Mastodon 4.7 encrypts local keys and extends fediverse signature support

What changed

Mastodon 4.7 was released on August 20, 2026. It stores local users' ActivityPub private keys in a new table, encrypted in the database, accepts RSA, Ed25519 and ML-DSA-44 public keys, and removes some legacy inbox handling. The release post describes no API or OAuth changes.

What it means

Upgrading to 4.7 is a required stop for zero-downtime migrations to later versions, and local ActivityPub private keys are encrypted at rest.

Who is affected

Server admins and developers of fediverse software. Ordinary posting through the Mastodon API is not changed.

What to do by 20 Aug 2026

Admins should plan the upgrade through 4.7 before later versions. Zero-downtime upgrades from 4.6 are supported.