BleachBit 6.0 Released — Cookie Manager, Vivaldi and Zen Cleaners, and SHA-256 Code Signing Land in Biggest Release in Years (April 25, 2026)

The BleachBit project on April 25, 2026 released BleachBit 6.0.0, the open-source disk cleaner's largest release in years, bundling a long-requested cookie manager, two new browser cleaners and a full overhaul of the project's Windows and Linux code-signing pipeline. Maintainer Andrew Ziem says the release contains more than 100 improvements and fixes across browser cleaners, the command-line interface, secure deletion, and platform-specific build fixes for Windows and Linux.

What Happened

The official release notes were posted to bleachbit.org on Saturday, April 25, 2026, with the v6.0.0 stable tag pushed to GitHub at 23:43 UTC the same day. Coverage from Help Net Security, Linuxiac, 9to5Linux, BetaNews and Neowin followed over April 26-28, focusing on three changes: the new cookie manager, the new Vivaldi and Zen browser cleaners, and the migration to modern code-signing infrastructure on Windows.

The most user-visible feature is a cookie manager that lets users selectively keep or purge cookies in Chromium-based browsers (Chrome, Edge, Brave, Opera, Vivaldi) and Firefox-based browsers (Firefox, Zen) — a long-standing gap for users who want to wipe tracking data without losing logins to specific sites. Additional Chromium artifacts now cleaned include component cache, extension cache, the Graphite Dawn cache, shader cache, DIPS, and crash reports.

Key Details

• Cookie manager — new dialog lets users keep specific cookies when cleaning Chromium- and Firefox-based browsers, addressing one of the most-requested issues in the BleachBit tracker.
• New browser cleaners — first-class support for the Vivaldi and Zen browsers, with deeper cleaning for existing Chromium and Firefox profiles.
• RFC 3161 code signing on Windows — the installer and application now timestamp signatures with the RFC 3161 protocol and SHA-256, replacing the older Authenticode protocol that still used SHA-1.
• Linux package signing — Debian and RPM packages are now signed directly with the maintainer's key, giving users three verification paths: direct package signature, detached signature, or signed checksum file.
• New distro packages — official packages for Ubuntu 25.10, Ubuntu 26.04 and Linux Mint 22.3 are now in the release matrix.
• Expert Mode toggle — disabled by default, this hides advanced cleaners that can cause data loss for inexperienced users while keeping them available behind a single preference for power users.
• Chaff feature improvements — the decoy-data generator runs faster, supports stop conditions based on file count, total size or free-space percentage, and no longer freezes the UI during downloads.
• Recycle Bin safety fix — a long-standing bug where BleachBit would follow directory junctions and symlinks inside the Windows Recycle Bin (potentially deleting data outside the bin) is now fixed.
• Clipboard paste for shred — pressing Ctrl+V in the main window now pastes file paths from the clipboard for secure deletion.

What Developers and Users Are Saying

On Reddit's r/privacy and r/linux, the most upvoted threads about the release celebrate the cookie manager — which has been on the project's wishlist for years — and the long-overdue retirement of SHA-1 from the Windows code-signing chain. Linux users on r/selfhosted highlight the new direct-key signing of Debian and RPM packages as a meaningful supply-chain improvement, since previous BleachBit Linux releases relied on detached checksum signatures only.

The recurring critical comment, repeated on BetaNews and tuxmachines threads, is that BleachBit's UI still looks like it was designed in the early 2010s. Several users argued that the Expert Mode toggle, while a sensible safety improvement, also surfaces just how dense the underlying cleaner list has become. There were no major reported regressions in the first 72 hours after release.

What This Means for Users

For Windows users, the most important change is silent: BleachBit's installer now timestamps signatures with SHA-256 via RFC 3161, which keeps the installer trusted by Windows SmartScreen and corporate certificate-pinning policies as the industry continues to deprecate SHA-1. Users running BleachBit in managed environments should see warning-free installs going forward.

For privacy-conscious users on any platform, the cookie manager is the headline feature: you can finally clean tracking cookies without logging out of the dozen or so sites you actually want to keep, which removes the most common reason regular users had stopped running their cleaner regularly. Linux users get genuinely stronger supply-chain integrity through the new direct package signatures.

What's Next

BleachBit 6.0.0 is available now from the official downloads page for Windows, macOS and a wide range of Linux distributions, and from the GitHub releases page. The project is funded primarily by donations and is maintained by Andrew Ziem with community contributors. The release notes commit BleachBit to a faster cadence after the long 5.x cycle, and the project's roadmap continues to focus on browser cleaning depth, supply-chain hardening, and expanding the chaff and shred features for users who need verifiable data destruction.

Sources

• BleachBit 6.0.0 Release Notes — official release announcement on bleachbit.org.
• bleachbit/bleachbit Releases on GitHub — primary source for the v6.0.0 stable tag and release body.
• Help Net Security: Open-source privacy tool BleachBit 6.0.0 upgrades code signing across Windows and Linux.
• Linuxiac: BleachBit 6.0 Lands as the Project's Biggest Release in Years.
• 9to5Linux: BleachBit 6.0 Introduces New Cookie Manager, Improves Browser Cleaning.
• BetaNews: BleachBit 6 arrives with deeper browser cleaning and a long-awaited cookie manager.