🖥️ PowerFolder Server 28 FINAL

• Release Date: August 2026

• Build Number: 28.0.100

• Type: Major Software Release

📦 Download Links

• JAR File (Wiki Password required)

• Linux

• Windows

• Outlook Add-In (No changes)

⬆️ Upgrade Information

• Please read this complete Release Notes and instructions before upgrading.

• Please follow the regular upgrade documentation for Windows or Linux

• Upgrading any previous version higher or equal to version 16.0.100

• Cluster: Running different versions on the servers in the cluster is supported but limited to version >= 22.0.100

📄 Euro-Office Support

PowerFolder supports Euro-Office as a Document Server for browser-based document viewing and editing.

Euro-Office can be deployed using Docker or standalone server and connected to PowerFolder as the configured Document Server. For production environments, JWT authentication and HTTPS via a reverse proxy are recommended.

For complete installation and configuration instructions, see: Euro-Office Setup Guide

🏷️ Tagging for Files, Folders, and Workspaces

Control whether tagging is available for files, folders, and workspaces.

Enable tagging:

To disable tagging completely, set:

When disabled:

• All tag-related UI elements are hidden from the Web Portal

• Tagging for files, folders, and workspaces is unavailable

• Tag API requests are rejected with HTTP 403

• Existing tags are preserved in the database

• Previously created tags become available again when tagging is re-enabled

Default:

Database Migration

The required database schema migration runs automatically on the first server start after the update.

Database schema version:

The migration adds the required tag-related database changes, including a new column in FolderInfo.

No manual database migration is required.

Search Index

After updating, the search index is automatically rebuilt once because the search index format version has changed.

No manual reindexing is normally required.

Mixed-Version Operation

Mixed operation with older PowerFolder Server or Client versions remains supported.

Older versions continue to work normally, but workspace tags are not propagated to older versions until those systems are updated to a version that supports workspace tagging.

Existing file and folder operations remain unaffected.

👥 Nested Groups

Control whether PowerFolder supports nested groups, allowing one group to be added as a member of another group.

Enable nested groups:

To disable nested group functionality, set:

When enabled:

• Groups can contain other groups as members

• Nested group structures can be created and managed

• Group membership can be inherited through parent/child group relationships

• Permissions assigned through nested groups can be evaluated according to the configured group structure

Default:

📁 Web Navigation into Newly Created Folders

Control whether the Web interface automatically opens newly created folders.

Enable automatic navigation into newly created folders:

To keep users in the current directory after creating a new folder, set:

The setting is available under:

Admin → Preferences → Web → Features → Open newly created folders

Default:

🏢 Organization Function Visibility

Control whether the Organization functionality is visible in the PowerFolder Web Portal.

Enable Organization functionality:

To hide Organization-related functions from the Web Portal, set:

When disabled, Organization functionality is hidden from:

• Main menu

• Dashboard

• Account editors

• Group editors

• Configuration editors

• Tables

• My Account

Default:

🔗 Hide File Links from Users

Control whether users can create and access public file links and download links.

Enable file links:

To disable file links for users, set:

The setting is also available under:

Admin → Preferences → Security → File Link security → Allow file links

When disabled:

• Links page is hidden

• Links menu entry is hidden

• Create link button is hidden

• Public file links are blocked

• Public downloads are blocked

• File-link API access is blocked

The following functions are not affected:

• Support-package links

• Document editing via /open

Default:

If the configuration key is missing, file links remain enabled by default. Existing servers therefore require no manual migration after an update.

📧 Email Notification for Inactive Device Cleanup

PowerFolder can automatically remove devices that have been inactive for a configured period and notify the account owner by email.

Configure how long a device may remain inactive before it is automatically removed:

The value is defined in months and is based on the device's last connection time.

To disable automatic removal of inactive devices, set:

or any value below 0.

Enable email notifications when inactive devices are automatically removed:

To disable the notification email, set:

Defaults:

With the default configuration, devices that have not connected for 24 months are automatically removed and the corresponding account owner receives an email notification.

📧 Use Primary Email Address Only

Control whether PowerFolder users are restricted to using only their primary email address.

Enable primary-email-only mode:

To allow users to manage additional email addresses, set:

The setting is available under:

Server Settings → Security → Account Security → Use primary email address only

When enabled:

• Users can no longer add additional email addresses

• Existing additional email addresses are no longer shown in My Account

• Adding additional email addresses is blocked on the server

• Additional email addresses cannot be added through the API

• The Username label is displayed as E-Mail throughout the Web interface

• The primary email address becomes the only email address used for the account

Default:

With the default configuration, users can continue to use and manage additional email addresses as before.

🔐 Argon2id Password Hashing

PowerFolder now uses Argon2id as the default password hashing algorithm for improved password security.

Enable or disable Argon2id hashing:

New passwords are hashed using Argon2id.

Existing SHA-256 password hashes are automatically migrated after the user's next successful login (lazy migration).

When disabled, all new passwords continue to use SHA-256 and no migration is performed.

Migration

• No batch migration required.

• No downtime.

• Users who have not logged in since the upgrade continue using their existing SHA-256 hash until their next login.

• Password hashing intentionally takes approximately 300–400 ms to improve brute-force resistance.

Monitoring

Each successful migration is logged:

Database hash prefixes:

• ARGON2ID: → Password already migrated.

• SHA-256: → Password not yet migrated.

Downgrade

Argon2id password hashes are not backward compatible with older PowerFolder Server versions.

After downgrading, users whose passwords have already been migrated must reset their password.

📝 OpenDocument (ODF) Support

New documents created in the online editor can now use the OpenDocument Format (ODF) instead of Microsoft Office formats.

Enable ODF creation:

New files will be created as:

• .odt

• .ods

• .odp

When disabled (default), PowerFolder creates:

• .docx

• .xlsx

• .pptx

Requires an active online editor (ONLYOFFICE or WOPI/Collabora).

📂 SMB / Samba Folder Sharing

PowerFolder folders can now be exposed as standard SMB/Samba/CIFS network shares.

Users can access shared folders directly from their operating system using native SMB clients, including Windows File Explorer, macOS Finder and Linux file managers.

Existing PowerFolder permissions continue to control access to the shared folders.

Detailed documentation.

🔍Full-Text Search and OCR

PowerFolder provides built-in full-text search capabilities, allowing users to search within document contents as well as file names. OCR support enables text recognition inside images and scanned PDFs. For more information: 🔍 Full-Text Search and OCR

🗂️ Folder Archive Configurability

Deleted top folders are now moved into the user-level archive at:

PowerFolders/username/.PowerFolder/archive

Enable user archive support:

server.archive.user.enabled=true

To disable this functionality and remove the ability for users to restore top folders from the recycle bin set:

server.archive.user.enabled=false

Legacy support for system archive

New default value for:

folderbase.deleteddir=

→ Empty value disables archiving of deleted top folders into the system archive (BACKUP_REMOVE).

For legacy behavior set:

folderbase.deleteddir=BACKUP_REMOVE

Cleanup of Legacy System Archive Folder

The legacy system archive folder:

PowerFolders/BACKUP_REMOVE

is no longer used and can now be safely deleted after the configured system cleanup time.

Restoring top folder from system archive ("BACKUP_REMOVE")

Admins and users are now able to restore top-level folders direct from recycle bin.

web.restore_folder.users.enabled=true

To hide the options from end users set in server config:

web.restore_folder.users.enabled=false

Note: The new functionality is always visible to server admins

👤 Account

Added new API action to create authentication tokens for any account with custom validity support.

API Documentation: PowerFolder API Documentation

🌐 Reverse Proxy Stability Improvements

Adjusted default reverse proxy settings for improved stability and performance.

New defaults:

http.proxy.read.timeout.seconds = 30

http.proxy.connect.timeout.seconds = 15

http.proxy.threadpool.max = 200

web.threadpool.min = 10

Deprecated and can now be removed:

http.proxy.timeout.seconds=

🌍 GEO IP Support

GEO IP functionality can now be enabled via configuration:

web.geo.ip=true

💻 Client Installation Prompt

The web client installation suggestion popup can now be enabled or disabled via configuration.

Disable the prompt:

web.client_install_prompt.enabled=false

Default setting:

web.client_install_prompt.enabled=true

📱 Automatic Cleanup of Old / Inactive Devices

Added support for automatic removal of old or inactive devices in “My Account” via configuration is now default:

server.devices.cleanup.remove_months=24

To turn off:

server.devices.cleanup.remove_months=0

🔄 Changing Database Collation to utf8mb4_general_ci in MariaDB v11.x

Attached detailed documentation describing the required database collation adjustment and upgrade procedure: Changing Database Collation to utf8mb4_general_ci

📊Folder Audit Information

More information about this feature: Server Audit Information

🌐WebDAV Token Validity

The default WebDAV token validity is now tecnically 21 years:

security.tokens.webdav.valid.time.seconds=662256000

Server admin can change this as per requirement.

🔄 Javascript in Email Templates

The email templates are also improved, please update the email templates or delete the old templates.

⬇️ Downgrade Information (optional)

• In case a downgrade to a previous version is necessary:

  • For a downgrade, you have to review our downgrade documentation.

  • Simply replace the PowerFolder-Server.jar file with that from the previous version you would like to run.

• Log messages due to the higher schema version of database can be ignored:

  • [DatabaseMigrator]: Database layout version is newer than expected.

📜 Full Changelog

• PFS-5306: Tagging of files and folders in web

• PFS-5630: Moderated folders

• PFS-5510: Nested Groups

• PFS-5633: File/Folder Path in the URL

• PFS-5613: Global file search should have filter and improved sorting

• PFS-5653: Extend file search: new search filters (date/size range, type, phrase, tags, fuzzy, ...)

• PFS-5537: Filter to show recent files

• PFS-5663: Euro-Office support

• PFS-5658: Improve org admin dashboard

• INT-1718: Fix and improve security of Service layer

• PFS-5629: Regression: Reducing user quota below current usage deletes user data in v26.2.x

• PFS-5691: Extern password/reset pages: reveal + reCAPTCHA, throttling & anti-enumeration

• PFS-5673: Fix reCaptha v3 login

• PFS-5647: Folder deletion: files stay on the server instead of being moved to the owner's archive

• PFS-5585: Groupadmin can downgrade himself

• PFS-5429: AntiXSSHandler escapes organization field during user login

• PFS-5577: Fix duplicate entries in login history using MFA login

• PFC-3576: Configurable navigation view for shared / interrupted subfolders (spec 3.7)

• PFC-3566: Server service: interrupt / restore inheritance (snapshot, self-lockout)

• PFC-3568: API endpoints: interrupt / restore / status + affected users

• PFC-3558: Domain model + DB persistence for inheritsPermissions

• PFC-3559: Feature toggle / configurability (default off)

• PFC-3560: Serialization + protocol negotiation (backward compatible)

• PFC-3561: Version-bumped flag change via FolderInfoFactory

• PFC-3564: Replicate the feature config across the server cluster when enabled

• PFC-3565: Folder runtime reinit + FileInfo DB migration on interrupt/restore

• PFC-3567: Logging for inheritance interruption / restoration

• PFC-3571: Exclude interrupted subfolder subtree from the top folder scan/DAO/watcher

• PFC-3562: Tests: feature gate, protocol negotiation, backward compatibility

• PFS-5654: Server & storage tables: usage bars, context menu and column layout

• PFS-5669: Improve accounts overview: expand Folders and Groups columns with detailed info

• PFS-5643: Re-arrange and optimize web preferences

• PFS-5671: Add folder version setting permission in folder security

• PFS-5638: Server admin should always be able to delete a folder

• PFS-5651: Folders: Server admin filters "Without members" and "Maintenance"

• PFS-5649: Web recycle bin: Show size of deleted top-level folders

• PFS-5674: Files view: show search filter dropdown when searching inside folders/directories

• PFS-5731: Manage folder dialog: version limit as a dropdown like the "Versions per file" preference

• PFS-5685: Preferences: add "Test SMTP setup" button on the SMTP server tab

• PFS-5687: E-mail notification on file conflicts — toggle in web preferences (Email → Notifications)

• PFS-5727: File changes are now attributed to the account that actually edited the document

• PFS-5597: Improve "login as" in user view and can be exit via button

• PFS-5660: Land admins without MFA on the dashboard, show the MFA warning there

• PFS-5575: Highlight target folder during drag n drop

• PFS-5615: Option to hide Organization function

• PFS-5592: Provide config to hide file links from users

• PFS-5655: Config to disabled navigation into new created folder/directory

• PFS-5621: Branding: Organization logo is not displayed on upload/download links

• PFS-5648: WebDAV token dialog: Copy buttons do not copy URL/token to clipboard

• PFS-5627: Link landing page: Show preview unavailable

• PFS-5667: File link page: inline/download URL for txt/md files built with '&' instead of '?'

• PFS-5639: Files with square brackets ([]) in filename return HTTP 400

• PFS-5652: Speed up file search: parallelize FolderRepository.searchFiles across folders

• PFS-5644: Search inside RTF files: added better encoding detection

• PFS-5632: Optimize OCR pool and shutdown behavior

• PFS-5689: Speed up server start blocked for 1 minute per 1000 accounts by base-path check in StorageManager

• PFS-5730: Preferences save fails with many whitelist domains - save request exceeds URL length

• PFS-5732: SAML email addresses: mark, replace on every login and merge with addresses from other sources

• PFS-5567: Force using primary email address only

• PFS-5596: fix inline creation of organization

• PFS-5536: Integrate Organization with nested groups feature

• PFS-5636: Create GroupService to consolidate group logic (Remove GroupController)

• PFS-5684: Account base path is now automatically adapted when the username is renamed

• PFS-5616: Email Template: Issues and Improvements for prepare_file_link_mail.vm

• PFS-5626: Allow customization of inactive device cleanup email template

• PFS-5576: Correct email notification for active devices

• PFS-4215: Improve notification in inviting using email with UMLAUTS

• PFS-5635: Problem accepting invitations in clustered environment

• PFS-5421: Fix bug to show link to sub directory as link (in cluster)

• PFS-5614: Reduce load from maintenance process for folder mounts

• PFS-5600: Reduce DB load on cluster cache for FolderInfo and Account

• PFS-5670: Orphaned f.<hash>.syncprofile entries accumulate in PowerFolder-Folder.config on HA nodes with dynamic folder mounting

• PFS-5606: Cache enabled storages and server uptime

• PFS-5640: Save Account and FolderSettings cache region on updates

• PFS-5634: Improve logs app (filter for warnings and errors)

• PFS-5641: Security fix

• INT-1726: Security fix

• INT-1727: Security fix

• INT-1728: Security fix

• INT-1729: Security fix

• INT-1730: Security fix

• INT-1731: Security fix

• INT-1732: Security fix

• INT-1733: Security fix

• INT-1734: Security fix

• INT-1735: Security fix

• INT-1736: Security fix

• INT-1737: Security fix

• INT-1725:Security fix