peach-browser
A free, open source, local-first password manager for Chrome, Firefox, and Android.
TypeScript
timeline
atlas179 files
public/
fonts/
models/
scripts/
src/
background/
aes.test.tsaes.tsaes.ts — AES-256-GCM encrypt/decrypt primitives for vault storage.alarms.test.tsalarms.tsclipboard.test.tsclipboard.tscommands.tsKeyboard command handler — routing for summon-inline: 1.entry.tshealth.test.tshealth.tshealth.ts — Pro advanced vault health analysis.index.tslicense.tsmessages.test.tsmessages.tsmessages.ts — the only background message handler.ml.tspairing-server-state.tsTracks the active 6-digit pairing-server session.passkey-crypto.test.tspasskey-crypto.tspasskey-firefox-proxy.test.tspasskey-firefox-proxy.test.ts — covers the v2.12.0 Firefox content-script proxy path.passkey.tsrecovery-pending.tsPersistent flag set while the user has just created a vault and is reading their 12 recovery words but has not yet typed the 3 confirmation words.sync-coordinator.test.tssync-coordinator.tssync-network.tssync-storage.tsvault-history.test.tsVault history tests.vault.test.tsvault.tsvault.ts — sole owner of vault state and chrome.storage vault keys.
content/
passkey-toast/
crypto/
argon2.test.tsargon2.tscrypto.test.tspeachPayload.test.tspeachPayload.tspeachPayload.ts — binary payload format shared by PeachScript and the Peach QR matrix code (spec §2).peachScript.test.tspeachScript.tspeachScript.ts — PeachScript encoding/decoding.totp.tszstd.tsThin wrapper around @bokuweb/zstd-wasm that defers WASM load until the first compress/decompress call and memoises the init promise.
popup/
components/
views/
Add.tsxcontracts.test.tsx@vitest-environment jsdomEntry.tsxExport.tsxSignal-conditioned views in this file must use <Show>, never a signal-conditioned early return (
if (signal()) return <X/>).Health.tsxImport.tsxSignal-conditioned views in this file must use <Show>, never a signal-conditioned early return — see Projects.md §4.1.Lock.tsxNoteEditor.tsxNotesEditor.tsxNotesMode.tsxNotesTOC.tsxOnboarding.tsxPanic.tsxPasskeyApproval.tsxProCelebration.tsxRecoveryWordDisplay.tsxRecoveryWordEntry.tsxSettings.tsxSyncPairing.tsxTrashView.tsxVault.tsxview-test-utils.tsxshared/
backup.test.tsbackup.tsbridge.tsbrowser.tsbrowser.ts — feature-detected browser identifier shared by background, popup, and content scripts.domain.tsfavicon.test.tsfavicon.tsResolves a favicon URL for a given domain.generate.test.tsgenerate.tsimport.test.tsimport.tslocal-network.tsml.tsnative.tsMobile platform detection helpers used by popup views to gate Capacitor-only paths.noise-js.test.tsNoise NK auth proof regression test.noise-js.tsNoise NK initiator for Android / Capacitor.passkey-flags.tspasskey-flags.ts — single switch for the Firefox passkey content-script proxy.recovery-word-list.tsrecovery-word-list.ts — 2048-word recovery word list for Peach vault recovery.recovery-words.tsrecovery-words.ts — BIP39-compatible recovery word encoding for Peach vault recovery.shortcuts.test.ts@vitest-environment jsdomshortcuts.tsshortcuts.ts — keybinding schema, defaults, matcher, formatter.storage.tssync-types.tssync-wire.tstypes.tstypes.ts — cross-boundary types and the
MessageType union.websocket-sync-transport.tstests/
fixtures/
history
4cefcb6b900atighten PeachScript subview to match export password card pattern (peach-settings-input, password-stack, master-password labelled section, mismatch hint); surface real backend error code instead of swallowing as RESTORE_FAILED; bump 2.7.36 months ago24d24af0eefdadd peachscript tile to onboarding restore picker as primary option; add initialView prop to ImportView so callers can deep-link into a specific subview; bump 2.7.26 months agobce5897d91f7redesign Import view to mirror Export menu pattern: card menu (peachscript paste / backup file) routes into focused subviews; PeachScript is the primary import path; preserve onboarding header, replace warning, master-password creation, merge/replace flows; bump 2.7.16 months ago9d435183c145delete all CJK code: 9 crypto modules + tests, CJKImport view, all UI references in App/Lock/Import/Settings, CSS rules, and stale comments; rename peach-cjk-qr-card to peach-passkey-card; bump 2.7.06 months ago8b496c05bd31before full CJK removal6 months ago06d1cb878ddcremove deprecated CJK phrase button from Settings restore surface; legacy CJK import still reachable via Import.tsx fallback; bump 2.6.46 months agoed4ce861a751reset trash-confirm and inline edits on entry change so prompts don't persist across selection; bump 2.6.36 months ago1306d91f5d4afix CFF private dict so Chromium OTS sanitizer accepts the font; suppress export result group bottom border; bump 2.6.26 months ago29b9d815a1dfreplace 15 weak layer-4 glyphs with stronger runic forms per tuning brief6 months agof3478eae923bregenerate PeachScript-Regular.otf with 256 historical-runic glyphs across four authentic extension layers6 months agofc2b557daaafbefore peachscript v2 font regeneration6 months ago6fb3c1f9873elog rune canvas + password autofocus session6 months ago7988534357d6autofocus first password input and submit on Enter for peachscript and QR backup forms6 months agoc5d246f728d6replace static peachscript text with animated RuneCanvas — scrolling rows with accent embers6 months agof2a5092253bdAppearance: 4 display fonts (Cormorant Italic / Cormorant / Inter / System), 3 text sizes (small / default / large via zoom), reduce-motion toggle — all driven by data-attributes on html and CSS variables so desktop/mobile builds inherit the same plumbing (v2.6.0)6 months ago2d236b3fa7d9PeachScript display: 22px glyphs, accent-tinted surface and glow, fill remaining vertical space, hidden horizontal scroll, styled vertical scrollbar; export menu: distribute three format cards across the popup (v2.5.1)6 months ago337f921aba65remove CJKExport.tsx + cjkPassphrase + their tests; trim backup.ts; bump to v2.5.0; update Projects.md §3.7 and §7.5; session notes outcomes6 months ago964d7e074a21rewrite Export.tsx and Import.tsx as unified screens — PeachScript primary, QR + CSV secondary, legacy CJK collapsed in import6 months agoab37b5888acaadd peachQR.ts — standard QR encoder for printable backup with explicit capacity boundary (proprietary matrix code deferred)6 months ago38a1ce3728e4add peachPayload.ts — section-based binary format with shared string table, delta timestamps, raw UUID bytes, AES-256-GCM envelope under Argon2id6 months ago1ad3a3572756add peachScript.ts — PUA U+E000..U+E0FF byte-to-codepoint codec with full round-trip tests6 months ago3cd9c3a61b67before peach export system v2.5.0 — peachScript, QR, CSV, legacy CJK removal6 months ago1233f69caec8Sync screen redesign: full feature showcase for free users replacing sparse gate (v2.4.5)6 months agobddf8230659bnav_prev/nav_next shortcuts changed from ArrowUp/Down to ArrowLeft/Right (v2.4.4)6 months ago0f322cfe1208License screen: real PeachMark SVG replaces emoji, Get Peach Pro button shrunk (v2.4.3)6 months ago7faf15611234session notes and Projects.md updated with pro addendum decisions and State 11 (v2.4.2)6 months ago2c915c4eb112passkey Pro gate in inline popup (State 11), background sync pendingProNotice banner (v2.4.2)6 months agof87c03ab9e01license key included in CJK and encrypted JSON vault exports, restored on import (v2.4.1)6 months ago34d5c471b02cbefore pro addendum — license export, passkey gate, sync notice6 months agob44e8d8142ccPro activation celebration — plays once on first popup open after license activation6 months agof2a05b205496before Pro celebration view6 months ago1cce4388cf54identity helper State 10 complete — version bump, Projects.md §4.15, session notes outcomes (v2.4.0)6 months ago4b42e5fd90d4State 10 renderIdentityHelper() in inject.ts, openSignupSelector fetches GET_IDENTITIES and wires email→generator→save flow6 months ago5c84f57c81c7SavedIdentity type, GET_IDENTITIES in MessageType, getIdentities() in vault.ts, handler and tests in messages.ts6 months ago1697ce363850before identity helper State 106 months agod204c0a4c417feat: Pro gate — requirePro(), PRO_GATE_TRIGGERED, sync/passkeys/health/smart-change handler enforcement (v2.3.0)6 months ago83e4ac8c9fbfbefore pro tier master plan v2.3.06 months ago15583ef6c4c5phase C: rebind UI in Settings → Shortcuts (per-action chip with capture-mode 'Press a key…' state, conflict detection vs other bindings, per-row reset and reset-all), help dialog overlay (?), App.tsx applyShortcuts persists only deltas vs DEFAULT_BINDINGS so future default updates land for non-customized actions; updates contracts.test.tsx for new SettingsView props (v2.3.0)6 months agoa17baeac9c45phase B: wire popup keyboard handler through bindings — replace hardcoded switch with SHORTCUT_HANDLERS map + matchKeybinding loop, load active bindings from settings on init, add new actions (copy_totp, edit_entry, delete_entry, jump_vault, jump_settings, show_help), input-focus and entry-scope guards preserve existing behavior; type-to-search remains a behavior (not an action)6 months ago616b4528790dphase A: add shared/shortcuts.ts — ShortcutAction union of 13 actions, Keybinding type, DEFAULT_BINDINGS (c/u/t/n/e/d/L=ctrl-l/?=shift+?/↑↓/ctrl+1/ctrl+,), matchKeybinding/keybindingFromEvent/formatKeybinding/findConflict helpers; add shortcuts? to VaultSettings; 15 unit tests cover matcher/formatter/conflict/override merging6 months ago91c0d36709babefore mature shortcuts system overhaul6 months agoe7eb8d5166f4fix: light-theme contrast — settings section icons darken from pure peach to peach-on-ink mix with stronger bg tint; replace 4 hardcoded rgba(240,232,216,*) text-color rules with var(--peach-t0) so they follow theme (peach-restore-warning, domain-chip, tag-filter-chip selected, duress-status active); peach-info-notice bg moves from invisible cream-on-cream to surface-card token (v2.2.3)6 months agofdc41e4571bbfeat: Pro benefits promo on Account screen — Cormorant italic headline, mono tagline, three accent-icon benefit bullets (Sync, Passkeys, future features), accent CTA with glow, radial gradient backdrop, divider before activate-key flow (v2.2.2)6 months ago6dfe457ed344fix: replace stray Unicode ⓤ/ⓟ glyphs in silver-platter and card-platter copy buttons with plain text — Copy username / Copy password / Copy number / Copy CVC (v2.2.1)6 months ago7a3d55d3fcc1supersede 14:18 [PROGRESS] and [PLANS] with the closing OUTCOMES record for v2.2.0 (Pass 7 done, save 5b1bd9672185 tagged v2.2.0)6 months ago5b1bd9672185feat: inline popup complete redesign — first-class citizen of Peach (v2.2.0): bump 2.1.9 → 2.2.0 in package.json + both manifests, add Projects.md §4.14 (state machine, theme system, dismissal + fill-success lock model, card autofill wiring, deferred follow-ups), append session notes OUTCOMES6 months ago2f850bd105b2add TOTP tray to silver platter — ··· button expands tray with grouped TOTP code, accent-colored countdown ring, copy button; cleanupHooks ensures the 1s refresh interval is cleared on dismiss6 months agoe088bc468451add card silver platter (State 7): extend AUTOFILL_QUERY with kind=card, new showCardSelector + setupCardAutofill wiring with icon injection on cc-number, fillCardForm integration, dismissal + fill-success lock reuse6 months ago217979dbf3f7wip: record session progress (Passes 0–4 done) and remaining plan (Passes 5–7)6 months ago708e87ada524fill detected form fields after new-entry save in both login and signup modes; record into filledForms to suppress reopens6 months ago
details
Peach
A free, open source, local-first password manager for Chrome, Firefox, and Android.
Peach encrypts your vault on your device. No hosted vault, subscription, or account is required to use it.
Features
- Passwords, cards, and secure notes — keep your private data together in one encrypted vault
- Inline autofill — fill and save credentials without leaving the page
- TOTP built in — generate two-factor codes without a separate authenticator
- Password health — find weak, reused, and exposed passwords
- Portable backups — export and restore with PeachScript or a
.peachfile
Peach Pro adds:
- Peach Sync — end-to-end encrypted sync across paired devices
- Passkeys — save and use passkeys in Chrome and Firefox
- Peach Codex — print an encrypted, scannable backup of your vault
- Advanced vault health, Canary Entries, and duress tools
See the Peach website for current availability and Pro details.
Install
Open Source
Peach is released under the GPL v3. This repository contains Peach's Chrome and Firefox browser extensions. Android is maintained separately.
The source is hosted on Kepr, Asha Software's version control platform.
Security
Vault data is encrypted with AES-256-GCM and protected by Argon2id key derivation. Peach Sync authenticates paired devices and encrypts data in transit.
Implementation details live alongside the code:
Building
bun install --frozen-lockfile
bun run build
Builds are written to dist-chrome/ and dist-firefox/.
Built by Asha Software · [email protected]