peach-browser
A free, open source, local-first password manager for Chrome, Firefox, and Android.
TypeScript
timeline
atlas546 files
.deepsec/This directory holds the deepsec config for the parent repo.
data/
peach-browser/
files/
src/
background/
aes.ts.jsonchirp-identity.ts.jsonchirp-sync-coordinator.ts.jsonchirp-sync-vault-adapter.ts.jsonclipboard.ts.jsoncodex-handlers.ts.jsondesktop-pairing-bg.ts.jsondesktop-pairing-mdns.ts.jsondesktop-pairing-probe.ts.jsondesktop-pairing.ts.jsonhealth.ts.jsonlicense.ts.jsonmessages.ts.jsonoffscreen.ts.jsonpasskey-crypto.ts.jsonpasskey.ts.jsonrecovery-pending.ts.jsonself-test.ts.jsonsync-alerts.ts.jsonsync-trigger.ts.jsonvault.ts.json
content/
popup/
codex/
components/
views/
Add.tsx.jsonAdoptVaultView.tsx.jsonChirpSync.tsx.jsonCodexGenerateView.tsx.jsonCodexRestoreView.tsx.jsonEntry.tsx.jsonExport.tsx.jsonHealth.tsx.jsonImport.tsx.jsonLock.tsx.jsonNoteEditor.tsx.jsonNotesEditor.tsx.jsonNotesMode.tsx.jsonNotesTOC.tsx.jsonOnboarding.tsx.jsonPanic.tsx.jsonRecoveryWordDisplay.tsx.jsonSettings.tsx.jsonvault-search.ts.jsonVault.tsx.json
shared/
backup.ts.jsonchirp-adopt.ts.jsonchirp-handshake.ts.jsonchirp-pairing.ts.jsonchirp-payload.ts.jsonchirp-sync-transport.ts.jsoncodex-types.ts.jsonconfig.ts.jsondevice-manifest.ts.jsondomain.ts.jsongenerate.ts.jsonimport.ts.jsonlocal-network.ts.jsonnative.ts.jsonnoise-js.ts.jsonpasskey-utils.ts.jsonrecovery-word-list.ts.jsonrecovery-words.ts.jsonshortcuts.ts.jsonsync-identity.ts.jsonsync-types.ts.jsontypes.ts.json
runs/
crypto-core/
public/
codex/
fonts/
models/
scripts/
build-noise-core.mjsbuild-peachscript.pyBuild PeachScript-Regular.otf — 256 historical-runic glyphs.check-sw-static-imports.mjsFails the build if any chunk reachable from the MV3 service worker still contains a runtime
import().ci.tsclean-chrome-dist.mjsclean-firefox-artifacts.mjsgenerate-kat.mjsgenerate-kat.mjs — recompute the pinned ciphertext for self-test.ts (PCH-01-020).package-amo-source.shpackage-amo-source.sh — produce peach-3.6.65-source.zip for AMO review.release-firefox.tsrelease.tssetup-chrome-release.sh───────────────────────────────────────────────────────────────────────────── Peach — Chrome Web Store Release Setup Run this once to configure Chrome publishing.sync-chrome-dist.mjssrc/
background/
aes.test.tsaes.tsaes.ts — AES-256-GCM encrypt/decrypt primitives for vault storage.alarms.test.tsalarms.tsclipboard.double-failure.test.tsT-037: clipboard double-failure / alreadyWritten pathclipboard.test.tsclipboard.tsClipboard write + reliable auto-clear — audit fix HV-2.codex-handlers.test.tsTests for src/background/codex-handlers.ts.codex-handlers.tscodex-handlers.ts — message handlers that back the Peach Codex flow.commands.tsKeyboard command handler — routing for summon-inline: 1.device-identity.test.tsdevice-identity.tsLocal-device identity helpers for the sync architecture.entry.lock-port.test.tsLV-5: the lock-on-close onConnect listener accepts only our popup port (legacy bare "popup" or nonce'd "popup-<uuid>") and ignores anything else.entry.tshealth.test.tshealth.tshealth.ts — Pro advanced vault health analysis.license.tslicense.verification.test.tsT-009: License Ed25519 signature verificationlocked-sync-spool.test.tslocked-sync-spool.tsmesh-relay-listener.test.tsmesh-relay-listener.tsmessages.adversarial.test.tsmessages.adversarial.test.ts — Layer 3 §3.3 adversarial message handler tests.messages.batch-sanitize.test.tsT-008: PCH-01-016 batch-add canary/tag sanitizationmessages.create-vault-from-root-key.test.tsmessages.edit-origin.test.tsT-022: GET_ENTRY_FOR_EDIT via sender.url + locked-vault AUTOFILL_QUERYmessages.test.tsmessages.tsmessages.ts — the only background message handler.ml.predictbatch.test.tsT-030: ml.ts predictBatch — batch sizes, softmax stability with extreme weightsml.tsnotes.test.tsoffscreen.htmloffscreen.tsOffscreen document script — audit fix HV-2c.paired-devices.test.tspaired-devices.tsPaired-device registry — v3 sync.passkey-chrome-ceremony.test.tspasskey-chrome-ceremony.test.ts — covers the Chrome chrome.webAuthenticationProxy ceremony path that the Firefox-proxy test file does NOT exercise.passkey-crypto.test.tspasskey-crypto.tspasskey-deny-on-close.test.tspasskey-deny-on-close.test.ts — M8/COR-009passkey-firefox-proxy.test.tspasskey-firefox-proxy.test.ts — covers the v2.12.0 Firefox content-script proxy path.passkey.ed25519.test.tsT-015: Ed25519 passkey round-trippasskey.tspending-vouched-devices.test.tspending-vouched-devices.tsPending vouched devices — audit fix MV-7.recovery-pending.tsPersistent flag set while the user has just created a vault and is reading their 12 recovery words but has not yet typed the 3 confirmation words.recovery-words.test.tsrecovery.adversarial.test.tsrecovery.adversarial.test.ts — Layer 3 §3.2 adversarial recovery words tests.relay-adoption-bg.test.tsrelay-adoption-bg.tsself-test.test.tsself-test.tsself-test.ts — Known-Answer Test (KAT) for the Peach crypto stack.sync-alarm.test.tssync-alarm.tssync-alarm.ts — the 10-minute background sync tick.sync-alerts.test.tssync-alerts.tsPending sync security alerts.sync-coordinator.test.tssync-coordinator.tsVault sync — Phase 2 manifest-diff coordinator.sync-runner.test.tssync-runner.tsProduction sync runner — composes the live vault adapter, WebSocket transport, and coordinator into the function the dispatcher injects via
setSyncRunner.sync-settings.test.tssync-settings.tssync-static.test.tsIV.7 — Static safety assertions for vault sync.sync-trigger.test.tssync-trigger.tssync-trigger.ts — central sync dispatcher.sync-vault-adapter.test.tssync-vault-adapter.tsProduction adapter that backs runSyncInitiator with the live vault.vault-createVaultFromRootKey.test.tsvault-history.test.tsVault history tests.vault.adversarial.test.tsvault.adversarial.test.ts — Layer 3 §3.1 adversarial vault tests.vault.consolidate-passkeys.test.tsT-023: vault.consolidatePasskeyEntries — passkey merge with lastUsed rankingvault.corruption.test.tsT-018: Vault corruption vs wrong-password discrimination (M7/COR-007)vault.duress-adoption.test.tsvault.hibp-padding.test.tsPCH-02-007 regression tests — the HIBP k-anonymity range request must ask for response padding, and the parser must stay correct on padded responses.vault.purge-trash.test.tsT-024: vault.purgeExpiredTrash — retention cutoff boundaryvault.rotate-sync-identity.test.tsT-016: rotateSyncIdentity — new root key, cleared peers, recovery pendingvault.session-escrow.test.tsvault.sync-clamp.test.tsUnit tests for HV-1 — sync timestamp clamp + remote-mutation alerts.vault.test.tsvault.tsvault.ts — sole owner of vault state and chrome.storage vault keys.vault.update-entry-sanitize.test.tsPCH-02-001 regression tests — UPDATE_ENTRY patch path must route canary/tags/passkey through the same sanitizers the add/restore/sync funnels use (sanitizeCanary / sanitizePasskey / sanitizeTags).content/
passkey-toast/
crypto/
argon2.test.tsargon2.tsargon2id.kat.test.tsT-019: Argon2id known-answer test (KAT) + parameter assertioncrypto.test.tsdecompression-bomb.test.tsMV-4: decompression-bomb output bounds on the zstd and pako legs.official-vectors.test.tspeachPayload.binaryreader-bounds.test.tsPCH-02-008 regression tests — BinaryReader must bound every read and fail with the decoder's existing PAYLOAD_TOO_SHORT code on truncated input.peachPayload.bomb.test.tsT-005: peachPayload declared-length decompression bomb (MV-4)peachPayload.test.tspeachPayload.tspeachPayload.ts — binary payload format shared by PeachScript and the Peach QR matrix code (spec §2).peachScript.test.tspeachScript.tspeachScript.ts — PeachScript encoding/decoding.totp.rfc6238.test.tsT-004: TOTP RFC 6238 known-answer vectorstotp.test.tstotp.tszstd.tsThin wrapper around @bokuweb/zstd-wasm that defers WASM load until the first compress/decompress call and memoises the init promise.
drafts/
PCH-02-FIXES/Drafts for all 10 findings of peach-code-review.md (Fable 5, 2026-06-12): 1 Low (PCH-02-001), 9 Informational.
clipboard.hash-match.test.tsPCH-02-010 regression tests (Option B only) — the auto-clear must compare the live clipboard hash (computed inside the offscreen document) against the parked SHA-256 before wiping, and must stay conservative when the comparison is unavailable.INTEGRATION-CONTRACT.mdSource of truth for integrating these drafts.PCH-02-001-vault-patch-sanitizers.patch.mdSeverity: Low (the only non-Informational finding in PCH-02) Target file:
src/background/vault.ts — sanitizeEntryPatch, lines 2375–2388 Report: peach-code-review.md, Finding PCH-02-001PCH-02-003-sas-trust-model-comment.patch.mdSeverity: Informational Target file: src/shared/chirp-handshake.ts:125-154 (the SECURITY block) Report: peach-code-review.md, Finding PCH-02-003PCH-02-004-exact-pin-deps.patch.mdSeverity: Informational Target files: package.json:40-46, bun.lock (regenerated), new WASM-PROVENANCE.md (see deviation note) Report: peach-code-review.md, Finding PCH-02-004PCH-02-005-legacy-pbkdf2-doc.patch.mdSeverity: Informational Target files: src/shared/backup.ts:146 (derivePeachExportKey), src/popup/views/Import.tsx (re-export notice) Report: peach-code-review.md, Finding PCH-02-005PCH-02-007-hibp-add-padding.patch.mdSeverity: Informational Target file: src/background/vault.ts:230 (checkBreach) Report: peach-code-review.md, Finding PCH-02-007PCH-02-008-binaryreader-bounds.patch.mdSeverity: Informational Target file: src/crypto/peachPayload.ts:940-969 (BinaryReader) Report: peach-code-review.md, Finding PCH-02-008PCH-02-010-clipboard-hash-match.patch.mdSeverity: Informational Target files: src/background/clipboard.ts:124-178 (clearClipboardNow), src/background/offscreen.ts, manifest.json (⚠ permission), comment in clipboard.ts:18-19 Report: peach-code-review.md, Finding PCH-02-010peachPayload.binaryreader-bounds.test.tsPCH-02-008 regression tests — BinaryReader must bound every read and fail with the decoder's existing PAYLOAD_TOO_SHORT code on truncated input.README.mdDrafts for all 10 findings of peach-code-review.md (Fable 5, 2026-06-12): 1 Low (PCH-02-001), 9 Informational.vault.hibp-padding.test.tsPCH-02-007 regression tests — the HIBP k-anonymity range request must ask for response padding, and the parser must stay correct on padded responses.vault.update-entry-sanitize.test.tsPCH-02-001 regression tests — UPDATE_ENTRY patch path must route canary/tags/passkey through the same sanitizers the add/restore/sync funnels use (sanitizeCanary / sanitizePasskey / sanitizeTags).WASM-PROVENANCE.mdPeach's vault security rests on a small set of third-party packages that either ship WebAssembly blobs or sit directly on a security path.TEST-EXPANSION/
argon2id.kat.test.tsT-019: Argon2id known-answer test (KAT) + parameter assertionbackup.nfc-fallback.test.tsT-006: backup/import NFC raw-fallback decrypt (LV-1 / PCH-01-001 sibling)clipboard.double-failure.test.tsT-037: clipboard double-failure / alreadyWritten pathcodex.multistripe.test.tsT-017: Codex multi-stripe round-tripcontent.orchestration.test.tsT-011 through T-014: index.ts autofill orchestrationgenerate.empty-pool.test.tsT-025: generate.ts empty-pool guard, 128-char boundary, minLength > maxLengthimport.csv.formulainjection.test.tsT-021: CSV formula-injection on import (round-trip)INTEGRATION-CONTRACT.mdGenerated by session:
test coverage expansion Agent: claude-sonnet-4-6 Priority 1: T-001–T-010 (10 files), Priority 2: T-011–T-024 (11 files, T-011–T-014 in one file), Priority 3: T-025, T-030, T-037 (3 files)license.verification.test.tsT-009: License Ed25519 signature verificationmessages.batch-sanitize.test.tsT-008: PCH-01-016 batch-add canary/tag sanitizationmessages.edit-origin.test.tsT-022: GET_ENTRY_FOR_EDIT via sender.url + locked-vault AUTOFILL_QUERYml.predictbatch.test.tsT-030: ml.ts predictBatch — batch sizes, softmax stability with extreme weightspasskey.ed25519.test.tsT-015: Ed25519 passkey round-trippdf-import.sandbox.test.tsT-007: MV-9 pdf.js sandbox flags regression testpeachPayload.bomb.test.tsT-005: peachPayload declared-length decompression bomb (MV-4)recovery-words.checksum.test.tsT-002: BIP39 checksum rejectionrecovery-words.integrity.test.tsT-001: BIP39 word-list integrityrecovery-words.kek.test.tsT-003: 128-bit prefix-KEK invariant (PCH-01-005 sibling)sync.disconnect.test.tsT-020: WebSocket sync-disconnect handling (PCH-01-026 #9)totp.rfc6238.test.tsT-004: TOTP RFC 6238 known-answer vectorsvault.consolidate-passkeys.test.tsT-023: vault.consolidatePasskeyEntries — passkey merge with lastUsed rankingvault.corruption.test.tsT-018: Vault corruption vs wrong-password discrimination (M7/COR-007)vault.purge-trash.test.tsT-024: vault.purgeExpiredTrash — retention cutoff boundaryvault.rotate-sync-identity.test.tsT-016: rotateSyncIdentity — new root key, cleared peers, recovery pendingmobile/
popup/
codex/
aztec.tsaztec.ts — Aztec 2D barcode generation with round-trip verification.browser-bundle.test.tscodex.adversarial.test.tscodex.adversarial.test.ts — Layer 3 §3.4 adversarial Codex tests.codex.multistripe.test.tsT-017: Codex multi-stripe round-tripcodex.suite.test.tscodex.suite.test.ts — cross-cutting regression suite for the Codex pipeline.codex.test.tsconfirmation.tsPick 3 distinct positions in [1, 12] for the recovery-words confirmation gate.erasure.tserasure.ts — Reed-Solomon erasure coding around the WASM library.generate.test.tsgenerate.tsgenerate.ts — full Codex generation pipeline.helpers.tshelpers.ts — shared utilities for Codex generation and restoration.node-wasm.tsNode-only WASM byte loader for Vitest.pdf-import.clamp.test.tspdf-import.sandbox.test.tsT-007: MV-9 pdf.js sandbox flags regression testpdf-import.test.tspdf-import.test.ts — coverage for the testable surface of the PDF import path.pdf-import.tspdf-import.ts — restore from a Codex PDF instead of a camera scan.pdf-layout.tspdf-layout.ts — A4 Codex page geometry shared between the generator and the PDF importer.pdf.tspdf.ts — render the printable Codex PDF.reed-solomon.tsBrowser-safe wrapper around the Reed-Solomon WASM exports.restore.test.tsrestore.test.ts — coverage for ChunkBuffer, parseRawScan, reconstructAndVerify.restore.tsrestore.ts — Peach Codex restoration library (popup-side).rs-loader.tsrs-loader.ts — load the Reed-Solomon erasure WASM module.scanner.tsscanner.ts — camera-based Aztec scanning for Codex restoration.
components/
GeneratorDrawer.test.tsGeneratorDrawer.tsxLockRuneCanvas.tsxNoteRow.tsxNoteRunes.tsxNoteToolbar.tsxPairingBirds.tsxPairing birds — the two illustrated characters used on the pairing screens.PairingProRequired.tsxPairingQrCode.tsxPeachMark.tsxRecoveryRuneBackground.tsxRuneBackground.tsxRuneCanvas.tsxSyncModeSelector.test.tsx@vitest-environment jsdomSyncModeSelector.tsxSyncModeSelector — the one place the relay choice is made.
views/
Add.tsxAdoptVaultView.test.tsx@vitest-environment jsdomAdoptVaultView.tsxCodexGenerateView.test.tsx@vitest-environment jsdomCodexGenerateView.tsxPeach Codex — generation view.CodexRestoreView.test.tsx@vitest-environment jsdomCodexRestoreView.tsxPeach Codex — restoration view.contracts.test.tsx@vitest-environment jsdomEntry.tsxExport.csv.test.ts@vitest-environment jsdomExport.tsxSignal-conditioned views in this file must use <Show>, never a signal-conditioned early return (
if (signal()) return <X/>).Health.test.tsx@vitest-environment jsdomHealth.tsxImport.tsxSignal-conditioned views in this file must use <Show>, never a signal-conditioned early return — see Projects.md §4.1.InitialSyncView.test.tsx@vitest-environment jsdomInitialSyncView.tsxLock.tsxNoteEditor.toHtml.test.ts@vitest-environment jsdomNoteEditor.tsxNotesEditor.tsxNotesMode.tsxNotesTOC.tsxOnboarding.tsxPairDevice.test.tsx@vitest-environment jsdomPairDevice.tsxPairDevice — the pairing surface, opened from the Settings → Sync card.Panic.tsxPasskeyApproval.tsxProCelebration.tsxRecoveryWordDisplay.tsxRecoveryWordEntry.tsxSettings.tsxTrashView.tsxvault-search.test.tsvault-search.tsVault.tsxview-test-utils.tsxzxcvbn-strength.test.tsLV-8: the @zxcvbn-ts replacement must score the master-password strength meter on the same 0-4 scale as the old zxcvbn, with dictionaries loaded (language-common is what keeps weak passwords from scoring optimistically).shared/
noise-core-wasm/
any is intentional throughout this module (L17/I3/QUA-010): import files are user-supplied external JSON whose schemas vary by source app and version (1Password CPG, Bitwarden, CXF, generic CSV).initial-sync.test.tsinitial-sync.tsmesh-peer-role.tsml.tsnative.tsMobile platform detection helpers used by popup views to gate Capacitor-only paths.noise-blake2s-kat.test.tsnoise-core.tsnoise-js.test.tsNoise NK auth proof regression test.noise-js.tsNoise NK initiator for Android / Capacitor.noise-kk.test.tsnoise.reject-zero-dh.test.tsPCH-02-009 regression tests — every Noise NK DH must reject an all-zero shared secret (low-order / identity peer point) instead of feeding it into the key schedule.pairing-dial.tsThe dialling half of code pairing — shared by device pairing and vault adoption.pairing-handshake.test.tspairing-handshake.tsPairing handshake — Noise NK, the SAS, and the PAIR_IDENTITY frame.pairing-handshake.vault-id.test.tsChange 1 — vault_id in the PAIR_IDENTITY frame.pairing-invitation.test.tspairing-invitation.tspasskey-flags.tspasskey-flags.ts — single switch for the Firefox passkey content-script proxy.passkey-utils.test.tspasskey-utils.tspasskey-utils.ts — WebAuthn relying-party-id validation.recovery-word-list.tsrecovery-word-list.ts — 2048-word recovery word list for Peach vault recovery.recovery-words.checksum.test.tsT-002: BIP39 checksum rejectionrecovery-words.cross-platform.test.tsrecovery-words.integrity.test.tsT-001: BIP39 word-list integrityrecovery-words.kek.test.tsT-003: 128-bit prefix-KEK invariant (PCH-01-005 sibling)recovery-words.tsrecovery-words.ts — BIP39-compatible recovery word encoding for Peach vault recovery.rendezvous.test.tsrendezvous.tsshortcuts.test.ts@vitest-environment jsdomshortcuts.tsshortcuts.ts — keybinding schema, defaults, matcher, formatter.storage.tssync-identity.test.tssync-identity.tsSync identity — long-term X25519 keypair tied to the vault, not the device installation.sync-kk-transport.test.tssync-limits.tsSync trust + resource bounds — audit fixes HV-1 (timestamp clamp) and MV-3 (receive-path size bounds).sync-outcome.test.tssync-outcome.tsWhy a sync run ended, in a form both the service worker and the popup can name.sync-padding.test.tssync-padding.tsE7: frame padding at the relay boundary.sync-transport.tsWebSocket reconnect transport — Noise KK with both paired static keys.sync-types.tsVault sync — type definitions.sync.disconnect.test.tsT-020: WebSocket sync-disconnect handling (PCH-01-026 #9)types.tstypes.ts — cross-boundary types and the MessageType union.vault-adopt-snapshot.test.tsvault-adopt.test.tsvault-adopt.tstests/
fixtures/
history
ce1712575251feat: add vault_id to PAIR_IDENTITY frame for desktop helper pairing (v4.0.2)4 months ago9d352e0795f8docs: CONTINUITY — desktop helper pairing drafts session record (4 passes, 12 files, brief-vs-source corrections, 4-message contract, gates certified, integration→4.0.3 pending)4 months agoeed41d6add18add Change 6 draft + INTEGRATION-CONTRACT + README — Change 6 needs sync-trigger.ts:104 filter widened (+|| deviceType==='desktop'), not a no-op; sync uses Noise XX on 8765 (pairing uses NK on 49142); vault_id flows pairing→SYNC_HELLO match verified; reconcile 4-message contract; 26 specs, additive (no existing test changes), integration bumps 4.0.2→4.0.34 months ago4fba012374b9add Change 4 UI draft — Solid DesktopPairingFlow (peach-underline-input code entry, not PeachField; not React), 6-digit entry → searching → SAS confirm → paired, wired into ChirpSync.tsx restView/pairingView; invalid_code+expired collapse to one message (no wire error frame); jsdom view-test-utils specs4 months ago6158d49b58ebadd Change 3/5 drafts — pairWithDesktopHelper (PEACH_HELLO → noiseNKInitiator against ACK ephemeral → reuse derivePairingSAS → PAIR_IDENTITY w/ vault_id → upsertPairedDevice), socket-close=invalid_code; new handshake-free probeSubnetForPort (existing probeSubnetForPeer does Noise XX, not reusable); KAT + invalid-code + persist tests4 months ago4b3171f697b0add DESKTOP-PAIRING ground-truth contract + Change 1/2 drafts — verify peach-sync wire (port 49142, PEACH_HELLO_ACK not _OK, no error frame, browser=NK initiator, SAS 0fbab8cd→895245 holds, vault_id genuinely optional); draft vault_id-in-PAIR_IDENTITY patch + test; flag Change 2 as no-op (desktop already in DeviceType)4 months ago0755f29c5e2btest: lock-screen suite full green 37/37 — fix #unlock-password vs #master-password selector (root cause of unlock 'timeouts'), add robust lock/unlock/settings helpers + 90s file timeout, rewrite LAC01-08 against the native auto-lock <select> (value-scoped options, real 30-min max, force selectOption + reload persistence), correct branding/icon/empty-password/transition assertions, repurpose untestable LS09/LS10, widen setupVault Argon2 waits4 months agoc4d5f79b2e49test: fix lock-screen setupVault — strong VAULT_PASSWORD passes the create-vault gate, auto-complete recovery confirmation to land in the unlocked vault (LS07b/c/d opt out), unlock fills + LSC01 use VAULT_PASSWORD, empty-vault unlock assertions check the lock-button shell not entry rows; suite 3→13 passing (remaining 24 are pre-existing timeout/flaky/feature-coupled debt)4 months agoef6f00072940fix: surface restore options on create-vault screen — relocate restore from clipped page footer into the card under the create CTA, tighten create-vault spacing so restore links + full recovery warning fit the 320x520 popup without clipping; shorten hint/warning copy; bump 4.0.1→4.0.2 (v4.0.2)4 months ago9e5693046d73docs: record PCH-02 integration in CONTINUITY (v4.0.1)4 months ago55bb28b8d92dchore: version bump 4.0.0 → 4.0.1 + build (v4.0.1)4 months ago2c1e7f972dd9fix: PCH-02-002 Noise XX message 1 empty-payload mixHash — wire change, ships with Android v2.3.0 (v4.0.0)4 months agofc06218b9f63fix: PCH-02-004 exact-pin crypto-adjacent deps (otpauth, pako, @zxing, bwip-js, pdf-lib, papaparse) + WASM-PROVENANCE.md (v4.0.0)4 months ago791712e7f33ffix: PCH-02-003/005/006/010 doc-only patches — SAS note, PBKDF2 note + re-export prompt, vault_id privacy note, clipboard clear rationale (v4.0.0)4 months ago1e1194c32494fix: PCH-02-009 rejectZero: true on all X25519 DH calls in Noise XX and NK (v4.0.0)4 months ago8f54f349945ffix: PCH-02-008 BinaryReader explicit bounds checks on every read operation (v4.0.0)4 months ago6d494603f74dfix: PCH-02-007 add Add-Padding header to HIBP k-anonymity range check (v4.0.0)4 months ago16d51870a784fix: PCH-02-001 UPDATE_ENTRY patch routes canary/tags/passkey through existing sanitizers (v4.0.0)4 months agoe69763aa6d3dadd PCH-02 drafts README + INTEGRATION-CONTRACT (file map, two integrator decisions, Android wire-change gate, pin table, 24-28 test estimate, v4.0.1 recommendation) + CONTINUITY session record — gates verified: tsc clean, 117 files / 3474 tests green4 months ago927a4bd80ebcadd PCH-02-010 fix draft: clipboard clear hash-match — Option A doc-only (recommended, no clipboardRead grant) vs Option B full offscreen SHA-256 match implementation with manifest permission gate + 4 tests4 months ago35841e9da617add PCH-02-007/008/009 fix drafts: HIBP Add-Padding header with padded-response parser proof + 3 tests, BinaryReader ensure() bounds on every read with PAYLOAD_TOO_SHORT + export seam + 8 tests, stablelib rejectZero=true at all 12 Noise DH sites + 5 tests4 months ago9bd1e7c2cf37add PCH-02-004/005/006 fix drafts: exact-pin crypto-adjacent deps with bun.lock versions + new WASM-PROVENANCE.md, legacy PBKDF2 KDF docblock with 250k-iteration correction + Import.tsx re-export notice, vault_id LAN-linkability privacy note4 months ago53ce63c0fe08add PCH-02-002 + PCH-02-003 fix drafts: Noise XX msg1 empty-payload mixHash deferred with ready patch (Android-coordinated wire change) + snow-interop doc correction; SAS peer-gate trust-model comment edits4 months ago2f6fb75710b9add PCH-02-001 fix draft: sanitizeEntryPatch routes canary/tags/passkey through sanitizeCanary/sanitizePasskey/sanitizeTags, producer compatibility audit, 8 regression tests4 months ago052b937cfde4add peach-code-review.md — independent static review: 0 Critical, 0 High, 1 Low (UPDATE_ENTRY patch sanitizer gap), 9 Informational; full crypto/boundary/sync/codex coverage + CONTINUITY record4 months ago3fd149556abafix: resolve 27 pre-existing tsc errors in test files — SharedArrayBuffer/Mock drift, unused vars, circular chrome type (v4.0.0)4 months ago40ffe3171e9bdocs: CONTINUITY.md — autofill-tests-integration session record (13 vitest + e2e + fixture integrated, split-OTP export, TOTP auto-copy toast with real clear time, v4.0.0); notes contract-vs-brief deviations, flaky contracts.test.tsx, export-only Addendum 1 rationale (v4.0.0)4 months ago2a7932644ca9chore: version bump 3.9.9 → 4.0.0 (manifest.json + manifest.firefox.json + package.json) + build Chrome/Firefox/Mobile; trash now-integrated AUTOFILL-TESTS draft files (kept INTEGRATION-CONTRACT.md as reference). Final: tsc no new errors (27 pre-existing), vitest 117 files/3474 passed/0 skipped/40 todo (v4.0.0)4 months agoab5c9a638d4bfeat: TOTP auto-copy toast — showTotpCopyToast(secondsUntilClear) in inject.ts shows '2FA code copied / clears in Ns' top-right, auto-dismisses 3s, resets timer on re-copy; wired into index.ts auto-copy path. Thread real clear time: export getEffectiveClearSeconds() from clipboard.ts (DRY with timer), COPY returns clearSeconds, add MessageResponse.clearSeconds. Activates T-M11/12/13 (v3.9.9)4 months ago0152b3f58edffix: split OTP input groups — export isSplitOtpGroup(field) from detect.ts (3+ maxlength=1 numeric inputs, numeric guard rejects 3-letter initials forms); activates T-DT18/20/21 skipIf spec. Export-only: every injectFieldIcon path already excludes maxLength===1 upstream, so a call-site guard would be unreachable (v3.9.9)4 months ago649e78412625test: autofill real-page e2e + login-form fixture — content.real-page.e2e.spec.ts→tests/, login-form.fixture.html→tests/fixtures/login-form.html; fix EXTENSION_PATH (3-up→1-up) + FIXTURE path; Playwright collects 10 tests (T-E01-10), vault-seed/served-origin still integration TODO per contract (v3.9.9)4 months agoce63d2b47335test: autofill layer — 13 vitest files integrated into src/content (smoke, detect, dismissal, field-icon, field-interaction, fill, initial-scan, interaction, message-routing, policy, save, selector-ui, totp-toast addendum); imports rewired ../../content→./, drop unused beforeAll; full suite 117 files/3468 green, 6 skipIf pending addenda (v3.9.9)4 months ago7f3e1f92d029chore: add content/_setup.ts shared test harness (chrome mock + DOM factories + jsdom rect/ResizeObserver shims) and trash throwaway vitest.drafts.config.ts (v3.9.9)4 months agof29f759b9d38add save.ts save-detection tests (T-SV01-10, banner-mount + AUTOFILL_QUERY/GET_ENTRY_FOR_FILL lookup; accept flows are closed-shadow e2e), Playwright e2e draft (T-E01-10) + login-form fixture, INTEGRATION-CONTRACT.md (file map, deviations, remaining refactors, 212 assertions) and CONTINUITY session record — full real suite recertified 104 passed/1 skipped, drafts excluded and unaffected4 months agocbcc3e0006bdadd inject.ts UI AUTOFILL-TESTS drafts: field-icon (T-IC01-08, real light-DOM button — render/aria/click/teardown/narrow-hide) and selector-ui (T-I01-16) — selector mounts a CLOSED shadow root so only mount/dismiss are externally observable; interior nav/filter/TOTP routed to e2e with documented rationale; ResizeObserver polyfill added to harness4 months ago6f1bb7a67d67add index.ts orchestration AUTOFILL-TESTS drafts: dismissal 3-layer model (T-D01-15 via _testSeam + captured onDismiss/onFillFields, fake timers for DISMISS_LOCK/grace), handleFieldInteraction core paths (T-F01-12 incl ML 150ms timeout race), initialScan aggression levels (T-S01-10), message routing (T-M01-10) + TOTP-toast addendum skipIf spec — mocks ./inject + ./content-ml-detector, drives real seams4 months ago17740443b130add pure-module AUTOFILL-TESTS drafts: detect (T-DT01-21 + skipIf isSplitOtpGroup spec), fill (T-FL01-12 incl React prototype-setter bypass), interaction (T-IT01-06), policy (T-PO01-06) — 58 passing, classifiers tested on clean arrays to dodge querySelectorAllDeep ancestor duplication4 months ago1e03ef874559add AUTOFILL-TESTS draft harness: _setup.ts chrome mock + DOM factories + jsdom visibility shim, throwaway runner config, passing smoke test proving index.ts/inject.ts import under jsdom4 months ago0cbcb74850d8chore: version bump 3.9.8→3.9.9 + CONTINUITY session record (v3.9.9)4 months agod65de1e59cb3test: integrate priority 3 test files T-025 T-030 T-037 + clipboard write-failure guard (v3.9.8)4 months ago12e652193472test: integrate priority 2 test files T-011 through T-024 (v3.9.8)4 months ago377a02b8e40drefactor: export testable decision functions from content/index.ts for T-011-T-014 (v3.9.8)4 months ago54e4594fb2f7draft: Priority 3 test files T-025/T-030/T-037 and Integration Contract in src/drafts/TEST-EXPANSION/4 months ago1b633f5d627cdraft: Priority 2 test files T-011 through T-024 in src/drafts/TEST-EXPANSION/4 months agoa1f68d42b20adraft: Priority 1 test files T-001 through T-010 in src/drafts/TEST-EXPANSION/4 months ago7100d7d25214fix: Add recovery popup reopen smoke test (v3.9.8)4 months ago689241c96391fix: Add recovery confirmation smoke test (v3.9.7)4 months agoe72ba4aef3cffix: Smoke test recovery screen onboarding flow (v3.9.5)4 months ago99c85210eeb0fix: Restore recovery password flow (v3.9.3)4 months ago4d43c82d69fdfix: Add onboarding password reveal controls (v3.9.2)4 months ago
details
Peach
A free, open source, local-first password manager for Chrome, Firefox, and Android.
Peach encrypts your vault on your device. No hosted vault, subscription, or account is required to use it.
Features
- Passwords, cards, and secure notes — keep your private data together in one encrypted vault
- Inline autofill — fill and save credentials without leaving the page
- TOTP built in — generate two-factor codes without a separate authenticator
- Password health — find weak, reused, and exposed passwords
- Portable backups — export and restore with PeachScript or a
.peachfile
Peach Pro adds:
- Peach Sync — end-to-end encrypted sync across paired devices
- Passkeys — save and use passkeys in Chrome and Firefox
- Peach Codex — print an encrypted, scannable backup of your vault
- Advanced vault health, Canary Entries, and duress tools
See the Peach website for current availability and Pro details.
Install
Open Source
Peach is released under the GPL v3. This repository contains Peach's Chrome and Firefox browser extensions. Android is maintained separately.
The source is hosted on Kepr, Asha Software's version control platform.
Security
Vault data is encrypted with AES-256-GCM and protected by Argon2id key derivation. Peach Sync authenticates paired devices and encrypts data in transit.
Implementation details live alongside the code:
Building
bun install --frozen-lockfile
bun run build
Builds are written to dist-chrome/ and dist-firefox/.
Built by Asha Software · [email protected]