peach-browser
A free, open source, local-first password manager for Chrome, Firefox, and Android.
TypeScript
timeline
atlas373 files
crypto-core/
public/
codex/
fonts/
models/
scripts/
build-noise-core.mjsbuild-peachscript.pyBuild PeachScript-Regular.otf — 256 historical-runic glyphs.check-sw-static-imports.mjsFails the build if any chunk reachable from the MV3 service worker still contains a runtime
import().ci.tsclean-chrome-dist.mjsclean-firefox-artifacts.mjsgenerate-kat.mjsgenerate-kat.mjs — recompute the pinned ciphertext for self-test.ts (PCH-01-020).package-amo-source.shpackage-amo-source.sh — produce peach-3.6.65-source.zip for AMO review.release-firefox.tsrelease.tssetup-chrome-release.sh───────────────────────────────────────────────────────────────────────────── Peach — Chrome Web Store Release Setup Run this once to configure Chrome publishing.sync-chrome-dist.mjssrc/
background/
aes.test.tsaes.tsaes.ts — AES-256-GCM encrypt/decrypt primitives for vault storage.alarms.test.tsalarms.tsclipboard.double-failure.test.tsT-037: clipboard double-failure / alreadyWritten pathclipboard.test.tsclipboard.tsClipboard write + reliable auto-clear — audit fix HV-2.codex-handlers.test.tsTests for src/background/codex-handlers.ts.codex-handlers.tscodex-handlers.ts — message handlers that back the Peach Codex flow.commands.tsKeyboard command handler — routing for summon-inline: 1.device-identity.test.tsdevice-identity.tsLocal-device identity helpers for the sync architecture.entry.lock-port.test.tsLV-5: the lock-on-close onConnect listener accepts only our popup port (legacy bare "popup" or nonce'd "popup-<uuid>") and ignores anything else.entry.tshealth.test.tshealth.tshealth.ts — Pro advanced vault health analysis.license.tslicense.verification.test.tsT-009: License Ed25519 signature verificationlocked-sync-spool.test.tslocked-sync-spool.tsmesh-relay-listener.test.tsmesh-relay-listener.tsmessages.adversarial.test.tsmessages.adversarial.test.ts — Layer 3 §3.3 adversarial message handler tests.messages.batch-sanitize.test.tsT-008: PCH-01-016 batch-add canary/tag sanitizationmessages.create-vault-from-root-key.test.tsmessages.edit-origin.test.tsT-022: GET_ENTRY_FOR_EDIT via sender.url + locked-vault AUTOFILL_QUERYmessages.test.tsmessages.tsmessages.ts — the only background message handler.ml.predictbatch.test.tsT-030: ml.ts predictBatch — batch sizes, softmax stability with extreme weightsml.tsnotes.test.tsoffscreen.htmloffscreen.tsOffscreen document script — audit fix HV-2c.paired-devices.test.tspaired-devices.tsPaired-device registry — v3 sync.passkey-chrome-ceremony.test.tspasskey-chrome-ceremony.test.ts — covers the Chrome chrome.webAuthenticationProxy ceremony path that the Firefox-proxy test file does NOT exercise.passkey-crypto.test.tspasskey-crypto.tspasskey-deny-on-close.test.tspasskey-deny-on-close.test.ts — M8/COR-009passkey-firefox-proxy.test.tspasskey-firefox-proxy.test.ts — covers the v2.12.0 Firefox content-script proxy path.passkey.ed25519.test.tsT-015: Ed25519 passkey round-trippasskey.tspending-vouched-devices.test.tspending-vouched-devices.tsPending vouched devices — audit fix MV-7.recovery-pending.tsPersistent flag set while the user has just created a vault and is reading their 12 recovery words but has not yet typed the 3 confirmation words.recovery-words.test.tsrecovery.adversarial.test.tsrecovery.adversarial.test.ts — Layer 3 §3.2 adversarial recovery words tests.relay-adoption-bg.test.tsrelay-adoption-bg.tsself-test.test.tsself-test.tsself-test.ts — Known-Answer Test (KAT) for the Peach crypto stack.sync-alarm.test.tssync-alarm.tssync-alarm.ts — the 10-minute background sync tick.sync-alerts.test.tssync-alerts.tsPending sync security alerts.sync-coordinator.test.tssync-coordinator.tsVault sync — Phase 2 manifest-diff coordinator.sync-runner.test.tssync-runner.tsProduction sync runner — composes the live vault adapter, WebSocket transport, and coordinator into the function the dispatcher injects via
setSyncRunner.sync-settings.test.tssync-settings.tssync-static.test.tsIV.7 — Static safety assertions for vault sync.sync-trigger.test.tssync-trigger.tssync-trigger.ts — central sync dispatcher.sync-vault-adapter.test.tssync-vault-adapter.tsProduction adapter that backs runSyncInitiator with the live vault.vault-createVaultFromRootKey.test.tsvault-history.test.tsVault history tests.vault.adversarial.test.tsvault.adversarial.test.ts — Layer 3 §3.1 adversarial vault tests.vault.consolidate-passkeys.test.tsT-023: vault.consolidatePasskeyEntries — passkey merge with lastUsed rankingvault.corruption.test.tsT-018: Vault corruption vs wrong-password discrimination (M7/COR-007)vault.duress-adoption.test.tsvault.hibp-padding.test.tsPCH-02-007 regression tests — the HIBP k-anonymity range request must ask for response padding, and the parser must stay correct on padded responses.vault.purge-trash.test.tsT-024: vault.purgeExpiredTrash — retention cutoff boundaryvault.rotate-sync-identity.test.tsT-016: rotateSyncIdentity — new root key, cleared peers, recovery pendingvault.session-escrow.test.tsvault.sync-clamp.test.tsUnit tests for HV-1 — sync timestamp clamp + remote-mutation alerts.vault.test.tsvault.tsvault.ts — sole owner of vault state and chrome.storage vault keys.vault.update-entry-sanitize.test.tsPCH-02-001 regression tests — UPDATE_ENTRY patch path must route canary/tags/passkey through the same sanitizers the add/restore/sync funnels use (sanitizeCanary / sanitizePasskey / sanitizeTags).content/
passkey-toast/
crypto/
argon2.test.tsargon2.tsargon2id.kat.test.tsT-019: Argon2id known-answer test (KAT) + parameter assertioncrypto.test.tsdecompression-bomb.test.tsMV-4: decompression-bomb output bounds on the zstd and pako legs.official-vectors.test.tspeachPayload.binaryreader-bounds.test.tsPCH-02-008 regression tests — BinaryReader must bound every read and fail with the decoder's existing PAYLOAD_TOO_SHORT code on truncated input.peachPayload.bomb.test.tsT-005: peachPayload declared-length decompression bomb (MV-4)peachPayload.test.tspeachPayload.tspeachPayload.ts — binary payload format shared by PeachScript and the Peach QR matrix code (spec §2).peachScript.test.tspeachScript.tspeachScript.ts — PeachScript encoding/decoding.totp.rfc6238.test.tsT-004: TOTP RFC 6238 known-answer vectorstotp.test.tstotp.tszstd.tsThin wrapper around @bokuweb/zstd-wasm that defers WASM load until the first compress/decompress call and memoises the init promise.
popup/
codex/
aztec.tsaztec.ts — Aztec 2D barcode generation with round-trip verification.browser-bundle.test.tscodex.adversarial.test.tscodex.adversarial.test.ts — Layer 3 §3.4 adversarial Codex tests.codex.multistripe.test.tsT-017: Codex multi-stripe round-tripcodex.suite.test.tscodex.suite.test.ts — cross-cutting regression suite for the Codex pipeline.codex.test.tsconfirmation.tsPick 3 distinct positions in [1, 12] for the recovery-words confirmation gate.erasure.tserasure.ts — Reed-Solomon erasure coding around the WASM library.generate.test.tsgenerate.tsgenerate.ts — full Codex generation pipeline.helpers.tshelpers.ts — shared utilities for Codex generation and restoration.node-wasm.tsNode-only WASM byte loader for Vitest.pdf-import.clamp.test.tspdf-import.sandbox.test.tsT-007: MV-9 pdf.js sandbox flags regression testpdf-import.test.tspdf-import.test.ts — coverage for the testable surface of the PDF import path.pdf-import.tspdf-import.ts — restore from a Codex PDF instead of a camera scan.pdf-layout.tspdf-layout.ts — A4 Codex page geometry shared between the generator and the PDF importer.pdf.tspdf.ts — render the printable Codex PDF.reed-solomon.tsBrowser-safe wrapper around the Reed-Solomon WASM exports.restore.test.tsrestore.test.ts — coverage for ChunkBuffer, parseRawScan, reconstructAndVerify.restore.tsrestore.ts — Peach Codex restoration library (popup-side).rs-loader.tsrs-loader.ts — load the Reed-Solomon erasure WASM module.scanner.tsscanner.ts — camera-based Aztec scanning for Codex restoration.
components/
GeneratorDrawer.test.tsGeneratorDrawer.tsxNoteRow.tsxNoteToolbar.tsxPairingBirds.tsxPairing birds — the two illustrated characters used on the pairing screens.PairingProRequired.tsxPairingQrCode.tsxPeachMark.tsxRecoveryRuneBackground.tsxRuneBackground.tsxRuneCanvas.tsxSyncModeSelector.test.tsx@vitest-environment jsdomSyncModeSelector.tsxSyncModeSelector — the one place the relay choice is made.
views/
Add.tsxAdoptVaultView.test.tsx@vitest-environment jsdomAdoptVaultView.tsxCodexGenerateView.test.tsx@vitest-environment jsdomCodexGenerateView.tsxPeach Codex — generation view.CodexRestoreView.test.tsx@vitest-environment jsdomCodexRestoreView.tsxPeach Codex — restoration view.contracts.test.tsx@vitest-environment jsdomEntry.tsxExport.csv.test.ts@vitest-environment jsdomExport.tsxSignal-conditioned views in this file must use <Show>, never a signal-conditioned early return (
if (signal()) return <X/>).Health.test.tsx@vitest-environment jsdomHealth.tsxImport.tsxSignal-conditioned views in this file must use <Show>, never a signal-conditioned early return — see Projects.md §4.1.InitialSyncView.test.tsx@vitest-environment jsdomInitialSyncView.tsxLock.tsxNoteEditor.toHtml.test.ts@vitest-environment jsdomNoteEditor.tsxNotesEditor.tsxNotesMode.tsxNotesTOC.tsxOnboarding.tsxPairDevice.test.tsx@vitest-environment jsdomPairDevice.tsxPairDevice — the pairing surface, opened from the Settings → Sync card.Panic.tsxPasskeyApproval.tsxProCelebration.tsxRecoveryWordDisplay.tsxRecoveryWordEntry.tsxSettings.tsxTrashView.tsxvault-search.test.tsvault-search.tsVault.tsxview-test-utils.tsxzxcvbn-strength.test.tsLV-8: the @zxcvbn-ts replacement must score the master-password strength meter on the same 0-4 scale as the old zxcvbn, with dictionaries loaded (language-common is what keeps weak passwords from scoring optimistically).shared/
noise-core-wasm/
any is intentional throughout this module (L17/I3/QUA-010): import files are user-supplied external JSON whose schemas vary by source app and version (1Password CPG, Bitwarden, CXF, generic CSV).initial-sync.test.tsinitial-sync.tsmesh-peer-role.tsml.tsnoise-blake2s-kat.test.tsnoise-core.tsnoise-js.test.tsNoise NK auth proof regression test.noise-js.tsNoise NK initiator for browser-to-browser sync.noise-kk.test.tsnoise.reject-zero-dh.test.tsPCH-02-009 regression tests — every Noise NK DH must reject an all-zero shared secret (low-order / identity peer point) instead of feeding it into the key schedule.pairing-dial.tsThe WebSocket seam every relay-facing Peach flow shares.pairing-handshake.tsShared pairing primitives used by the live relay-adoption path.pairing-invitation.test.tspairing-invitation.tspasskey-flags.tspasskey-flags.ts — single switch for the Firefox passkey content-script proxy.passkey-utils.test.tspasskey-utils.tspasskey-utils.ts — WebAuthn relying-party-id validation.recovery-word-list.tsrecovery-word-list.ts — 2048-word recovery word list for Peach vault recovery.recovery-words.checksum.test.tsT-002: BIP39 checksum rejectionrecovery-words.cross-platform.test.tsrecovery-words.integrity.test.tsT-001: BIP39 word-list integrityrecovery-words.kek.test.tsT-003: 128-bit prefix-KEK invariant (PCH-01-005 sibling)recovery-words.tsrecovery-words.ts — BIP39-compatible recovery word encoding for Peach vault recovery.rendezvous.test.tsrendezvous.tsshortcuts.test.ts@vitest-environment jsdomshortcuts.tsshortcuts.ts — keybinding schema, defaults, matcher, formatter.storage.tssync-identity.test.tssync-identity.tsSync identity — long-term X25519 keypair tied to the vault, not the device installation.sync-kk-transport.test.tssync-limits.tsSync trust + resource bounds — audit fixes HV-1 (timestamp clamp) and MV-3 (receive-path size bounds).sync-outcome.test.tssync-outcome.tsWhy a sync run ended, in a form both the service worker and the popup can name.sync-padding.test.tssync-padding.tsE7: frame padding at the relay boundary.sync-transport.tsWebSocket reconnect transport — Noise KK with both paired static keys.sync-types.tsVault sync — type definitions.sync.disconnect.test.tsT-020: WebSocket sync-disconnect handling (PCH-01-026 #9)types.tstypes.ts — cross-boundary types and the MessageType union.vault-adopt-snapshot.test.tsvault-adopt.test.tsvault-adopt.tstests/
fixtures/
history
7e401ad4a9dfadd passwordHistory model, capture old password on change in updateEntry, preserve across unlock, strip from passive fill4 months ago761e69236230fix: Copy & fill auto-saves and dismisses — no extra Save click (v3.6.158)4 months ago2adce7cc303efeat: contextual signup wizard — step through email → username → password on multi-field signup forms (v3.6.157)4 months ago3ae3a65f503ffix: detect separate email fields + exclude personal name fields from autofill (v3.6.156)4 months ago46998e6f05b2fix: inline edit mode no longer hijacked by silver-platter type-to-search handler (v3.6.155)4 months ago288ded81074etweak: rename vault sort label 'used' to 'recent' (key unchanged) (v3.6.154)4 months agof70e3c342944revert: remove vault list search-scope toggle (both/emails/usernames) from sort bar; search defaults to full-text 'both' as before (v3.6.153)4 months agoae1591d81f00fix: popup steadiness — will-change top/left, track modal internal scroll, dismiss when anchor leaves DOM (v3.6.152)4 months agodfa5e826f09dfix: shadow root delegatesFocus so modal focus traps see the popup host as focused instead of an opaque closed-shadow node (v3.6.151)4 months ago93a2840e97c4fix: identity helper + suggest list fade is scroll-state-aware (only when overflowing, clears at bottom) instead of an always-on mask that cut short lists (v3.6.150)4 months agoa45e13531957fix: inline popup mounts at document root for non-modal forms + compensates fixed containing-block ancestors (backdrop-filter/transform); renders on-field instead of clipped off-screen (v3.6.149)4 months ago5233be9a5934feat: Add vault search MRU scope toggle (v3.6.148)4 months agoccffed5200abfix: Add identity search, MRU sort, and username-aware fallback (v3.6.147)4 months ago70b8eecdabd3add internal notes — complete 12-part reference for Android team4 months agof907c7a5cc9fdocs: Record explicit-summon fix (v3.6.146)4 months ago7834ef7ed3cffix: Make explicit login-form icon clicks open Peach (v3.6.146)4 months ago5ede1338abb9release v3.6.145 to Chrome Web Store and Firefox AMO4 months agoadc8a19b4e39extend globe-detection to entry view domain row — DomainFavicon component, shared titleInitials/titleBackground, fix contracts mock5 months agob0f705a676edshow InitialsChip instead of Chrome globe for entries without a real favicon — canvas-based globe detection, no flash (v3.6.145)5 months agod12779c5867cfix passkey entry editability — isPasskeyOnly excludes TOTP/email, + 2FA always visible on login entries5 months agoab5496be14e8fix passkey Google origin timing bug and passkey+TOTP real-time merge5 months agoa885fa9c118abump version to 3.6.1425 months ago528a807295c0swallow Chrome Missing GetResponseDetails.responseJson error in GET pass-through paths5 months ago3aafd13289fbpass through GET requests with no matching Peach credential instead of rejecting NotAllowedError5 months agoea3d3ceb520adocs: session notes OUTCOMES — v3.6.140 end-to-end passkey create+get proof, orthogonality of null-buffer harness artifact, smoke now green5 months agoda331121f21ftest: prove passkey create+get end-to-end — extend compile-stripped E2E Pro bypass to provider-enable and get gates, drive smoke setup over messages (create/unlock/enable, lockOnClose off), approve in fresh popups; smoke now green (v3.6.140)5 months ago071b1347e42ddocs: session notes OUTCOMES — v3.6.140 passkey document-is-not-defined root cause and fix5 months ago6e876e9e1422fix: disable Vite modulePreload so the service worker's dynamic import() helper no longer touches document — passkey get/create no longer throws ReferenceError mid-flow (v3.6.140)5 months ago21fbb6627cdduse font-display block + preload RegularItalic so entry names keep Cormorant after pre-lock removal, no Times fallback (v3.6.139)5 months ago5847a1a7137dremove static #pre-lock splash so unlocked popup no longer flashes the lock screen on open (v3.6.138)5 months agoec66f22212b6test: add atomic-persist regression — a slot-B write failure must restore slot A so no phantom entry is left on disk (covers v3.6.137)5 months agoebb7bd2456e6fix: make vault persist atomic — restore prior slot A if a later write fails, so a failed save never leaves disk ahead of memory; eliminates phantom/duplicate entries (v3.6.137)5 months ago34691b7eed91fix: add unlimitedStorage + surface real save errors + plain-text note paste; cap vault history 10→5 — resolves intermittent STORAGE_QUOTA_EXCEEDED save failures (v3.6.136)5 months agoc3a13ed2e2c4before investigating intermittent entry/note save failures5 months agodeb59054482erelease v3.6.135 to Chrome Web Store and Firefox AMO5 months ago797d654ef572before v3.6.135 store release5 months ago3a5e85455435replace blur-based list dismiss with mousedown watcher — focus traps can't close the list (v3.6.135)5 months ago062f87c4a7e5resist focus-trap blur in identity suggest list + popup auto-close after inline unlock (v3.6.134)5 months ago42176e8b1f29broaden modal detection to form ancestor + position:fixed fallback (v3.6.132)5 months ago91ca0c3fee4eappend popup inside modal ancestor so focus traps don't intercept Peach's internal inputs (v3.6.131)5 months agob1774d59b9e2before modal-anchor popup fix5 months ago293e14f7664efix(sw): register onMessage handler synchronously at SW startup + gate unlock-dependent handlers on a restore-ready promise — fixes cold-start race where the popup's HAS_VAULT hit a listenerless worker and flashed onboarding; preserves the no-spurious-lock fix (v3.6.130)5 months agod4136f2febfddocs: independent security audit report — findings, resolutions, verification, safety rating (8.5/10), and codebase recommendations5 months ago3352fb2a8b40independent security audit complete — all 18 confirmed findings resolved (v3.6.129); mobile resynced (peach-android v1.0.39)5 months ago07ce1ae7d42cfix(security): recovery words no longer exported to world-readable Android public Downloads — native offers a clipboard copy, desktop keeps user-chosen-location .txt (MEDIUM #7); document Web3Forms key as an intentionally-public anti-spam token (INFO #11) (v3.6.129)5 months agocf426553736efix(security): CSV export neutralizes spreadsheet formula injection (MEDIUM #8); 2FA toast no longer renders the live code into page-readable DOM (LOW #10); password generator uses rejection sampling to remove modulo bias (INFO #12) (v3.6.128)5 months agoc9f2283eb546fix(security): duress pads both vault slots to a fixed 256KiB ceiling so ciphertext lengths never reveal a hidden decoy vault exists — restores plausible deniability across real-vault growth (MEDIUM #5) (v3.6.127)5 months ago935ae427d7eefix(security): pairing now gates persistence on a user-confirmed Short Authentication String (SAS) derived from the shared Noise handshake hash — both devices show it, user confirms match before enrolling; defeats LAN/audio-range initiator impersonation (HIGH #4, extension+shared) (v3.6.126)5 months ago2da1a2aff52cfix(security): inline locked bubble no longer collects the master password in page DOM — routes to the trusted popup via OPEN_POPUP; removes page-observable keystroke surface and the trim/no-trim inconsistency (HIGH #3 + LOW #9) (v3.6.125)5 months agoc0204fa478dffix(security): CSV/JSON import requires a real master password when no vault exists; CREATE_VAULT handler rejects empty password — no more empty-key vault with zero at-rest protection (HIGH) (v3.6.124)5 months ago
details
Peach
A free, open source, local-first password manager for Chrome, Firefox, and Android.
Peach encrypts your vault on your device. No hosted vault, subscription, or account is required to use it.
Features
- Passwords, cards, and secure notes — keep your private data together in one encrypted vault
- Inline autofill — fill and save credentials without leaving the page
- TOTP built in — generate two-factor codes without a separate authenticator
- Password health — find weak, reused, and exposed passwords
- Portable backups — export and restore with PeachScript or a
.peachfile
Peach Pro adds:
- Peach Sync — end-to-end encrypted sync across paired devices
- Passkeys — save and use passkeys in Chrome and Firefox
- Peach Codex — print an encrypted, scannable backup of your vault
- Advanced vault health, Canary Entries, and duress tools
See the Peach website for current availability and Pro details.
Install
Open Source
Peach is released under the GPL v3. This repository contains Peach's Chrome and Firefox browser extensions. Android is maintained separately.
The source is hosted on Kepr, Asha Software's version control platform.
Security
Vault data is encrypted with AES-256-GCM and protected by Argon2id key derivation. Peach Sync authenticates paired devices and encrypts data in transit.
Implementation details live alongside the code:
Building
bun install --frozen-lockfile
bun run build
Builds are written to dist-chrome/ and dist-firefox/.
Built by Asha Software · [email protected]