Skip to content
Cra

Cra 0.1.1127 October 2026

Your passwords, locked in your Keychain

Two security fixes, both reported by Rainatsu: Cra’s saved passwords and cookies are now protected by your Mac’s Keychain, and web pages can no longer run Cra’s scripting commands.

Passwords and cookies protected by your Keychain

Cra encrypted saved passwords and cookies with a key every copy of Cra shared, so anyone who could read your Cra folder could decrypt them, including passwords you imported from Chrome, Arc or Dia. They are now encrypted with a secret of Cra’s own in your Mac’s Keychain (“Cra Safe Storage”). The first time you open this version, Cra moves everything over before it starts. You stay signed in, and there is no password prompt. Reported by Rainatsu.

More windows, and incognito

An incognito window, dark with its own Incognito space

⌘N opens another window on the space you’re in, and ⇧⌘N opens an incognito window whose tabs are never saved. A tab moves between windows without reloading. Closing the last window keeps Cra as it was, so a Dock click brings it back.

Profiles

Settings ▸ Profiles listing the Default profile and the spaces that use it

Settings ▸ Profiles lists your profiles and how many spaces use each. Create one there, then pick it for a space in Edit Space to keep its sign-ins and cookies apart.

Tab switcher

Hold ⌃ and press Tab to flip through your five most recent tabs in the space, with a preview of each, like ⌘Tab for apps. Release ⌃ to switch, or press Esc to stay.

Arc’s downloads

A download flies into a bin on the Library button, and hovering the button shows your recent downloads. Chrome’s hidden download popup no longer swallows your next click.

What else is new

  • cra:// links are locked down

    A page could open a cra:// link in a new tab and run Cra’s testing commands with one click: open local files, press keys, or send DevTools commands. Pages can no longer reach cra:// at all, and links from other apps only open the command bar or an http(s) page. The full scripting commands stay available from the shell after running defaults write dk.kildahl.cra scriptingURLs -bool YES. Reported by Rainatsu.

For every change in 0.1.11, see the changelog.

Past releases