off on the receiving device at any time.
• Fix: files above roughly 100 KB failed in one-way mode ("Maximum call stack size exceeded").
• Fix: a failing offline cache could stop pages from opening; the cache can no longer block a page.
• One-way transfer. A sender without a camera, such as a desktop instrument PC, can now send; the receiver no longer has to show a code back.
• Works offline after the first visit. The transfer app is cached on the device and runs with no network at all.
• Clearer start. The app explains that two devices are needed and shows a code to open the page on the second one, instead of an empty camera frame.
• Licence warnings. The licence line turns amber 30 days before expiry and during the 14-day grace period, and states the days left.
• Clock rollback resistance. Setting the device clock back to stretch a licence is detected and shown on screen.
• Annual subscription. Each renewal delivers a new signed licence file, downloaded with your licence key.
• Command-line tools for signing dispatch and delivery when the file travels by another route.

August 2026

• Enterprise protocol (v2). P-256 signatures with canonical low-S form, enrolment trust bundles and a control plane contract.
• Hardware-backed keys. Windows TPM key bridge and Android attestation verification; production enrolment is not yet shipped.
• Device qualification. A signed matrix of how a sender and receiver pair actually performed.