Version 2026 Updates

We are pleased to announce the full release of version 2026 across our product line! In this update guide, we provide an overview of all the new features and updates for every toolkit. We welcome you to download the latest version of all products and try them for yourself.

Download Products

This guide provides details about new functionality that applies to all libraries as well as details applicable to individual products.

Contents

• Overview
• Product Details
• API Changes

Overview

2026 brings several changes that apply broadly across the entire product line, ahead of the toolkit-specific highlights further down.

Post-Quantum Cryptography Everywhere

Post-quantum algorithm support is no longer limited to the cryptography-focused toolkits. Every TLS- and SSH-enabled component across the product line now supports post-quantum key exchange and signature algorithms, so applications built on any /n software component can support PQC without waiting on a component-by-component rollout. IPWorks PGP and IPWorks Encrypt go a step further with dedicated post-quantum components and algorithm support, covered in their respective sections below.

For more details please refer to this Post Quantum Cryptography Support article.

New Go and Rust Editions

New Go and Rust editions are now available for the majority of our products. Go and Rust editions maintain the same intuitive API present in existing C++, Java, and .NET editions and provide a consistent developer experience. These new editions expand the capabilities of two of the fastest-growing languages in modern development.

Performance and Usability Improvements

We've continued to invest in general performance and usability across the board this release - from faster default compiler settings in the C++ editions, to more consistent and self-documenting APIs achieved by promoting long-standing configs to full properties and methods, converting integer flags to enums, and cleaning up inconsistent naming. Many of these show up as small, individual changes in the toolkit-specific sections below, but together they add up to a more polished experience across the entire product line.

Product Details

All products benefit from the major highlights listed above, such as new Go and Rust editions and support for Post-Quantum Cryptography. The sections below detail additional new product-specific features and improvements.

IPWorks LLM

IPWorks LLM is a new toolkit, now available in beta, for adding large language model (LLM) capabilities to your applications.

Native Provider Components

The OpenAI, Anthropic, and Gemini components model each provider's API directly. They cover chat, streaming, tool calling, embeddings, token counting, and model listing. The same components work with any OpenAI-compatible endpoint, including Ollama, vLLM, DeepSeek, Groq, and Azure OpenAI, and with locally hosted models that require no API key.

Provider-Neutral LLMClient Component

The LLMClient component holds the conversation, the tools, and the reply in a provider-neutral form, and translates them to and from the API of the selected provider. Switching between OpenAI, Anthropic, and Gemini requires changing a single property, and an existing conversation can be continued with a different provider. Messages can include text, images, and files, and replies can be constrained to a JSON Schema for structured output.

Content Credentials (C2PA)

The C2PASigner component creates a signed C2PA manifest that records who produced an asset, which tool produced it, and whether generative AI was involved, and embeds it in JPEG, PNG, and PDF files. The C2PAVerifier component reads those manifests and reports the result of each validation check: whether the signature is intact, whether the signer is trusted, and whether the content still matches what was signed.

IPWorks

IPWorks continues to build on the foundation of the toolkit with a number of API refinements, security defaults, and platform updates that apply across the product line.

Security and Reliability Updates

CertMgr and the Certificate class now report the EffectiveDate and ExpirationDate properties in UTC rather than local time, removing a common source of confusion around time zones and daylight saving time. TCPServer in the C++ edition now assigns unique connection IDs by default instead of reusing IDs from disconnected clients, which resolves subtle issues in server implementations that track connections by ID. FIPS mode has also been tightened: AllowPKCS1InFIPS now defaults to false. Additionally, the default value of FirewallHTTPVersion has been changed from HTTP/1.0 to HTTP/1.1.

API and Usability Improvements

Several long-requested API gaps have been closed. The POP component now includes a ResetState method to reset server-side session state, separate from the existing Reset method which only resets local component state. The WSClient component now includes PauseData and ProcessData methods to temporarily pause communication. The XML component adds an Interrupt method so that in-progress document parsing can be stopped. Email-based components now include OAuth capabilities directly without the need for using the standalone OAuth component.

DTLS Components

The DTLSClient and DTLSServer components, previously available in the separate IPWorks DTLS toolkit, are now included in IPWorks. They provide secure UDP communication over the Datagram Transport Layer Security (DTLS) protocol. DTLSClient connects to DTLS servers, and DTLSServer accepts incoming DTLS connections, with the same certificate handling as the other TLS-enabled components. Please see the Secure UDP with DTLS article for more information.

IPWorks SSH

IPWorks SSH includes refined connection handling and modernizes several defaults to better match current SSH client conventions.

Server and Key Management

SSHServer's SSHCert property has been changed from a single value to a collection, allowing multiple host keys (for example, both an Ed25519 and an RSA key) to be configured at the same time. This preserves compatibility with legacy clients while using modern keys with clients that support them.

Fingerprint Format Updates

The default encoding for server host key fingerprints reported by the SSHServerAuthentication event and the SSHFingerprintSHA256/SHA1/MD5 configs has changed from hex to base64 to match the format used by most modern SSH clients. The SSHAcceptServerHostKeyFingerprint config now accepts fingerprints in either hex or base64 format as well.

SFTP Improvements

The SFTPClient component now includes CopyRemoteFile and CopyRemoteData methods to copy files remotely without needing to download and re-upload the file. This functionality may be used with servers that support the copy-data extension.

IPWorks EDI

IPWorks EDI has been updated with support for AS2 version 1.3, and general cleanup to keep the toolkit aligned with current EDI practices.

The AS2 default encryption algorithm for AS2 profiles has moved from 3DES to AES-CBC-256. For AS2 version 1.3 specifically, outgoing messages now reject weak digest, MDN MIC, and encryption algorithms, and incoming messages and generated MDNs are held to the same standard. AS2 1.3 messages and MDNs also now include an AS2-Product header. The AS2Version property defines which version is enabled. For compatibility, AS2 Version 1.2 is the default and AS2 Version 1.3 may be optionally enabled.

IPWorks NFS

IPWorks NFS includes updated support for NFSv4.1. NFS 4.1 is fully supported including robust support for NFS sessions. This update also includes a number of performance improvements to transfer speeds.

IPWorks PGP

IPWorks PGP includes numerous updates including support for Post-Quantum Cryptography and enhanced interoperability.

Post-Quantum Cryptography Support

IPWorks PGP now supports the post-quantum algorithms defined in RFC 9980: ML-KEM-768+X25519 and ML-KEM-1024+X448 for encryption, and ML-DSA-65+Ed25519 and ML-DSA-87+Ed448 for signing. When one of these algorithms is selected, the associated curve is implied by the algorithm name and the Curve/SubKeyCurve configs no longer apply. GnuPG's own ML-KEM variant is also supported for interoperability with recent GnuPG builds.

GnuPG v5 Interoperability

GnuPG has adopted its own LibrePGP standard rather than the OpenPGP v6 format defined in RFC 9580. To maintain interoperability, a new CompatibilityProfile config has been added to KeyMgr and OpenPGP, allowing you to switch between the standard "RFC9580" profile (the default) and "LibrePGP". Messages and keys in either format can be parsed regardless of which profile is active.

IPWorks VoIP

IPWorks VoIP improves audio handling and adds presence-style status subscriptions.

Busy Lamp Field Support

New SubscribeUserStatus and UnsubscribeUserStatus methods, along with a UserStatusChanged event, allow an application to monitor the call status of other endpoints (idle, ringing, in a call, and so on) and be notified as that status changes - commonly known as Busy Lamp Field (BLF) functionality. The initial implementation has been tested against FreePBX.

Audio Handling Improvements

The Record event now includes a Direction parameter indicating whether an audio frame is incoming or outgoing, replacing the previous AudioDirection config. AudioEncoding has been promoted from a config to a full property, and EnableDynamicRecording now defaults to true.

IPWorks BLE

IPWorks BLE adds the new BLEServer component for hosting a GATT server (peripheral) in your application. BLEClient connects to the services exposed by other devices. BLEServer works in the other direction: the application defines its own services, characteristics, and descriptors, advertises them, and responds to read, write, and subscribe requests from connected clients. Please see the BLEServer Getting Started Guide for more information.

Secure PDF

Secure PDF continues the modernization of the PDF signing, forms, and editing API.

Improved Remote Signing Support

This release updates the remote signing capabilities of the PDFSign component, which allow the PDF itself to remain local while signing is performed remotely. The RemoteSignatureMethod, RemoteSignatureDigest, and RemoteSignatureData configuration settings have been promoted to full properties, and the old settings are now deprecated. Please see the PDFSign Getting Started Guide for more information.

PDF/A and ZUGFeRD Improvements

The EnforcePDFA and PDFALevel configuration settings have been merged into the new PDFAConformanceLevel property in all applicable components. It provides a simpler way to set the PDF/A conformance level when creating new documents with PDFForm or PDFEdit, while still preserving the conformance level of existing documents by default.

The AddAttachment method also adds an AttachmentType parameter. Its patElectronicInvoice value creates a ZUGFeRD-compliant invoice in one line of code. For more details, please see the Creating ZUGFeRD Invoices with PDFEdit article.

Font Management

The new FontLookup event and the FontPolicy and UsedFonts configuration settings in the PDFForm and PDFEdit components make font management configurable and add more fallback options when fonts are missing. Further font compatibility updates improve the default font choices of the components, such as in text search and replace operations.

IPWorks Zip

IPWorks Zip adds new Zstandard and LZ4 compression components and support for batching multiple Zip modifications into a single pass.

New Zstd and Lz4 Components

The new Zstd and Lz4 components implement the Zstandard format (RFC 8878) and the LZ4 Frame Format. Unlike the archive components, they have no concept of file names, archive headers, or multiple entries. They operate on a complete block of data or a stream, which suits compressing data in memory or over a network connection. Lz4 favors speed over compression ratio, while Zstd achieves a better ratio for a similar amount of effort. Both components share the same API and produce standard output that can be read by any compliant implementation, including the zstd and lz4 command-line tools. Please see the Zstd and Lz4 Getting Started Guide for more information.

Batch Operations

The Zip component adds StartBatch, ProcessBatch, and AbortBatch methods. Once a batch session is started, AppendFiles, Delete, and Update operations are queued in memory rather than applied immediately; ProcessBatch then rewrites the archive once with the final queued state, avoiding repeated decompress/compress cycles when making several changes at once. AbortBatch discards any queued operations and leaves the archive unchanged.

IPWorks Encrypt

IPWorks Encrypt significantly expands the toolkit's cryptographic primitives, with a particular focus on post-quantum readiness.

New MLKEM Component

The new MLKEM component implements the FIPS 203 key-encapsulation algorithm. All three standard parameter sets are supported (512, 768, and 1024, selected via the ParamSet config), and the component exposes CreateKey, Encapsulate, and Decapsulate methods.

New MLDSA Component

The new MLDSA component implements the FIPS 204 signature algorithm. All three standard parameter sets are supported (44, 65, and 87, selected via the ParamSet config), along with both pure ML-DSA and pre-hashed HashML-DSA signing; SHA256, SHA384, and SHA512 are available as hash algorithms for the pre-hashed mode.

New CMAC Component

The new CMAC component adds AES-CMAC support, with platform-accelerated implementations available via CNG on Windows and FIPS-validated implementations available across the Java, .NET, and C++ editions.

New HMAC Component

The new HMAC component provides full support for Hash-Based Message Authentication Code including support for SHA1, SHA256, and SHA512.

JWT Updates

The JWT component adds SignAndEncrypt and DecryptAndVerify methods along with a new SigningKey property, which is used for the HMAC signature step while the existing Key property continues to be used for AES encryption.

IPWorks Auth

IPWorks Auth 2026 includes the WebAuthn component, previously available as the separate IPWorks WebAuthn toolkit. The WebAuthn component implements a WebAuthn Relying Party server, so your web application can register and verify passwordless credentials such as Windows Hello and hardware security keys.

Cloud Storage

Cloud Storage 2026 makes interrupted uploads easier to recover, adds Dropbox Business support, and adds new authentication options and provider features.

Resumable Uploads

Resuming an interrupted upload previously required the application to save its progress, such as the StartByte value, before the interruption. The new GetUploadStatus method gets that state from the server instead. If the process stops unexpectedly, for example after a power loss, call GetUploadStatus to set StartByte from the data the server already holds, then call the upload method again to continue from that point. GetUploadStatus is available in the AmazonS3, AzureBlob, AzureFile, BackblazeB2, DigitalOcean, Dropbox, GoogleStorage, IBMStorage, Linode, S3, and Wasabi components, and already existed in GoogleDrive.

The CloudFiles component now supports resumable uploads through the new UseResumableUpload and ResumableUploadState properties. For providers that can report the state of an upload, CloudFiles resumes from the server automatically. For other providers, save ResumableUploadState during the transfer and set it again before calling Upload to resume.

Dropbox Business

The Dropbox component now works with Dropbox Business teams. Set the new APIMode property to team mode to list, create, delete, restore, and get information about team folders. The new ListTeamNamespaces method lists the team's namespaces, including team folders, shared folders, and team member folders, and RenameTeamFolder renames a team folder. The SelectTeamAdmin and SelectTeamUser configuration settings let a team-scoped token act as a team administrator or as a specific team member.

Authentication and Identity

The AmazonS3 component can now authenticate with AWS IAM Identity Center (AWS SSO) in the Java and .NET editions. Set the SSOEnabled configuration setting along with the start URL, account Id, and role name, and the component handles the sign-in and gets temporary role credentials. This also works when Identity Center federates sign-in to another identity provider such as Okta.

The OneDrive and SharePoint components add the RetrieveCurrentUser method and CurrentUser property, which report the account an access token belongs to. This is otherwise difficult to determine from the access token alone, especially for personal Microsoft accounts. The CloudFiles component now supports OAuth through the new OAuth property and Authorize method.

Provider Updates

• The S3 component adds Supabase as a service provider, since Supabase's storage API is S3-compatible.
• AzureBlob adds blob versioning (VersionId property and ListVersions method), server-side copy with PutBlockFromURL, and bulk deletes with BatchDeleteBlob.
• S3 and GoogleStorage add the DeleteObjects method for deleting multiple objects in one request.
• AzureFile adds the SendCustomRequest method for endpoints not covered by the API, such as leases.
• The AmazonGlacier component has been removed, since AWS no longer accepts new Amazon Glacier customers.

Cloud SSO

Cloud SSO adds the new SCIMWeb and SCIMDesktop components for automatic user and group provisioning. SCIM (System for Cross-domain Identity Management) lets an identity provider such as Microsoft Entra ID or Okta create, update, and deactivate accounts in your application as changes are made in the directory.

Both components implement the service provider side of SCIM 2.0 (RFC 7642, 7643, and 7644). They parse incoming SCIM requests and fire events so your code can update its own user store, then build the SCIM responses, discovery documents, and errors required by the specification. SCIMWeb is designed to be embedded in an existing web application, while SCIMDesktop hosts its own HTTP server for desktop applications and background services. Please see the SCIM Getting Started Guide for more information.

Encrypted Assertions

The SAMLWeb and SAMLDesktop components now support encrypted SAML assertions. Set the new ServiceProviderEncryptingCert property to a certificate with a private key, and the components decrypt any EncryptedAssertion element in the SAML response before parsing it. If the property is set when building service provider metadata, the certificate is included so the identity provider can use it to encrypt. Supported algorithms include AES-GCM and AES-CBC for the data and RSA-OAEP for key transport. The RequireSignedEncryptedResponse, AllowCBCDataEncryption, and AllowRSA15KeyTransport configuration settings control which responses and algorithms are accepted.

Cloud Mail

Cloud Mail adds support for Microsoft 365 shared mailboxes.

Cloud Keys

Cloud Keys adds support for certificates stored in Azure Key Vault.

SecureBlackbox

In line with our other products, SecureBlackbox underwent a major re-evaluation of security baselines. All the major technologies received a boost of their security defaults. This includes TLS and SSH, which have older and weaker security mechanisms now switched off and come with prioritized post-quantum security.

Post-Quantum Cryptography Support

This release comes with support for post-quantum algorithms across the board. The transport components on both sides have received support for ML-KEM key exchange as well as its hybrid variants based on NIST and Edwards elliptic curves. ML-DSA signature support has been integrated fully into the PKI and AdES stack, allowing for a qualitative shift in the security level provided.

Support for the post-quantum technology was integrated seamlessly into the existing components, which results in next-to-zero learning curve.

Advances in the Digital Signature Ecosystem

The electronic signature stack received multiple improvements in all areas. The chain validation subsystem now fully supports Trusted Lists v6, which have now become standard across Europe. Support for Delta CRLs allows for wider coverage of the PKI ecosystem and faster chain validations. Support for the CSC v2 signature protocol provides increased interoperability and smoother integration with third-party providers.

Secure Transports

A number of long-awaited features are now supported in the transport components. SecureBlackbox 2026 fully supports OpenSSH certificates for trust-based authentication on the client and server sides. These integrate seamlessly into the existing API. The refreshed HTTP components come with support for the HTTP SSE (Server-Sent Events) technology, providing for easier integration with modern real-time architectures.

Supporting Modern Development Tools

SecureBlackbox 2026 includes support for the most recent versions of Visual Studio, Java, Delphi, Free Pascal/Lazarus, and other development toolchains and platforms. At the same time, we continue our long-time commitment to those tied to older development environments by providing dependable backward compatibility packs.

Additional Updates

We have reviewed and updated our API to make sure it provides an efficient, rewarding, and easy-to-understand experience. Some of the component declarations were updated to match those criteria better. The SSH key management API, as well as TLS settings, were updated to reflect the respective subject areas better. WebDAVClient and WebSocketClient were updated with new features that expand their capabilities by providing better access to the HTTP layer.

In addition to public API changes, we conducted a major cleanup of the underlying code to make sure it provides a secure and efficient foundation for your project's needs.

API Changes

The following articles detail major API changes between version 2024 and version 2026. Please refer to the documentation for a complete reference.