peach-browser
A free, open source, local-first password manager for Chrome, Firefox, and Android.
TypeScript
timeline
atlas268 files
public/
codex/
fonts/
models/
scripts/
build-peachscript.pyBuild PeachScript-Regular.otf — 256 historical-runic glyphs.ci.tsclean-chrome-dist.mjsclean-firefox-artifacts.mjspackage-amo-source.shpackage-amo-source.sh — produce peach-3.6.65-source.zip for AMO review.release-firefox.tsrelease.tssetup-chrome-release.sh───────────────────────────────────────────────────────────────────────────── Peach — Chrome Web Store Release Setup Run this once to configure Chrome publishing.sync-chrome-dist.mjs
src/
background/
aes.test.tsaes.tsaes.ts — AES-256-GCM encrypt/decrypt primitives for vault storage.alarms.test.tsalarms.tschirp-identity.tsLocal-device identity helpers for the chirp-sync architecture.chirp-sync-coordinator.test.tschirp-sync-coordinator.tsChirp Sync — Phase 2 manifest-diff coordinator.chirp-sync-runner.test.tschirp-sync-runner.tsProduction sync runner — composes the live vault adapter, WebSocket transport, and coordinator into the function the dispatcher injects via
setSyncRunner.chirp-sync-static.test.tsIV.7 — Static safety assertions for Chirp Sync.chirp-sync-vault-adapter.test.tschirp-sync-vault-adapter.tsProduction adapter that backs runChirpSyncInitiator with the live vault.clipboard.test.tsclipboard.tscodex-handlers.test.tsTests for src/background/codex-handlers.ts.codex-handlers.tscodex-handlers.ts — message handlers that back the Peach Codex flow.commands.tsKeyboard command handler — routing for summon-inline: 1.entry.tshealth.test.tshealth.tshealth.ts — Pro advanced vault health analysis.index.tslicense.tsmessages.adversarial.test.tsmessages.adversarial.test.ts — Layer 3 §3.3 adversarial message handler tests.messages.test.tsmessages.tsmessages.ts — the only background message handler.ml.tsnotes.test.tspaired-devices.test.tspaired-devices.tsPaired-device registry — v3 chirp-sync.passkey-chrome-ceremony.test.tspasskey-chrome-ceremony.test.ts — covers the Chrome chrome.webAuthenticationProxy ceremony path that the Firefox-proxy test file does NOT exercise.passkey-crypto.test.tspasskey-crypto.tspasskey-deny-on-close.test.tspasskey-deny-on-close.test.ts — M8/COR-009passkey-firefox-proxy.test.tspasskey-firefox-proxy.test.ts — covers the v2.12.0 Firefox content-script proxy path.passkey.tsrecovery-pending.tsPersistent flag set while the user has just created a vault and is reading their 12 recovery words but has not yet typed the 3 confirmation words.recovery-words.test.tsrecovery.adversarial.test.tsrecovery.adversarial.test.ts — Layer 3 §3.2 adversarial recovery words tests.self-test.test.tsself-test.tsself-test.ts — Known-Answer Test (KAT) for the Peach crypto stack.sync-trigger.test.tssync-trigger.tssync-trigger.ts — central sync dispatcher.vault-history.test.tsVault history tests.vault.adversarial.test.tsvault.adversarial.test.ts — Layer 3 §3.1 adversarial vault tests.vault.test.tsvault.tsvault.ts — sole owner of vault state and chrome.storage vault keys.content/
passkey-toast/
crypto/
argon2.test.tsargon2.tscrypto.test.tspeachPayload.test.tspeachPayload.tspeachPayload.ts — binary payload format shared by PeachScript and the Peach QR matrix code (spec §2).peachScript.test.tspeachScript.tspeachScript.ts — PeachScript encoding/decoding.totp.tszstd.tsThin wrapper around @bokuweb/zstd-wasm that defers WASM load until the first compress/decompress call and memoises the init promise.
popup/
codex/
aztec.tsaztec.ts — Aztec 2D barcode generation with round-trip verification.browser-bundle.test.tscodex.adversarial.test.tscodex.adversarial.test.ts — Layer 3 §3.4 adversarial Codex tests.codex.suite.test.tscodex.suite.test.ts — cross-cutting regression suite for the Codex pipeline.codex.test.tsconfirmation.tsPick 3 distinct positions in [1, 12] for the recovery-words confirmation gate.erasure.tserasure.ts — Reed-Solomon erasure coding around the WASM library.generate.test.tsgenerate.tsgenerate.ts — full Codex generation pipeline.helpers.tshelpers.ts — shared utilities for Codex generation and restoration.node-wasm.tsNode-only WASM byte loader for Vitest.pdf-import.test.tspdf-import.test.ts — coverage for the testable surface of the PDF import path.pdf-import.tspdf-import.ts — restore from a Codex PDF instead of a camera scan.pdf-layout.tspdf-layout.ts — A4 Codex page geometry shared between the generator and the PDF importer.pdf.tspdf.ts — render the printable Codex PDF.reed-solomon.tsBrowser-safe wrapper around the Reed-Solomon WASM exports.restore.test.tsrestore.test.ts — coverage for ChunkBuffer, parseRawScan, reconstructAndVerify.restore.tsrestore.ts — Peach Codex restoration library (popup-side).rs-loader.tsrs-loader.ts — load the Reed-Solomon erasure WASM module.scanner.tsscanner.ts — camera-based Aztec scanning for Codex restoration.
components/
views/
Add.tsxChirpSync.tsxChirpSync — the v3 Settings → Sync surface.CodexGenerateView.test.tsx@vitest-environment jsdomCodexGenerateView.tsxPeach Codex — generation view.CodexRestoreView.tsxPeach Codex — restoration view.contracts.test.tsx@vitest-environment jsdomEntry.tsxExport.tsxSignal-conditioned views in this file must use <Show>, never a signal-conditioned early return (
if (signal()) return <X/>).Health.test.tsx@vitest-environment jsdomHealth.tsxImport.tsxSignal-conditioned views in this file must use <Show>, never a signal-conditioned early return — see Projects.md §4.1.Lock.tsxNoteEditor.toHtml.test.ts@vitest-environment jsdomNoteEditor.tsxNotesEditor.tsxNotesMode.tsxNotesTOC.tsxOnboarding.tsxPanic.tsxPasskeyApproval.tsxProCelebration.tsxRecoveryWordDisplay.tsxRecoveryWordEntry.tsxSettings.tsxTrashView.tsxVault.tsxview-test-utils.tsxshared/
backup.test.tsbackup.tsbridge.tsbrowser.test.tsbrowser.test.ts — locks down feature-detected browser identification.browser.tsbrowser.ts — feature-detected browser identifier shared by background, popup, and content scripts.chirp-handshake.test.tschirp-handshake.tsPost-chirp pairing handshake.chirp-pairing.test.tschirp-pairing.tsAudio pairing driver — orchestrates the two-chirp exchange that bootstraps trust between two devices in the same room.chirp-payload.test.tschirp-payload.tsAudio pairing payload — 64 bytes on the wire.chirp-sync-transport.test.tsSubnet-probe rate-limit tests.chirp-sync-transport.tsWebSocket sync transport — v3 chirp-sync Phase 2.codex-types.tscodex-types.ts — shared shapes for the Peach Codex.config.tsTemporary until Vesper (internal tracker) is readydevice-manifest.test.tsdevice-manifest.tsDevice manifest — v2 brief §4.3.domain.tsfavicon.test.tsfavicon.tsResolves a favicon URL for a given domain.generate.test.tsgenerate.tsggwave.test.tsggwave.tsggwave loader — thin async wrapper around the ggwave-wasm module.import.test.tsimport.ts
any is intentional throughout this module (L17/I3/QUA-010): import files are user-supplied external JSON whose schemas vary by source app and version (1Password CPG, Bitwarden, CXF, generic CSV).local-network.tsLocal network discovery — minimal helper used by chirp pairing.ml.tsnative.tsMobile platform detection helpers used by popup views to gate Capacitor-only paths.noise-js.test.tsNoise NK auth proof regression test.noise-js.tsNoise NK initiator for Android / Capacitor.noise-xx.test.tsnoise-xx.tsNoise XX (mutual auth) — used for every Phase-2 WebSocket connection after the audio chirp pairing has stamped each side into the other's paired-device registry.passkey-flags.tspasskey-flags.ts — single switch for the Firefox passkey content-script proxy.passkey-utils.test.tspasskey-utils.tspasskey-utils.ts — WebAuthn relying-party-id validation.recovery-word-list.tsrecovery-word-list.ts — 2048-word recovery word list for Peach vault recovery.recovery-words.tsrecovery-words.ts — BIP39-compatible recovery word encoding for Peach vault recovery.shortcuts.test.ts@vitest-environment jsdomshortcuts.tsshortcuts.ts — keybinding schema, defaults, matcher, formatter.storage.tssync-identity.test.tssync-identity.tsSync identity — long-term X25519 keypair tied to the vault, not the device installation.sync-types.tsChirp Sync — type definitions (Master Brief v2).types.tstypes.ts — cross-boundary types and the MessageType union.tests/
fixtures/
history
34ea8d9a31d0fix: harden storage access and cover message sender matrix (v5.0.20)1 month ago8da868d4f0e1fix: fail closed message authorization and recovery state (v5.0.19)1 month ago271b44b1633fdocs: record the 56-byte MAXDHLEN guard fix and the Android-found inertness bug in CONTINUITY (save 9346444bdaff, v5.0.17)1 month ago9346444bdafffix: small-order DH guard compares the leading 32 bytes of snow's 56-byte MAXDHLEN buffer — the strict try_from never fired on real handshakes (found by the Android parity test); regression test now drives all nine blocklist entries through the KK handshake plus a padded-buffer case, WASM rebuilt; bump 5.0.16→5.0.171 month ago282a941beb44docs: record the JS-side small-order mirror as resolved in CONTINUITY — DISCOVERIES follow-up closed, PROGRESS/OUTCOMES updated for save bc75d413d54d at v5.0.16 with green gates1 month agobc75d413d54dadd JS-side small-order X25519 blocklist mirroring the Rust crypto core (PB-26-014 follow-up) — isSmallOrderPubkey over the nine libhydrogen u-coordinates guards the KK/NK initiator remote static and both auth-proof DH boundaries in noise-js.ts before the DH runs, TDD regression tests cover all nine entries plus a real key, PCH-02-009 zero-point test updated for the earlier small-order rejection path; gates green (tsc, biome, vitest src/shared + src/background 2763 tests); bump 5.0.15→5.0.161 month ago65cde98607e5docs: record the PB-26 audit-fix campaign in CONTINUITY — all 15 findings and the hygiene register resolved at v5.0.15, full CI green including the new WASM provenance gate, Android small-order-blocklist parity and JS-side mirror recorded as follow-ups1 month ago518931773452fix: recovery words hide on window blur in both the recovery display and Codex generation views — words are cleared on visibilitychange-hidden (Codex requires the password step again) so an OS screenshot of a backgrounded popup never captures them; bump 5.0.14→5.0.151 month ago7c55294ece28chore: hygiene register — remove the dead form_detector.onnx binary (no consumer), map raw error echoes to fixed strings in Add/Lock/Import (PB-26-012 family), fix the stale kepr.build output path to the real build output; bump 5.0.13→5.0.141 month ago4ad8a009eebafix: reject small-order X25519 public keys in the Noise core DH (PB-26-014) — contributory-behaviour blocklist of the nine order-1/2/4/8 u-coordinates checked before every DH, Rust regression test fails a KK handshake against a small-order remote static, WASM rebuilt and committed (deny-only validation change: no wire format change, honest peers unaffected, no protocol version bump; Android parity recorded in CONTINUITY); bump 5.0.12→5.0.131 month ago893247f6b982fix: retire stale release credential paths (PB-26-013) — submit:firefox npm script removed (web-ext secrets were on the command line; release-firefox.ts already passes them via child env), setup-chrome-release.sh trashed (it persisted CWS secrets in plaintext to the shell profile), release.ts env-contract comments updated; bump 5.0.11→5.0.121 month ago3fedcd356231docs: correct the StoredVault.version comment — the field is not AAD (PB-26-012); the AES-GCM AAD is the constant slot aadTag, so no false downgrade-protection claim; bump 5.0.10→5.0.111 month ago7b5651a88e18fix: bound PeachScript decode at MAX_JSON_BYTES and enforce an http(s) URL scheme allow-list at the vault storage boundary (PB-26-011, PB-26-010) — javascript:/data: URLs dropped on add, restore, and patch; .peach file picks size-bounded before read; TDD regression tests; bump 5.0.9→5.0.101 month ago5cd09213d011fix: standalone notes editor pastes as plain text through the shared handleRichTextPaste guard (PB-26-009) — pasted rich HTML can no longer enter the extension-origin DOM live; guard extracted from the inline editor so both editors share one paste handler; bump 5.0.8→5.0.91 month ago2ee6e8b00769fix: card autofill applies the visibility gate and form-action check requires https on-domain-or-subdomain (PB-26-007, PB-26-008) — hidden card fields no longer filled, crafted forms on sibling registrable domains or plain http refused; TDD regression tests; bump 5.0.7→5.0.81 month agoa838d84d8945fix: fill/edit origin attestation uses the browser-attested frame url with tab url as fallback (PB-26-005) — all_frames content scripts validate against their own frame origin, not the top page; tests pin frame-url precedence in both directions; bump 5.0.6→5.0.71 month agoc9312ae6559efix: passkey allowCredentials match re-verifies the requesting rpId (PB-26-015) — a foreign-RP request listing a known credential id now passes through instead of selecting the credential, regression test; bump 5.0.5→5.0.61 month ago9b95e9847dfffix: mesh routing fails closed on absent or unknown trustSource (PB-26-006) — isRouteCapableMeshPeer no longer treats undefined as direct/vouched, regression tests cover missing and mystery trust values; bump 5.0.4→5.0.51 month ago73dccaa00b21fix: include crypto-core in the AMO source archive (PB-26-004) — both release scripts ship Cargo sources and the noise-core build script so reviewers can rebuild the WASM, excluding target and generated build output; archive contents verified; bump 5.0.3→5.0.41 month ago06ca6237835cfix: add Noise WASM provenance gate to CI (PB-26-003) — scripts/check-noise-core.mjs rebuilds the blob from crypto-core and fails on drift from the committed artifacts, wired into scripts/ci.ts after Tests; gate verified green with deterministic rebuild matching committed SHA; bump 5.0.2→5.0.31 month ago5b7714bd29ddfix: enforce MAX_FRAME_BYTES during sync-frame chunk reassembly (PB-26-002) — receive fails with SyncFrameTooLargeError as soon as the buffered continuation stream exceeds the bound, regression test drives 400 continuation chunks; bump 5.0.1→5.0.21 month agoaa05b62ef5a3fix: gate GET_CODEX_VAULT_DATA behind privileged-page check and fresh master-password re-auth (PB-26-001) — recoveryWords only returned with verifyMainPassword proof, popup asks for password on the words step, ESTIMATE_CODEX_PAGES privileged for symmetry, regression tests; bump 5.0.0→5.0.11 month agof14867aea6fffinal repo cleanup pass1 month ago0f8f63facf30docs: record v5 compatibility cutoff1 month ago63f03f2256dfrefactor: drop pre-live compatibility formats (v5.0.0)1 month ago68b85733a708docs: Record dist cleanup and compatibility retention1 month agoeb3bc24fb4ccchore: Remove orphan configs and dist mirror (v4.10.43)1 month ago92e94fdc3572docs: Record completed tombstone-ledger verification (v4.10.42)1 month agoaa22a0e2d0d0fix: Retain purged vault tombstones during sync (v4.10.42)1 month ago9784408d482ddocs: Record tombstone resurrection edge case (v4.10.41)1 month ago1e29815e2b55docs: Replace phantom contract manifest with concrete wire rules (v4.10.41)1 month agoa9c23cb82decdocs: Close the repository cleanup briefing (v4.10.41)1 month ago9c471c1968d6chore: Remove residual diagnostics and compatibility debris (v4.10.41)1 month agoc327200c1db0docs: Reconcile adoption design with relay-only architecture (v4.10.40)1 month agoc465530a0e11fix: Preserve NoteRow mouse input on touch devices (v4.10.40)1 month agoaff447a19549docs: Compact continuity into a current briefing (v4.10.39)1 month ago1d32bcd94040test: Restore clean test signal (v4.10.39)1 month ago90d2d69e8d21test: Retire false-green browser suites (v4.10.38)1 month ago29e0ff7cbd5dchore: Repair package ownership and remove stale AMO tooling (v4.10.37)1 month ago06609f3696a8refactor: Remove unreachable popup states and styles (v4.10.36)1 month agof284ee4f084drefactor: Remove unused runtime seams (v4.10.35)1 month ago703d47477a7brefactor: Remove retired pairing and LAN remnants (v4.10.34)1 month ago59d6ee714036bump to 4.10.33 and rebuild chrome and firefox dist at the new version1 month agob7b2d01ab243purge unreachable CSS rules, keyframes, and tokens from popup stylesheets1 month ago09cfac12e2f2bump to 4.10.31 and rebuild chrome and firefox dist at the new version1 month ago78a43519bc73delete unreferenced modules, exports, and the dead relay dial path1 month ago8de15d6aae62strip Capacitor native branches from popup, background, and shared code1 month agoa2d17dc903acremove mobile webview build, drafts, deepsec, and agent scratch dirs from the repo1 month ago55554d95b4beadd biome lint step to ci.ts (audit #12)2 months ago4b29cedfa68eneutralize leading ; in csvSafe (regional formula separator) (audit #11)2 months ago
details
Peach
A free, open source, local-first password manager for Chrome, Firefox, and Android.
Peach encrypts your vault on your device. No hosted vault, subscription, or account is required to use it.
Features
- Passwords, cards, and secure notes — keep your private data together in one encrypted vault
- Inline autofill — fill and save credentials without leaving the page
- TOTP built in — generate two-factor codes without a separate authenticator
- Password health — find weak, reused, and exposed passwords
- Portable backups — export and restore with PeachScript or a
.peachfile
Peach Pro adds:
- Peach Sync — end-to-end encrypted sync across paired devices
- Passkeys — save and use passkeys in Chrome and Firefox
- Peach Codex — print an encrypted, scannable backup of your vault
- Advanced vault health, Canary Entries, and duress tools
See the Peach website for current availability and Pro details.
Install
Open Source
Peach is released under the GPL v3. This repository contains Peach's Chrome and Firefox browser extensions. Android is maintained separately.
The source is hosted on Kepr, Asha Software's version control platform.
Security
Vault data is encrypted with AES-256-GCM and protected by Argon2id key derivation. Peach Sync authenticates paired devices and encrypts data in transit.
Implementation details live alongside the code:
Building
bun install --frozen-lockfile
bun run build
Builds are written to dist-chrome/ and dist-firefox/.
Built by Asha Software · [email protected]