Karakeep 0.33.1

Original release notes

0.33.1

Welcome to the 0.33 release of Karakeep! The headline of this release is semantic search. Karakeep can now generate embeddings for your bookmarks, letting you search by meaning instead of exact keywords (and making auto-tagging noticeably more consistent along the way). The mobile app gets offline reading, so you can save articles to your device and read them on a plane, along with new layouts, sorting, and one-tap clipboard saving. Cookie and GDPR consents should be something of the past with this release (finally). Plus a big batch of crawler, security and performance fixes.

Thanks to everyone who contributed to this release: @esimkowitz, @joestump, @zerone0x, @ElectricTea, @optix2000, @thiswillbeyourgithub, @jcgoodwin86, @InventorB, @VrtxOmega, @pike00, @KayMi, @TanishValesha, @mahirhir, @moduvoice, @eviaaaaa, @archit-goyal, @CertStone, and everyone who shipped code, triaged bugs, or shared feedback.

*Note: the changes mentioned here for the extension and mobile releases will need to go through the different store (apple, google, mozilla) reviews. So it might take a couple of days until all of them are released.*

If you enjoy using Karakeep, consider supporting the project here or via GitHub here. Also share Karakeep's managed offering ( link) with your friends who're not into selfhosting.

New Features

Semantic Search (#2959, #2960) - Search is no longer limited to exact keyword matching. There are now three search modes, switchable from a dropdown in the search bar:
Full text - the existing keyword search (still the default).
Semantic [Experimental] - pure meaning-based search powered by embeddings. Searching for "how to make coffee" will find your espresso bookmarks even if they never use those words.
Hybrid [Experimental] - fuses the results of both.
The new mode is also available in the API, MCP and CLI which is going to be the most useful with agents.
Semantic search is still new and experimental, so results might not be super accurate yet, but it's a start.
Semantic search requires embeddings to be enabled, read the upgrade notes for details about how to enable them.
Smarter auto-tagging using embeddings (#2858) - When tagging a new bookmark, Karakeep now looks up semantically similar bookmarks and feeds their existing tags into the LLM prompt as suggestions. The result is a lot less tag sprawl (no more k8s, kubernetes and Kubernetes all coexisting). This also requires embeddings to be enabled, read the upgrade notes for details about how them.
Cleaner saved pages (#2973): the crawler now detects common consent dialogs (cookies and GDPR) and automatically opts out before capturing the article, screenshot and PDF.
Offline reading on mobile (#2957) - The mobile app can now work without a connection:
Save articles for offline: from a bookmark's "..." menu, pick *Make available offline*. The full article is downloaded and kept on device until you remove it.
Recent cache: everything you browse (bookmark lists, tags, lists, highlights) is now persisted for 7 days, so recently visited screens still open when you're offline.
Mobile app improvements:
New layouts (#2837): switch between the existing card layout and a new compact list layout. *Note: the default is now the list layout.*
Sorting (#2777): sort your bookmarks newest-first or oldest-first (overdue, sorry!).
Save from clipboard (#2868): a new *Clipboard* entry in the "+" menu saves whatever is in your clipboard in one tap. Thanks @InventorB!
The manage bookmark sheet now has favourite, archive, share and highlights actions instead of just delete.
Karakeep for agentic usage - continuing where 0.32 left off:
MCP server went from 8 to 29 tools. Newly added: full list CRUD, full tag CRUD, highlights, delete-bookmark, and get-asset. Big thanks to @joestump for the list/tag CRUD work (#2917)!
New readable content API (#2660): GET /api/v1/bookmarks/{bookmarkId}/content returns a bookmark's article content as markdown or plain text, cursor-paginated in LLM-friendly chunks that snap to paragraph boundaries.
Much faster bookmark metadata (#2932): Karakeep's pre-flight http request to the website can now contribute to its metadata extraction. This results into some metadata (e.g. title) appearing much faster. A new CRAWLER_PREFLIGHT_USER_AGENT option lets you set a user agent for that probe request, and let's just say that a good user agent makes a huge difference.
The default OpenAI model has changed from gpt-4.1-mini to gpt-5.6-luna which is half as cheap, though a bit slower given that it's a reasoning model.

UX Improvements

Re-saving an existing bookmark now actually does something (#2962) - Saving a link you've saved before used to just tell you "Bookmark already exists" and do nothing. Now it re-saves it: the bookmark is un-archived and bumped back to the top of your list.
Smarter bookmark previews (#2975) - Newly crawled pages are now assessed for how well they work in Reader View. Articles continue to open in the clean reader, while homepages, search results, product pages and other non-article content default to a screenshot or a new page-overview panel instead of showing a poor text extraction. You can still switch among the overview, Reader View, screenshot, PDF and archived page from the preview selector.
Bulk edit is now one hover away: instead of first switching bulk edit on from the toolbar, a selection circle appears directly on a bookmark card when you hover it. Selecting one card puts you into bulk edit mode for the rest.
The sidebar is now wider on large screens, and its scrollbar only appears when you hover it instead of sitting there permanently.
Mobile polish: a proper loading state while an article is still being crawled, better reader contrast in dark mode, a rebuilt login screen with much clearer connection errors, faster Manage Tags page on large libraries (server-side search instead of loading every tag), iPad/tablet reader toolbar and FAB fixes by @esimkowitz (#2788, #2793, #2794), and a bunch of redundant success toasts removed.
Karakeep is now installable as a PWA in Chrome again, allowing you to use karakeep on your desktop as if it's one of the apps.
New Instagram renderer (#2836): Instagram posts and reels now render as the actual embedded post in the bookmark preview, joining the existing YouTube, X, TikTok and Amazon renderers.

Fixes

Security fixes:
Fixed a DNS rebinding / TOCTOU hole in the crawler's SSRF protection (#2945). Reported by @celinke97 (GHSA-vc53-r298-c6h6).
API key and signed asset token verification now use timing-safe comparisons, reported by @xancyber (GHSA-hjm9-gc55-5hgv).
Bookmark URLs are now restricted to http/https on create and update. Reported by @therawdev and @shukla304 (GHSA-6mfw-xrw2-h5x3).
Legacy bookmarks with unsafe schemes are filtered out of RSS feeds and Netscape HTML exports, and the exported URLs are HTML-escaped. Reported by @karen93shieh and @MuxiLyuLucy (GHSA-4vx2-9j8p-jg8v).
Tag names are now HTML-escaped in Netscape bookmark exports, preventing a crafted or AI-generated tag from breaking out of the TAGS attribute when the export is opened in a browser.
User-supplied names (user names, list names, inviter names) are HTML-escaped in outgoing emails, fixing HTML injection in the list invitation email. Reported by @therawdev and @shukla304 (GHSA-pvj2-rgwm-r7f8).
Password logins are now rate limited (10 attempts per 15 minutes per IP + email). Note that this requires RATE_LIMITING_ENABLED=true.
Closed account-enumeration side channels in login and password reset.
Much faster bookmark deletion (#2669): added the missing indexes that should make deletions less IO intensive for large libraries.
Old completed import sessions are now archived after 30 days: their summary counts are kept, but the per-bookmark staging rows are deleted, which keeps the DB from growing unboundedly after big imports.
YouTube/video downloads work again - yt-dlp now uses the bundled node as its JS runtime, by @pike00 (#2805).
Fixed BROWSER_WEB_URL failing to resolve on IPv6-only Docker networks by @VrtxOmega (#2863).
Fixed the X/Twitter renderer, which broke after the API changed its response shape.
Inline images in SingleFile archives are no longer clobbered by the lazy-load normalization, by @zerone0x (#2928).
Banner/preview image extraction now works for SingleFile and precrawled archives that inline the image as a data URI.
Fixed summarization producing garbled output for users running with INFERENCE_OUTPUT_SCHEMA=json, by @eviaaaaa (#2926).
New OPENAI_TIMEOUT_SEC option to control the per-request inference timeout, useful for slow self-hosted providers, by @optix2000 (#2876).
Hardened the tagging prompt: tags are now capped to 1-3 words, and Karakeep explicitly returns no tags for error pages, Cloudflare/CAPTCHA interstitials, cookie banners and login walls - so no more just a moment or cloudflare tags on failed crawls.
Fixed the MCP get-bookmark-content tool crashing on bookmarks that haven't been crawled yet, by @joestump (#2915).
Fixed scrolling in the bookmark preview's screenshot view by @VrtxOmega (#2864).
The browser extension now requests host permissions at runtime for client-side crawling (#2784), instead of asking for them up front.
Added missing Japanese translations by @mahirhir (#2903) and filled in the missing Korean translation keys by @moduvoice (#2938).
PDF previews now render via <embed> so they display in Safari, by @KayMi (#2806).
Import progress is now tracked per import job (#2950), so running two imports at once no longer makes their progress bars fight each other. Thanks @jcgoodwin86!

For Developers

Docker healthchecks now respect a custom PORT by @zerone0x (#2948).
OAuth providers can now use a configurable ID token signing algorithm via OAUTH_ID_TOKEN_SIGNED_RESPONSE_ALG, by @CertStone (#2850).

Community Projects

*Checkout our community projects page here.*

wdoc: A RAG-powered document/knowledge querying tool with Karakeep support, by @thiswillbeyourgithub (#2904)

Screenshots

Offline Reading

New Mobile List Layouts

*Please don't judge my saved content*

Upgrading

To upgrade:

If you're using KARAKEEP_VERSION=release, run docker compose pull && docker compose up -d.
If you're pinning it to a specific version, upgrade the version and then run docker compose pull && docker compose up -d.

Enabling Embeddings

Karakeep's embedding uses your existing meilisearch installation as the default vector store. If you're an OG, and running an old meilisearch version, you'll need to ensure you're on meilisearch version (1.13 or higher). Check this guide for info on how to update.
If you're using the default OpenAI based configuration, auto embeddings of new bookmarks will be enabled automatically and will use the text-embedding-3-small model.
If you're using a custom provider, you'll need to pass in the EMBEDDING_TEXT_MODEL=<your_mode>, the size of the dimension of the model via EMBEDDING_DIMENSIONS and then pass EMBEDDING_ENABLE_AUTO_INDEXING=true to enable embeddings. Check out our docs for example models and configurations.

Once you've enabled embeddings, you'll need to regenerate embeddings for all existing bookmarks. Head to the admin panel's Background Jobs page (new "Embeddings" card) and regenerate embeddings for all/pending bookmarks. This might take a while depending on how many bookmarks you have, and will cost you money (though embeddings are usually pretty cheap).

NOTE: Changing the model or its dimension after embedding even a single bookmark will require you to regenerate embeddings for *all* bookmarks.

All Commits

fix(tagging): loosen the captcha rejection in the prompt a bit - @MohamedBassem in 8550eb09
fix(workers): wait for autoconsent in parallel with page load - @MohamedBassem in 98c52b85
fix(tests): fix failing test after changing default model - @MohamedBassem in f249307b
feat: change default inference model to gpt-5.6-luna - @MohamedBassem in 1bc351a7
fix: enable auto embedding by default for default inference configuration (#2976) - @MohamedBassem in bcbb5776
fix: enable auto embedding by default for default inference configurations - @MohamedBassem in 7722c6ae
deps: upgrade docusaurus - @MohamedBassem in ccddfcf3
feat: Add support for configurable ID token signing algorithm in OAuth (#2850) - @CertStone in b2b2579b
feat(landing): 28k starts - @MohamedBassem in 385ec1df
feat: add new article quality assessment (#2975) - @MohamedBassem in 76b477c4
fix: make queue registration idempotent - @MohamedBassem in 6f120133
i18n: some translation fixes - @MohamedBassem in 3b7982c1
i18n: Sync weblate translations - Hosted Weblate in 590c6700
feat(web): some UX improvements in signin and password forms - @MohamedBassem in b4b94740
feat(workers): auto-dismiss consent dialogs with autoconsent (#2973) - @MohamedBassem in c333f240
deps: upgrade nextjs to 16.2.12 - @MohamedBassem in 11488896
fix(workers): fix workers in dev mode - @MohamedBassem in 3a0421d0
deps: bump a bunch of deps - @MohamedBassem in a90034d1
i18n: Sync weblate translations - Hosted Weblate in 8b4b9170
docs: hide the chat flags for now - @MohamedBassem in 36c36e3e
fix(auth): close account enumeration oracles in login and password reset - @MohamedBassem in 036da4c0
fix(mobile): don't silently swallow mutations fired while offline - @MohamedBassem in 9188958c