peach-browser
A free, open source, local-first password manager for Chrome, Firefox, and Android.
TypeScript
timeline
atlas266 files
public/
codex/
fonts/
models/
scripts/
build-peachscript.pyBuild PeachScript-Regular.otf — 256 historical-runic glyphs.ci.tsclean-chrome-dist.mjsclean-firefox-artifacts.mjspackage-amo-source.shpackage-amo-source.sh — produce peach-3.6.65-source.zip for AMO review.release-firefox.tsrelease.tssetup-chrome-release.sh───────────────────────────────────────────────────────────────────────────── Peach — Chrome Web Store Release Setup Run this once to configure Chrome publishing.sync-chrome-dist.mjs
src/
background/
aes.test.tsaes.tsaes.ts — AES-256-GCM encrypt/decrypt primitives for vault storage.alarms.test.tsalarms.tschirp-identity.tsLocal-device identity helpers for the chirp-sync architecture.chirp-sync-coordinator.test.tschirp-sync-coordinator.tsChirp Sync — Phase 2 manifest-diff coordinator.chirp-sync-runner.test.tschirp-sync-runner.tsProduction sync runner — composes the live vault adapter, WebSocket transport, and coordinator into the function the dispatcher injects via
setSyncRunner.chirp-sync-static.test.tsIV.7 — Static safety assertions for Chirp Sync.chirp-sync-vault-adapter.test.tschirp-sync-vault-adapter.tsProduction adapter that backs runChirpSyncInitiator with the live vault.clipboard.test.tsclipboard.tscodex-handlers.test.tsTests for src/background/codex-handlers.ts.codex-handlers.tscodex-handlers.ts — message handlers that back the Peach Codex flow.commands.tsKeyboard command handler — routing for summon-inline: 1.entry.tshealth.test.tshealth.tshealth.ts — Pro advanced vault health analysis.index.tslicense.tsmessages.adversarial.test.tsmessages.adversarial.test.ts — Layer 3 §3.3 adversarial message handler tests.messages.test.tsmessages.tsmessages.ts — the only background message handler.ml.tsnotes.test.tspaired-devices.test.tspaired-devices.tsPaired-device registry — v3 chirp-sync.passkey-chrome-ceremony.test.tspasskey-chrome-ceremony.test.ts — covers the Chrome chrome.webAuthenticationProxy ceremony path that the Firefox-proxy test file does NOT exercise.passkey-crypto.test.tspasskey-crypto.tspasskey-deny-on-close.test.tspasskey-deny-on-close.test.ts — M8/COR-009passkey-firefox-proxy.test.tspasskey-firefox-proxy.test.ts — covers the v2.12.0 Firefox content-script proxy path.passkey.tsrecovery-pending.tsPersistent flag set while the user has just created a vault and is reading their 12 recovery words but has not yet typed the 3 confirmation words.recovery-words.test.tsrecovery.adversarial.test.tsrecovery.adversarial.test.ts — Layer 3 §3.2 adversarial recovery words tests.self-test.test.tsself-test.tsself-test.ts — Known-Answer Test (KAT) for the Peach crypto stack.sync-trigger.test.tssync-trigger.tssync-trigger.ts — central sync dispatcher.vault-history.test.tsVault history tests.vault.adversarial.test.tsvault.adversarial.test.ts — Layer 3 §3.1 adversarial vault tests.vault.test.tsvault.tsvault.ts — sole owner of vault state and chrome.storage vault keys.content/
passkey-toast/
crypto/
argon2.test.tsargon2.tscrypto.test.tspeachPayload.test.tspeachPayload.tspeachPayload.ts — binary payload format shared by PeachScript and the Peach QR matrix code (spec §2).peachScript.test.tspeachScript.tspeachScript.ts — PeachScript encoding/decoding.totp.tszstd.tsThin wrapper around @bokuweb/zstd-wasm that defers WASM load until the first compress/decompress call and memoises the init promise.
popup/
codex/
aztec.tsaztec.ts — Aztec 2D barcode generation with round-trip verification.browser-bundle.test.tscodex.adversarial.test.tscodex.adversarial.test.ts — Layer 3 §3.4 adversarial Codex tests.codex.suite.test.tscodex.suite.test.ts — cross-cutting regression suite for the Codex pipeline.codex.test.tsconfirmation.tsPick 3 distinct positions in [1, 12] for the recovery-words confirmation gate.erasure.tserasure.ts — Reed-Solomon erasure coding around the WASM library.generate.test.tsgenerate.tsgenerate.ts — full Codex generation pipeline.helpers.tshelpers.ts — shared utilities for Codex generation and restoration.node-wasm.tsNode-only WASM byte loader for Vitest.pdf-import.test.tspdf-import.test.ts — coverage for the testable surface of the PDF import path.pdf-import.tspdf-import.ts — restore from a Codex PDF instead of a camera scan.pdf-layout.tspdf-layout.ts — A4 Codex page geometry shared between the generator and the PDF importer.pdf.tspdf.ts — render the printable Codex PDF.reed-solomon.tsBrowser-safe wrapper around the Reed-Solomon WASM exports.restore.test.tsrestore.test.ts — coverage for ChunkBuffer, parseRawScan, reconstructAndVerify.restore.tsrestore.ts — Peach Codex restoration library (popup-side).rs-loader.tsrs-loader.ts — load the Reed-Solomon erasure WASM module.scanner.tsscanner.ts — camera-based Aztec scanning for Codex restoration.
components/
views/
Add.tsxChirpSync.tsxChirpSync — the v3 Settings → Sync surface.CodexGenerateView.test.tsx@vitest-environment jsdomCodexGenerateView.tsxPeach Codex — generation view.CodexRestoreView.tsxPeach Codex — restoration view.contracts.test.tsx@vitest-environment jsdomEntry.tsxExport.tsxSignal-conditioned views in this file must use <Show>, never a signal-conditioned early return (
if (signal()) return <X/>).Health.test.tsx@vitest-environment jsdomHealth.tsxImport.tsxSignal-conditioned views in this file must use <Show>, never a signal-conditioned early return — see Projects.md §4.1.Lock.tsxNoteEditor.toHtml.test.ts@vitest-environment jsdomNoteEditor.tsxNotesEditor.tsxNotesMode.tsxNotesTOC.tsxOnboarding.tsxPanic.tsxPasskeyApproval.tsxProCelebration.tsxRecoveryWordDisplay.tsxRecoveryWordEntry.tsxSettings.tsxTrashView.tsxVault.tsxview-test-utils.tsxshared/
backup.test.tsbackup.tsbridge.tsbrowser.test.tsbrowser.test.ts — locks down feature-detected browser identification.browser.tsbrowser.ts — feature-detected browser identifier shared by background, popup, and content scripts.chirp-handshake.test.tschirp-handshake.tsPost-chirp pairing handshake.chirp-pairing.test.tschirp-pairing.tsAudio pairing driver — orchestrates the two-chirp exchange that bootstraps trust between two devices in the same room.chirp-payload.test.tschirp-payload.tsAudio pairing payload — 64 bytes on the wire.chirp-sync-transport.test.tsSubnet-probe rate-limit tests.chirp-sync-transport.tsWebSocket sync transport — v3 chirp-sync Phase 2.codex-types.tscodex-types.ts — shared shapes for the Peach Codex.config.tsTemporary until Vesper (internal tracker) is readydevice-manifest.test.tsdevice-manifest.tsDevice manifest — v2 brief §4.3.domain.tsfavicon.test.tsfavicon.tsResolves a favicon URL for a given domain.generate.test.tsgenerate.tsggwave.test.tsggwave.tsggwave loader — thin async wrapper around the ggwave-wasm module.import.test.tsimport.ts
any is intentional throughout this module (L17/I3/QUA-010): import files are user-supplied external JSON whose schemas vary by source app and version (1Password CPG, Bitwarden, CXF, generic CSV).local-network.tsLocal network discovery — minimal helper used by chirp pairing.ml.tsnative.tsMobile platform detection helpers used by popup views to gate Capacitor-only paths.noise-js.test.tsNoise NK auth proof regression test.noise-js.tsNoise NK initiator for Android / Capacitor.noise-xx.test.tsnoise-xx.tsNoise XX (mutual auth) — used for every Phase-2 WebSocket connection after the audio chirp pairing has stamped each side into the other's paired-device registry.passkey-flags.tspasskey-flags.ts — single switch for the Firefox passkey content-script proxy.recovery-word-list.tsrecovery-word-list.ts — 2048-word recovery word list for Peach vault recovery.recovery-words.tsrecovery-words.ts — BIP39-compatible recovery word encoding for Peach vault recovery.shortcuts.test.ts@vitest-environment jsdomshortcuts.tsshortcuts.ts — keybinding schema, defaults, matcher, formatter.storage.tssync-identity.test.tssync-identity.tsSync identity — long-term X25519 keypair tied to the vault, not the device installation.sync-types.tsChirp Sync — type definitions (Master Brief v2).types.tstypes.ts — cross-boundary types and the MessageType union.tests/
fixtures/
history
5d22740c27d6feat: UI-1 sync alert banners — popup fetches GET_SYNC_ALERTS on open, renders dismissible REMOTE_PASSWORD_CHANGE/REMOTE_DELETE/DEVICE_KEY_ROTATED banners, acks with consume4 months ago800e374c624bfeat: UI-3 + UI-4 Sync settings — pending vouched-device Allow/Reject rows (CONFIRM/REJECT) with live badge, rotate-sync-identity danger button + confirm dialog (ROTATE_SYNC_IDENTITY) routing to new recovery words4 months agob5317629a444feat: UI-2 lazy-search loading hint — pulsing 'searching…' in inline popup while vault-wide list loads on first search gesture4 months agobefb31137ebbfeat: UI-8 homograph warning — non-blocking row in Entry URL editor + save.ts offer banner when page domain is non-ASCII/punycode4 months ago41ef91e27e40feat: UI-7 friendly IMPORT_TOO_LARGE message in import view (maps MV-5 oversized-import error, never shows raw string)4 months ago6a30323ef695feat: UI-6 popup lock port uses nonce'd name popup-<uuid> (pairs with LV-5 entry.ts acceptance)4 months ago9af036ca50b9test: adapt recovery-words + recovery.adversarial suites to LV-4 GET_RECOVERY_WORDS password re-auth; full suite green (3141)4 months ago56b407befb6efix: LV-9 exact-pin crypto/vault deps (hash-wasm, @stablelib/*, zstd-wasm, reed-solomon, pdfjs-dist, tldts) + WASM-PROVENANCE SHA-256 table4 months ago2a773119080bfix: LV-8 replace unmaintained zxcvbn with @zxcvbn-ts/core 3.0.4 (+language-common 3.0.4, language-en 3.0.2 — no 3.0.4 published); Lock.tsx lazy loader with dictionaries4 months agoeb5ade2fb949fix: LV-7 ggwave createNamedFunction static rewrite (no new Function, CSP-safe) + PEACH-PATCH marker; updateSettings proto-pollution key filter4 months ago47e9cdca5c50fix: LV-6 standardize on [email protected] — packageManager pin, frozen-lockfile CI gate, commit bun.lock + drop pnpm/npm lockfiles, source-zip ships bun.lock4 months ago2335dde54c5bfix: LV-5 deduplicate onConnect popup lock — delete dead background/index.ts, accept nonce'd popup-<uuid> port (legacy popup for one release) in entry.ts4 months agoe1bf91ef908dfix: LV-4 GET_RECOVERY_WORDS requires fresh password re-auth (verifyMainPassword), exempt during recovery-pending confirmation window; change-password flow sets pending4 months ago0c436fd73d57fix: LV-3 canary fetch debounced per webhook+entry (1h), test pings exempt — caps page-induced ping firehose while keeping each canary live4 months ago8c8a5b1478bcfix: LV-2 detectHomograph flags non-ASCII and xn-- punycode hostnames (non-blocking detector; edit/save-banner UI lands in UI-8)4 months ago878cf96cfacbfix: LV-1 NFC-normalize master password at deriveKey chokepoint + deriveKeyRaw legacy-unlock fallback with heal; NFC on export KDF and recovery words4 months agob02250b96462fix: MV-9 pdf.js getDocument hardened — isEvalSupported:false + disableFontFace/Range/Stream on Codex PDF import4 months agof6a46c70c59ffix: MV-8 sync revocation — rotateSyncIdentity re-keys root + clears peers + recovery-pending, removePairedDeviceById security note, DEVICE_KEY_ROTATED notify/alert4 months ago590192651cb2fix: MV-7 vouched-manifest trust requires user confirmation — unknown devices queue in pending-vouched store until CONFIRM/REJECT4 months ago4620e8e0a3acfix: MV-6 import whitelist — sanitizeRestoredEntry routed through normalizeEntry, nested passkey/canary shape sanitizers, peachPayload passkey blob field picker4 months agoa207e6c140c2fix: MV-5 file and string size limits on all import paths — PDF gate before read, raw-string caps in parseImportSource and importEntriesFromPeachJson4 months ago386e53180a98fix: MV-4 decompression bomb caps — declared-length + cumulative section caps in peachPayload, zstd output cap, bounded streaming inflate in Codex generate4 months agob529572d23c6fix: MV-3 sync receive bounds — transport frame cap, coordinator pre-parse cap, adapter entry-count/per-envelope/tombstone limits4 months ago56ea59d6835afix: MV-2 vault inventory lazy-loaded behind userGesture gate; inline popup search loads vault-wide list only on explicit search gesture4 months ago2105d0bf213bfix: MV-1 GET_ENTRY_FOR_FILL re-validates sender origin against entry domain set; explicitSummon flag on cross-domain summons4 months ago1cb25e2b1e38fix: HV-2 clipboard auto-clear via chrome.alarms backstop + offscreen document; offscreen wired into Chrome build, firefox manifest unchanged4 months agofed31ad00996fix: HV-1 clamp future sync timestamps + remote-mutation alert queue (v3.7.1 base)4 months ago1b75540dc84cchore: copy audit-fix new files + clipboard.ts replacement; exclude internal drafts from tsc/vitest (pre-patch — HV-1 test red until HV-1)4 months agofecde68f0c43record audit-fix drafts session outcome4 months agof05963232662add audit-fix drafts README and INTEGRATION-CONTRACT: file map, new deps/permissions, UI work, sequencing, spec deviations, ~60-test estimate4 months ago17cc61a09727add LV-6 to LV-9 audit fix drafts: bun lockfile standardization, ggwave createNamedFunction static rewrite + settings proto-pollution filter, zxcvbn-ts migration, exact-pin crypto deps + WASM-PROVENANCE4 months ago7dc4a6f5f29aadd LV-1 to LV-5 audit fix drafts: NFC chokepoint with legacy fallback, homograph detector, per-key canary debounce, recovery-words password re-auth, onConnect dedup + nonce port4 months agoafaf05013b19add MV-9 audit fix draft: pdf.js getDocument hardened with isEvalSupported:false, disableFontFace/Range/Stream4 months agoc6c9305d6ce7add MV-8 audit fix draft: removePairedDeviceById security note, rotateSyncIdentity root-key rotation in vault.ts, DEVICE_KEY_ROTATED notification, settings UI contract4 months agoc344313d62baadd MV-7 audit fix draft: new vouched devices queue in pending-vouched-devices store until user confirms via CONFIRM/REJECT_VOUCHED_DEVICE handlers4 months ago41dd37002842add MV-6 audit fix draft: sanitizeRestoredEntry routed through normalizeEntry whitelist with passkey/canary shape sanitizers, peachPayload passkey blob picked not spread4 months agob9d695be722dadd MV-5 audit fix draft: import size limits — 25 MiB PDF gate before arrayBuffer, 10 MiB raw-string gate in parseImportSource and importEntriesFromPeachJson, UI error mapping4 months ago7681d8b87d52add MV-4 audit fix draft: decompression bomb caps — import-limits module, declared-length + cumulative checks in peachPayload, zstd output cap, bounded streaming inflate in Codex generate4 months ago5f80f9a47790add MV-3 audit fix draft: sync receive bounds — transport frame cap, coordinator pre-parse cap, adapter entry-count/per-entry/tombstone limits4 months ago7120becb5a8cadd MV-2 audit fix draft: vault-wide includeAll list fetched lazily behind userGesture gate, lazy-load thunk threaded to inline popup search4 months ago227776363daaadd MV-1 audit fix draft: GET_ENTRY_FOR_FILL re-validates entry domain set against browser-attested sender origin, explicitSummon escape hatch4 months ago1d7f5aad32f4add HV-2 audit fix draft: clipboard auto-clear via chrome.alarms backstop + offscreen document, full clipboard.ts replacement, manifest/entry wiring4 months ago0fe9d25fec1aadd HV-1 audit fix draft: clampSyncTimestamp + sync-limits module, sync-alerts queue, merge/tombstone clamp patches, 4 unit tests4 months ago96a378083e97add internal review notes — Fable adversarial static audit; encryption + autofill boundary clean4 months agoc1f231e00063always-show history toggle + empty state in both edit surfaces (v3.7.1); record outcome4 months agoba3bcf1cd545record v3.7.0 password-history outcome4 months agoef5b40237b76bump to v3.7.0 and rebuild Chrome + Firefox + Mobile dists4 months agob695a37f5dd2add vault password-history tests (capture, cap, restore, persistence) and message fill/edit history-stripping test4 months agoe3936c5a967cadd password history reveal/copy/restore to inline edit form with styling and timeSince helper4 months ago24cc275f410fadd password history reveal/copy/restore drawer to main popup edit mode with styling4 months ago
details
Peach
A free, open source, local-first password manager for Chrome, Firefox, and Android.
Peach encrypts your vault on your device. No hosted vault, subscription, or account is required to use it.
Features
- Passwords, cards, and secure notes — keep your private data together in one encrypted vault
- Inline autofill — fill and save credentials without leaving the page
- TOTP built in — generate two-factor codes without a separate authenticator
- Password health — find weak, reused, and exposed passwords
- Portable backups — export and restore with PeachScript or a
.peachfile
Peach Pro adds:
- Peach Sync — end-to-end encrypted sync across paired devices
- Passkeys — save and use passkeys in Chrome and Firefox
- Peach Codex — print an encrypted, scannable backup of your vault
- Advanced vault health, Canary Entries, and duress tools
See the Peach website for current availability and Pro details.
Install
Open Source
Peach is released under the GPL v3. This repository contains Peach's Chrome and Firefox browser extensions. Android is maintained separately.
The source is hosted on Kepr, Asha Software's version control platform.
Security
Vault data is encrypted with AES-256-GCM and protected by Argon2id key derivation. Peach Sync authenticates paired devices and encrypts data in transit.
Implementation details live alongside the code:
Building
bun install --frozen-lockfile
bun run build
Builds are written to dist-chrome/ and dist-firefox/.
Built by Asha Software · [email protected]