peach-browser
A free, open source, local-first password manager for Chrome, Firefox, and Android.
TypeScript
timeline
atlas330 files
public/
codex/
fonts/
models/
scripts/
build-peachscript.pyBuild PeachScript-Regular.otf — 256 historical-runic glyphs.ci.tsclean-chrome-dist.mjsclean-firefox-artifacts.mjsgenerate-kat.mjsgenerate-kat.mjs — recompute the pinned ciphertext for self-test.ts (PCH-01-020).package-amo-source.shpackage-amo-source.sh — produce peach-3.6.65-source.zip for AMO review.release-firefox.tsrelease.tssetup-chrome-release.sh───────────────────────────────────────────────────────────────────────────── Peach — Chrome Web Store Release Setup Run this once to configure Chrome publishing.sync-chrome-dist.mjs
src/
background/
aes.test.tsaes.tsaes.ts — AES-256-GCM encrypt/decrypt primitives for vault storage.alarms.test.tsalarms.tschirp-identity.test.tschirp-identity.tsLocal-device identity helpers for the chirp-sync architecture.chirp-sync-coordinator.test.tschirp-sync-coordinator.tsChirp Sync — Phase 2 manifest-diff coordinator.chirp-sync-runner.test.tschirp-sync-runner.tsProduction sync runner — composes the live vault adapter, WebSocket transport, and coordinator into the function the dispatcher injects via
setSyncRunner.chirp-sync-static.test.tsIV.7 — Static safety assertions for Chirp Sync.chirp-sync-vault-adapter.test.tschirp-sync-vault-adapter.tsProduction adapter that backs runChirpSyncInitiator with the live vault.clipboard.test.tsclipboard.tsClipboard write + reliable auto-clear — audit fix HV-2.codex-handlers.test.tsTests for src/background/codex-handlers.ts.codex-handlers.tscodex-handlers.ts — message handlers that back the Peach Codex flow.commands.tsKeyboard command handler — routing for summon-inline: 1.entry.lock-port.test.tsLV-5: the lock-on-close onConnect listener accepts only our popup port (legacy bare "popup" or nonce'd "popup-<uuid>") and ignores anything else.entry.tshealth.test.tshealth.tshealth.ts — Pro advanced vault health analysis.license.tslicense.verification.test.tsT-009: License Ed25519 signature verificationmessages.adversarial.test.tsmessages.adversarial.test.ts — Layer 3 §3.3 adversarial message handler tests.messages.batch-sanitize.test.tsT-008: PCH-01-016 batch-add canary/tag sanitizationmessages.test.tsmessages.tsmessages.ts — the only background message handler.ml.tsnotes.test.tsoffscreen.htmloffscreen.tsOffscreen document script — audit fix HV-2c.paired-devices.test.tspaired-devices.tsPaired-device registry — v3 chirp-sync.passkey-chrome-ceremony.test.tspasskey-chrome-ceremony.test.ts — covers the Chrome chrome.webAuthenticationProxy ceremony path that the Firefox-proxy test file does NOT exercise.passkey-crypto.test.tspasskey-crypto.tspasskey-deny-on-close.test.tspasskey-deny-on-close.test.ts — M8/COR-009passkey-firefox-proxy.test.tspasskey-firefox-proxy.test.ts — covers the v2.12.0 Firefox content-script proxy path.passkey.tspending-vouched-devices.tsPending vouched devices — audit fix MV-7.recovery-pending.tsPersistent flag set while the user has just created a vault and is reading their 12 recovery words but has not yet typed the 3 confirmation words.recovery-words.test.tsrecovery.adversarial.test.tsrecovery.adversarial.test.ts — Layer 3 §3.2 adversarial recovery words tests.self-test.test.tsself-test.tsself-test.ts — Known-Answer Test (KAT) for the Peach crypto stack.sync-alerts.tsPending sync alerts — audit fix HV-1b.sync-trigger.test.tssync-trigger.tssync-trigger.ts — central sync dispatcher.vault-history.test.tsVault history tests.vault.adversarial.test.tsvault.adversarial.test.ts — Layer 3 §3.1 adversarial vault tests.vault.session-escrow.test.tsvault.sync-clamp.test.tsUnit tests for HV-1 — sync timestamp clamp + remote-mutation alerts.vault.test.tsvault.tsvault.ts — sole owner of vault state and chrome.storage vault keys.content/
passkey-toast/
crypto/
argon2.test.tsargon2.tscrypto.test.tsdecompression-bomb.test.tsMV-4: decompression-bomb output bounds on the zstd and pako legs.peachPayload.bomb.test.tsT-005: peachPayload declared-length decompression bomb (MV-4)peachPayload.test.tspeachPayload.tspeachPayload.ts — binary payload format shared by PeachScript and the Peach QR matrix code (spec §2).peachScript.test.tspeachScript.tspeachScript.ts — PeachScript encoding/decoding.totp.rfc6238.test.tsT-004: TOTP RFC 6238 known-answer vectorstotp.test.tstotp.tszstd.tsThin wrapper around @bokuweb/zstd-wasm that defers WASM load until the first compress/decompress call and memoises the init promise.
drafts/
TEST-EXPANSION/
argon2id.kat.test.tsT-019: Argon2id known-answer test (KAT) + parameter assertionbackup.nfc-fallback.test.tsT-006: backup/import NFC raw-fallback decrypt (LV-1 / PCH-01-001 sibling)chirp-transport.probe.test.tsT-010: PCH-01-018 subnet-probe identity-leak integrationclipboard.double-failure.test.tsT-037: clipboard double-failure / alreadyWritten pathcodex.multistripe.test.tsT-017: Codex multi-stripe round-tripcontent.orchestration.test.tsT-011 through T-014: index.ts autofill orchestrationgenerate.empty-pool.test.tsT-025: generate.ts empty-pool guard, 128-char boundary, minLength > maxLengthimport.csv.formulainjection.test.tsT-021: CSV formula-injection on import (round-trip)INTEGRATION-CONTRACT.mdGenerated by session:
test coverage expansion Agent: claude-sonnet-4-6 Priority 1: T-001–T-010 (10 files), Priority 2: T-011–T-024 (11 files, T-011–T-014 in one file), Priority 3: T-025, T-030, T-037 (3 files)license.verification.test.tsT-009: License Ed25519 signature verificationmessages.batch-sanitize.test.tsT-008: PCH-01-016 batch-add canary/tag sanitizationmessages.edit-origin.test.tsT-022: GET_ENTRY_FOR_EDIT via sender.url + locked-vault AUTOFILL_QUERYml.predictbatch.test.tsT-030: ml.ts predictBatch — batch sizes, softmax stability with extreme weightspasskey.ed25519.test.tsT-015: Ed25519 passkey round-trippdf-import.sandbox.test.tsT-007: MV-9 pdf.js sandbox flags regression testpeachPayload.bomb.test.tsT-005: peachPayload declared-length decompression bomb (MV-4)recovery-words.checksum.test.tsT-002: BIP39 checksum rejectionrecovery-words.integrity.test.tsT-001: BIP39 word-list integrityrecovery-words.kek.test.tsT-003: 128-bit prefix-KEK invariant (PCH-01-005 sibling)sync.disconnect.test.tsT-020: WebSocket sync-disconnect handling (PCH-01-026 #9)totp.rfc6238.test.tsT-004: TOTP RFC 6238 known-answer vectorsvault.consolidate-passkeys.test.tsT-023: vault.consolidatePasskeyEntries — passkey merge with lastUsed rankingvault.corruption.test.tsT-018: Vault corruption vs wrong-password discrimination (M7/COR-007)vault.purge-trash.test.tsT-024: vault.purgeExpiredTrash — retention cutoff boundaryvault.rotate-sync-identity.test.tsT-016: rotateSyncIdentity — new root key, cleared peers, recovery pendingpopup/
codex/
aztec.tsaztec.ts — Aztec 2D barcode generation with round-trip verification.browser-bundle.test.tscodex.adversarial.test.tscodex.adversarial.test.ts — Layer 3 §3.4 adversarial Codex tests.codex.suite.test.tscodex.suite.test.ts — cross-cutting regression suite for the Codex pipeline.codex.test.tsconfirmation.tsPick 3 distinct positions in [1, 12] for the recovery-words confirmation gate.erasure.tserasure.ts — Reed-Solomon erasure coding around the WASM library.generate.test.tsgenerate.tsgenerate.ts — full Codex generation pipeline.helpers.tshelpers.ts — shared utilities for Codex generation and restoration.node-wasm.tsNode-only WASM byte loader for Vitest.pdf-import.clamp.test.tspdf-import.sandbox.test.tsT-007: MV-9 pdf.js sandbox flags regression testpdf-import.test.tspdf-import.test.ts — coverage for the testable surface of the PDF import path.pdf-import.tspdf-import.ts — restore from a Codex PDF instead of a camera scan.pdf-layout.tspdf-layout.ts — A4 Codex page geometry shared between the generator and the PDF importer.pdf.tspdf.ts — render the printable Codex PDF.reed-solomon.tsBrowser-safe wrapper around the Reed-Solomon WASM exports.restore.test.tsrestore.test.ts — coverage for ChunkBuffer, parseRawScan, reconstructAndVerify.restore.tsrestore.ts — Peach Codex restoration library (popup-side).rs-loader.tsrs-loader.ts — load the Reed-Solomon erasure WASM module.scanner.tsscanner.ts — camera-based Aztec scanning for Codex restoration.
components/
views/
Add.tsxChirpSync.tsxChirpSync — the v3 Settings → Sync surface.CodexGenerateView.test.tsx@vitest-environment jsdomCodexGenerateView.tsxPeach Codex — generation view.CodexRestoreView.test.tsx@vitest-environment jsdomCodexRestoreView.tsxPeach Codex — restoration view.contracts.test.tsx@vitest-environment jsdomEntry.tsxExport.csv.test.ts@vitest-environment jsdomExport.tsxSignal-conditioned views in this file must use <Show>, never a signal-conditioned early return (
if (signal()) return <X/>).Health.test.tsx@vitest-environment jsdomHealth.tsxImport.tsxSignal-conditioned views in this file must use <Show>, never a signal-conditioned early return — see Projects.md §4.1.Lock.tsxNoteEditor.toHtml.test.ts@vitest-environment jsdomNoteEditor.tsxNotesEditor.tsxNotesMode.tsxNotesTOC.tsxOnboarding.tsxPanic.tsxPasskeyApproval.tsxProCelebration.tsxRecoveryWordDisplay.tsxRecoveryWordEntry.tsxSettings.tsxTrashView.tsxvault-search.test.tsvault-search.tsVault.tsxview-test-utils.tsxzxcvbn-strength.test.tsLV-8: the @zxcvbn-ts replacement must score the master-password strength meter on the same 0-4 scale as the old zxcvbn, with dictionaries loaded (language-common is what keeps weak passwords from scoring optimistically).shared/
backup.nfc-fallback.test.tsT-006: backup/import NFC raw-fallback decrypt (LV-1 / PCH-01-001 sibling)backup.test.tsbackup.tsbridge.tsbrowser.test.tsbrowser.test.ts — locks down feature-detected browser identification.browser.tsbrowser.ts — feature-detected browser identifier shared by background, popup, and content scripts.chirp-handshake.test.tschirp-handshake.tsPost-chirp pairing handshake.chirp-pairing.test.tschirp-pairing.tsAudio pairing driver — orchestrates the two-chirp exchange that bootstraps trust between two devices in the same room.chirp-payload.test.tschirp-payload.tsAudio pairing payload — 64 bytes on the wire.chirp-sync-transport.test.tsSubnet-probe rate-limit tests.chirp-sync-transport.tsWebSocket sync transport — v3 chirp-sync Phase 2.chirp-transport.probe.test.tsT-010: PCH-01-018 subnet-probe identity-leak integrationcodex-types.tscodex-types.ts — shared shapes for the Peach Codex.config.tsWeb3Forms access key for the in-app feedback form (Settings → feedback).device-manifest.test.tsdevice-manifest.tsDevice manifest — v2 brief §4.3.domain.homograph.test.tsLV-2: homograph detector tests.domain.tsfavicon.test.tsfavicon.tsResolves a favicon URL for a given domain.generate.test.tsgenerate.tsggwave.test.tsggwave.tsggwave loader — thin async wrapper around the ggwave-wasm module.import-limits.tsImport-path resource bounds — audit fixes MV-4 (decompression bomb) and MV-5 (unbounded file/string allocation).import.test.tsimport.ts
any is intentional throughout this module (L17/I3/QUA-010): import files are user-supplied external JSON whose schemas vary by source app and version (1Password CPG, Bitwarden, CXF, generic CSV).local-network.tsLocal network discovery — minimal helper used by chirp pairing.ml.tsnative.tsMobile platform detection helpers used by popup views to gate Capacitor-only paths.noise-blake2s-kat.test.tsnoise-js.test.tsNoise NK auth proof regression test.noise-js.tsNoise NK initiator for Android / Capacitor.noise-xx.test.tsnoise-xx.tsNoise XX (mutual auth) — used for every Phase-2 WebSocket connection after the audio chirp pairing has stamped each side into the other's paired-device registry.passkey-flags.tspasskey-flags.ts — single switch for the Firefox passkey content-script proxy.passkey-utils.test.tspasskey-utils.tspasskey-utils.ts — WebAuthn relying-party-id validation.recovery-word-list.tsrecovery-word-list.ts — 2048-word recovery word list for Peach vault recovery.recovery-words.checksum.test.tsT-002: BIP39 checksum rejectionrecovery-words.integrity.test.tsT-001: BIP39 word-list integrityrecovery-words.kek.test.tsT-003: 128-bit prefix-KEK invariant (PCH-01-005 sibling)recovery-words.tsrecovery-words.ts — BIP39-compatible recovery word encoding for Peach vault recovery.shortcuts.test.ts@vitest-environment jsdomshortcuts.tsshortcuts.ts — keybinding schema, defaults, matcher, formatter.storage.tssync-identity.test.tssync-identity.tsSync identity — long-term X25519 keypair tied to the vault, not the device installation.sync-limits.tsSync trust + resource bounds — audit fixes HV-1 (timestamp clamp) and MV-3 (receive-path size bounds).sync-types.tsChirp Sync — type definitions (Master Brief v2).types.tstypes.ts — cross-boundary types and the MessageType union.tests/
fixtures/
7100d7d25214 (v3.9.8) Method: Full read of src/ (130 source modules, 43,826 LOC) cross-referenced against the test suite (109 test files).tsconfig.background.jsontsconfig.jsontsconfig.tests.jsonvite.config.mobile.tsvite.config.tsvitest.config.tshistory
4af33f75244frecord v5.3.12 release to Chrome review and public AMO2 weeks agob11d632a0a16record confirmed Firefox site-access root cause and passkey sign-in success2 weeks ago7bae6a15aa4cprompt for withheld all-sites access so Firefox injects content scripts without a popup click (v5.3.12)2 weeks agod9428e0ddd2dretain Firefox passkey requests through background delivery failures (v5.3.11)2 weeks ago8254614ba3a7shorten pairing confirmation while preserving vault-access consent (v5.3.10)2 weeks agoa9f8cf99d108preserve Chrome opt-in while defaulting Firefox interception on (v5.3.9)2 weeks ago52a1b1bfa47fenable passkey interception by default with saved opt-out (v5.3.8)2 weeks ago2627a8b30c10finish Firefox passkey ceremonies before popup close (v5.3.7)2 weeks agoe013c493c758wait for Peach unlock before Firefox passkey sign-in (v5.3.6)2 weeks agoa22c047efc1apreserve Firefox conditional passkey request timing (v5.3.5)2 weeks ago69251a167183preserve page-realm WebAuthn bytes and credential results in Firefox (v5.3.4)2 weeks ago070c26097d42preserve Chrome passkey registration flags in Firefox assertions (v5.3.3)2 weeks agoa1cd10fe1734remove obsolete Koh binary build configuration2 weeks ago055f13757fd8record in-extension Pro nudge verification in continuity3 weeks ago96284c293604list all six Pro features in the nudge from a catalog shared with Settings (v5.3.2)3 weeks ago5157b6df8f7dfit Pro nudge inside the 520px popup so dismiss options stay visible (v5.3.1)3 weeks ago9e3dd1d2e969record Pro nudge schedule and verification in continuity3 weeks ago191e3b1947edadd occasional Peach Pro nudge with 90-day snooze and never-again (v5.3.0)3 weeks agoa27dae22457cremove stale .omo evidence logs3 weeks agob6c6f5f5f2fdmigrate: rename kepr.build to koh.build4 weeks agob2bebaef0eddrecord Browser v5.2.62 store submissions1 month ago39fbcdba0010publish inbound Sync completion and wait for delayed peers (v5.2.62)1 month agof8b6e6a82945close vulnerable dependency graph and record audit closure (v5.2.61)1 month ago900ec1e6d886preverify device manifest budgets before canonicalization (v5.2.60)1 month ago7f2cc11320efmake Codex PDF recovery hermetic with a 250-entry multi-type vault (v5.2.59)1 month agocc664d67df06record final release assurance evidence and residual limitations (v5.2.58)1 month agod5fc7a2595b1remove fixed cross-client harness delay and bound cleanup (v5.2.58)1 month agodbbd97c413bdupgrade Vite Vitest jsdom and web-ext advisory clusters (v5.2.58)1 month agoa1fb64adbf3dbox Noise handshake state to satisfy strict Clippy (crypto-core v1.0.2, Browser v5.2.57)1 month ago6a6f14084909restore deterministic Chromium release assurance (v5.2.57)1 month ago69320fbe5c70preserve pending recovery confirmation across ordinary lock (v5.2.57)1 month ago71c03512622eplan ordered CI and test assurance remediation1 month agod02401fe200arefresh open popup after remote sync merges (v5.2.56)1 month ago19c8b3dce8efpublish complete independent audit PDF and evidence package for Browser 5.2.551 month agoc67f9103ca9afix signed revocation identifier bounds and release Browser 5.2.551 month ago53d1a99ff53fpublish independent audit PDF and evidence package for Browser 5.2.541 month ago990a9167e5c5save locked Sync toggle alignment at Browser 5.2.541 month agod4f846268212align locked Sync Protection control with toggle rows at Browser 5.2.541 month agoaa22799926eaadd configurable locked Sync key custody at Browser 5.2.531 month agobc40f634fb77resolve PB-26-930 through PB-26-934 at Browser 5.2.521 month ago6aa6595bc1depublish independent audit PDF and evidence package for Browser 5.2.511 month ago371dbc476bcbclose PB-26-925 and PB-26-927 through PB-26-929 at Browser 5.2.51; record PB-26-926 Android gate blocker1 month agobea130facd46publish independent audit PDF and evidence package for Browser 5.2.501 month agof38052979d35polish Sync layout and migration notices (v5.2.50)1 month ago8e6d7effbebehide the secure reset panel once the device is on the settled generation (v5.2.50)1 month agob1c0079c5bffverify the reset archive by field, not serialized text (v5.2.50)1 month ago2f80eea29ae0make Sync identity cache best effort during reset (v5.2.49)1 month agoa7728642a731complete locked-vault Sync reset flow (v5.2.48)1 month ago9aec7adfb69cfix peer revoke and reset identity migration failures (v5.2.47)1 month agob8afc9544b71scope Entry keyboard shortcuts to the active entry view1 month ago
details
Peach
A free, open source, local-first password manager for Chrome, Firefox, and Android.
Peach encrypts your vault on your device. No hosted vault, subscription, or account is required to use it.
Features
- Passwords, cards, and secure notes — keep your private data together in one encrypted vault
- Inline autofill — fill and save credentials without leaving the page
- TOTP built in — generate two-factor codes without a separate authenticator
- Password health — find weak, reused, and exposed passwords
- Portable backups — export and restore with PeachScript or a
.peachfile
Peach Pro adds:
- Peach Sync — end-to-end encrypted sync across paired devices
- Passkeys — save and use passkeys in Chrome and Firefox
- Peach Codex — print an encrypted, scannable backup of your vault
- Advanced vault health, Canary Entries, and duress tools
See the Peach website for current availability and Pro details.
Install
Open Source
Peach is released under the GPL v3. This repository contains Peach's Chrome and Firefox browser extensions. Android is maintained separately.
The source is hosted on Kepr, Asha Software's version control platform.
Security
Vault data is encrypted with AES-256-GCM and protected by Argon2id key derivation. Peach Sync authenticates paired devices and encrypts data in transit.
Implementation details live alongside the code:
Building
bun install --frozen-lockfile
bun run build
Builds are written to dist-chrome/ and dist-firefox/.
Built by Asha Software · [email protected]