peach-browser
A free, open source, local-first password manager for Chrome, Firefox, and Android.
TypeScript
timeline
atlas385 files
crypto-core/
public/
codex/
scripts/
build-noise-core.mjsbuild-peachscript.pyBuild PeachScript-Regular.otf — 256 historical-runic glyphs.check-noise-core.mjsPB-26-003: verify the committed Noise WASM still matches crypto-core source.check-sw-static-imports.mjsFails the build if any chunk reachable from the MV3 service worker still contains a runtime
import().ci.tsclean-chrome-dist.mjsclean-firefox-artifacts.mjsgenerate-kat.mjsgenerate-kat.mjs — recompute the pinned ciphertext for self-test.ts (PCH-01-020).package-source.test.tspackage-source.tsrelease-firefox.tsrelease-gate.test.tsrelease-gate.tsPB-26-210: Release browser-gate validation.release-lib.test.tsscripts/release-lib.test.ts PB-26-211: release tool hardening — security tests for the argv-based runner.release-lib.tsscripts/release-lib.ts Shared argv-based runner for release tooling (PB-26-211).release.test.tsrelease.tsrun-release-browser-gate.tstest-firefox-passkeys.mjstest-firefox-sender-context.mjsweb-accessible-resources.test.tssrc/
background/
aes.test.tsaes.tsaes.ts — AES-256-GCM encrypt/decrypt primitives for vault storage.alarms.test.tsalarms.tsclipboard.double-failure.test.tsT-037: clipboard double-failure / alreadyWritten pathclipboard.test.tsclipboard.tsClipboard write + reliable auto-clear — audit fix HV-2.codex-handlers.test.tsTests for src/background/codex-handlers.ts.codex-handlers.tscodex-handlers.ts — message handlers that back the Peach Codex flow.commands.test.tscommands.tsKeyboard command handler — routing for summon-inline: 1.device-identity.test.tsdevice-identity.tsLocal-device identity helpers for the sync architecture.entry.lock-port.test.tsThe lock-on-close onConnect listener accepts only our nonce'd "popup-<uuid>" port from the extension page and ignores anything else.entry.tshealth.test.tshealth.tshealth.ts — Pro advanced vault health analysis.license.tslicense.verification.test.tsT-009: License Ed25519 signature verificationlocked-sync-spool.test.tslocked-sync-spool.tsmesh-relay-listener.test.tsmesh-relay-listener.tsmessage-policy.test.tsmessage-policy.tsmessages.adversarial.test.tsmessages.adversarial.test.ts — Layer 3 §3.3 adversarial message handler tests.messages.autolock-refresh.test.tsPB-26-107: passive page traffic must not refresh the auto-lock timer.messages.batch-sanitize.test.tsT-008: PCH-01-016 batch-add canary/tag sanitizationmessages.create-vault-from-root-key.test.tsmessages.edit-origin.test.tsT-022: GET_ENTRY_FOR_EDIT via sender.url + locked-vault AUTOFILL_QUERYmessages.entry-write-origin.test.tsPB-26-106: content-script entry mutations must be bound to the entry's own domain set.messages.passkey-offer-decline.test.tsPB-26-109: the passkey offer-decline handler is page-relay, so any page's content script may send it.messages.test.tsmessages.tsmessages.ts — the only background message handler.ml.predictbatch.test.tsT-030: ml.ts predictBatch — batch sizes, softmax stability with extreme weightsml.tsnotes.test.tsoffscreen.htmloffscreen.tsOffscreen document script — audit fix HV-2c.pair-secrets.test.tspair-secrets.tspair-secrets.ts — PB-26-213: the reusable rendezvous secret must never sit in plaintext in chrome.storage.local.paired-devices.test.tspaired-devices.tsPaired-device registry — v3 sync.passkey-chrome-ceremony.test.tspasskey-chrome-ceremony.test.ts — covers the Chrome chrome.webAuthenticationProxy ceremony path that the Firefox-proxy test file does NOT exercise.passkey-crypto.test.tspasskey-crypto.tspasskey-deny-on-close.test.tspasskey-deny-on-close.test.ts — M8/COR-009passkey-firefox-proxy.test.tspasskey-firefox-proxy.test.ts — covers the v2.12.0 Firefox content-script proxy path.passkey.ed25519.test.tsT-015: Ed25519 passkey round-trippasskey.tspending-vouched-devices.test.tspending-vouched-devices.tsPending vouched devices — audit fix MV-7.recovery-pending.test.tsrecovery-pending.tsBackground-owned state set while the user has just created or rotated a vault identity and is confirming their recovery words.recovery-words.test.tsrecovery.adversarial.test.tsrecovery.adversarial.test.ts — Layer 3 §3.2 adversarial recovery words tests.relay-adoption-bg.test.tsrelay-adoption-bg.tsself-test.test.tsself-test.tsself-test.ts — Known-Answer Test (KAT) for the Peach crypto stack.storage-access.test.tsstorage-access.tsPB-26-203: the session-key escrow is only as trustworthy as the boundary around chrome.storage.session.sync-alarm.test.tssync-alarm.tssync-alarm.ts — the 10-minute background sync tick.sync-alerts.test.tssync-alerts.tsPending sync security alerts.sync-coordinator.test.tssync-coordinator.tsVault sync — Phase 2 manifest-diff coordinator.sync-runner.test.tssync-runner.tsProduction sync runner — composes the live vault adapter, WebSocket transport, and coordinator into the function the dispatcher injects via
setSyncRunner.sync-settings.test.tssync-settings.tssync-static.test.tsIV.7 — Static safety assertions for vault sync.sync-trigger.test.tssync-trigger.tssync-trigger.ts — central sync dispatcher.sync-vault-adapter.test.tssync-vault-adapter.tsProduction adapter that backs runSyncInitiator with the live vault.vault-createVaultFromRootKey.test.tsvault-history.test.tsVault history tests.vault.adversarial.test.tsvault.adversarial.test.ts — Layer 3 §3.1 adversarial vault tests.vault.card-decline.test.tsPB-26-108: declined-card metadata must not be offline-enumerable.vault.consolidate-passkeys.test.tsT-023: vault.consolidatePasskeyEntries — passkey merge with lastUsed rankingvault.corruption.test.tsT-018: Vault corruption vs wrong-password discrimination (M7/COR-007)vault.duress-adoption.test.tsvault.entry-id-namespace.test.tsvault.hibp-padding.test.tsPCH-02-007 regression tests — the HIBP k-anonymity range request must ask for response padding, and the parser must stay correct on padded responses.vault.purge-trash.test.tsT-024: vault.purgeExpiredTrash — retention cutoff boundaryvault.rotate-sync-identity.test.tsT-016: rotateSyncIdentity — new root key, cleared peers, recovery pendingvault.session-escrow.test.tsvault.sync-clamp.test.tsUnit tests for HV-1 — sync timestamp clamp + remote-mutation alerts.vault.test.tsvault.tombstone-ledger.test.tsvault.tsvault.ts — sole owner of vault state and chrome.storage vault keys.vault.update-entry-sanitize.test.tsPCH-02-001 regression tests — UPDATE_ENTRY patch path must route canary/tags/passkey through the same sanitizers the add/restore/sync funnels use (sanitizeCanary / sanitizePasskey / sanitizeTags).content/
passkey-toast/
crypto/
argon2.test.tsargon2.tsargon2id.kat.test.tsT-019: Argon2id known-answer test (KAT) + parameter assertioncrypto.test.tsdecompression-bomb.test.tsMV-4: decompression-bomb output bounds on the zstd and pako legs.official-vectors.test.tspeachPayload.binaryreader-bounds.test.tsPCH-02-008 regression tests — BinaryReader must bound every read and fail with the decoder's existing PAYLOAD_TOO_SHORT code on truncated input.peachPayload.bomb.test.tsT-005: peachPayload declared-length decompression bomb (MV-4)peachPayload.test.tspeachPayload.tspeachPayload.ts — binary payload format shared by PeachScript and the Peach QR matrix code (spec §2).peachScript.bounds.test.tsPB-26-208: PeachScript normalization before limits.peachScript.test.tspeachScript.tspeachScript.ts — PeachScript encoding/decoding.totp.rfc6238.test.tsT-004: TOTP RFC 6238 known-answer vectorstotp.test.tstotp.tszstd.tsThin wrapper around @bokuweb/zstd-wasm that defers WASM load until the first compress/decompress call and memoises the init promise.
popup/
codex/
aztec.tsaztec.ts — Aztec 2D barcode generation with round-trip verification.browser-bundle.test.tscodex.adversarial.test.tscodex.adversarial.test.ts — Layer 3 §3.4 adversarial Codex tests.codex.multistripe.test.tsT-017: Codex multi-stripe round-tripcodex.suite.test.tscodex.suite.test.ts — cross-cutting regression suite for the Codex pipeline.codex.test.tsconfirmation.tsPick 3 distinct positions in [1, 12] for the recovery-words confirmation gate.erasure.tserasure.ts — Reed-Solomon erasure coding around the WASM library.generate.test.tsgenerate.tsgenerate.ts — full Codex generation pipeline.helpers.tshelpers.ts — shared utilities for Codex generation and restoration.node-wasm.tsNode-only WASM byte loader for Vitest.pdf-import.clamp.test.tspdf-import.sandbox.test.tsT-007: MV-9 pdf.js sandbox flags regression testpdf-import.test.tspdf-import.test.ts — coverage for the testable surface of the PDF import path.pdf-import.tspdf-import.ts — restore from a Codex PDF instead of a camera scan.pdf-layout.tspdf-layout.ts — A4 Codex page geometry shared between the generator and the PDF importer.pdf.tspdf.ts — render the printable Codex PDF.reed-solomon.tsBrowser-safe wrapper around the Reed-Solomon WASM exports.restore.test.tsrestore.test.ts — coverage for ChunkBuffer, parseRawScan, reconstructAndVerify.restore.tsrestore.ts — Peach Codex restoration library (popup-side).rs-loader.tsrs-loader.ts — load the Reed-Solomon erasure WASM module.scan-limits.test.tsscan-limits.test.ts — PB-26-207 resource bounds on the Codex scan path.scanner.tsscanner.ts — camera-based Aztec scanning for Codex restoration.
components/
GeneratorDrawer.test.tsGeneratorDrawer.tsxNoteRow.test.tsx@vitest-environment jsdomNoteRow.tsxNoteToolbar.tsxPairingBirds.tsxPairing birds — the two illustrated characters used on the pairing screens.PairingProRequired.tsxPairingQrCode.tsxPeachMark.tsxRecoveryRuneBackground.tsxRuneBackground.tsxRuneCanvas.tsxSyncModeSelector.test.tsx@vitest-environment jsdomSyncModeSelector.tsxSyncModeSelector — the one place the relay choice is made.
views/
Add.tsxAdoptVaultView.test.tsx@vitest-environment jsdomAdoptVaultView.tsxCodexGenerateView.test.tsx@vitest-environment jsdomCodexGenerateView.tsxPeach Codex — generation view.CodexRestoreView.test.tsx@vitest-environment jsdomCodexRestoreView.tsxPeach Codex — restoration view.contracts.test.tsx@vitest-environment jsdomEntry.totp-params.test.tsx@vitest-environment jsdomEntry.tsxExport.csv.test.ts@vitest-environment jsdomExport.tsxSignal-conditioned views in this file must use <Show>, never a signal-conditioned early return (
if (signal()) return <X/>).Health.test.tsx@vitest-environment jsdomHealth.tsxImport.test.tsx@vitest-environment jsdomImport.tsxSignal-conditioned views in this file must use <Show>, never a signal-conditioned early return — see Projects.md §4.1.InitialSyncView.test.tsx@vitest-environment jsdomInitialSyncView.tsxLock.test.tsx@vitest-environment jsdomLock.tsxNoteEditor.toHtml.test.ts@vitest-environment jsdomNoteEditor.tsxNotesEditor.tsxNotesMode.tsxNotesTOC.tsxOnboarding.tsxPairDevice.test.tsx@vitest-environment jsdomPairDevice.tsxPairDevice — the pairing surface, opened from the Settings → Sync card.Panic.tsxPasskeyApproval.tsxProCelebration.tsxRecoveryWordDisplay.tsxRecoveryWordEntry.tsxSettings.tsxTrashView.tsxvault-search.test.tsvault-search.tsVault.tsxview-test-utils.tsxzxcvbn-strength.test.tsLV-8: the @zxcvbn-ts replacement must score the master-password strength meter on the same 0-4 scale as the old zxcvbn, with dictionaries loaded (language-common is what keeps weak passwords from scoring optimistically).shared/
noise-core-wasm/
any is intentional throughout this module (L17/I3/QUA-010): import files are user-supplied external JSON whose schemas vary by source app and version (1Password CPG, Bitwarden, CXF, generic CSV).initial-sync.test.tsinitial-sync.tsmesh-peer-role.tsml.tsnoise-blake2s-kat.test.tsnoise-core.tsnoise-js.test.tsNoise NK auth proof regression test.noise-js.tsNoise NK initiator for browser-to-browser sync.noise-kk.test.tsnoise-small-order-dh.test.tsPB-26-014 follow-up — the JS-side DH boundaries in noise-js.ts mirror the Rust core's small-order X25519 blocklist (libhydrogen's contributory-behaviour list).noise.reject-zero-dh.test.tsPCH-02-009 regression tests — every Noise NK DH must reject an all-zero shared secret (low-order / identity peer point) instead of feeding it into the key schedule.pairing-dial.test.tspairing-dial.tsThe WebSocket seam every relay-facing Peach flow shares.pairing-handshake.tsShared pairing primitives used by the live relay-adoption path.pairing-invitation.test.tspairing-invitation.tspasskey-flags.tspasskey-flags.ts — single switch for the Firefox passkey content-script proxy.passkey-utils.test.tspasskey-utils.tspasskey-utils.ts — WebAuthn relying-party-id validation.recovery-word-list.tsrecovery-word-list.ts — 2048-word recovery word list for Peach vault recovery.recovery-words.checksum.test.tsT-002: BIP39 checksum rejectionrecovery-words.cross-platform.test.tsrecovery-words.integrity.test.tsT-001: BIP39 word-list integrityrecovery-words.kek.test.tsT-003: 128-bit prefix-KEK invariant (PCH-01-005 sibling)recovery-words.tsrecovery-words.ts — BIP39-compatible recovery word encoding for Peach vault recovery.rendezvous.test.tsrendezvous.tsshortcuts.test.ts@vitest-environment jsdomshortcuts.tsshortcuts.ts — keybinding schema, defaults, matcher, formatter.storage.tssync-identity.test.tssync-identity.tsSync identity — long-term X25519 keypair tied to the vault, not the device installation.sync-kk-transport.test.tssync-limits.tsSync trust + resource bounds — audit fixes HV-1 (timestamp clamp) and MV-3 (receive-path size bounds).sync-outcome.test.tssync-outcome.tsWhy a sync run ended, in a form both the service worker and the popup can name.sync-padding.test.tssync-padding.tsE7: frame padding at the relay boundary.sync-transport.tsWebSocket reconnect transport — Noise KK with both paired static keys.sync-types.tsVault sync — type definitions.sync.disconnect.test.tsT-020: WebSocket sync-disconnect handling (PCH-01-026 #9)types.tstypes.ts — cross-boundary types and the MessageType union.vault-adopt-snapshot.test.tsvault-adopt.test.tsvault-adopt.tstest/
tests/
fixtures/
history
517bf896d7f1mark Q0 code-complete, carry the website copy sweep forward, and open the phone-to-phone initiator gap the relay-only model creates3 months agoc3f426a6fc8cdrop 'pair with a code, keep in step' from the sync card lede — the code half is no longer true and 'in step' reads oddly (v4.2.1)3 months ago839586785c0arecord the browser LAN removal, the checkpoint recovery of the relay dialler, and the phone-to-phone initiator gap the restructure opens3 months ago3f06919b90edrestructure browser sync around public/private/off relay modes and delete the LAN transport: pairing codes, subnet probing, the address cache and the local-network module all go, leaving one relay path (v4.2.0)3 months ago74a005e256a7record the LAN-retirement decision in docs/ and open a consolidated queue covering it, the blocked-on-June verifications, the security items with their real verified status, this session's unfixed findings, and the cleanup list3 months agofc721b3898a8show the topbar sync button unconditionally, and shrink the bird stage and QR on the invitation screen so the bird is no longer clipped to its legs (v4.1.13)3 months ago33473d579a29pin the shared recovery-word vector and the 2048-unique-list invariant on the browser side, so a future divergence fails a test instead of surfacing when someone tries to restore (v4.1.12)3 months ago236066499ad0add a topbar sync button that only appears once a device is paired, and drop the manual invitation textarea the QR already carries (v4.1.11)3 months agoefce56bed4e5note that the phone was two wire contracts behind at 2.3.68 and is now on 2.4.10, so browser and Android are finally in lockstep for the pairing retest3 months agoafecc4c62698supersede the Mayan-code terminology item: the format was deprecated months ago, so the pairing screen's QR copy is correct and there is no open copy fix3 months agof820f0e64e33record the MV3 dynamic-import root cause, the double masking that hid it, the live browser proof, and the stale Playwright setupVault helper found on the way3 months ago43458142142aload sync and pairing through static imports: runtime import() throws in an MV3 service worker, and Vite's preload helper reported it as "window is not defined", so the whole sync surface failed silently (v4.1.10)3 months ago06089c871dd2record the relay deploy, the live 429 that proves the limiter is enforcing, and the two probing traps that hide non-101 responses3 months agob59a3a2d340brecord the v0x02 manifest and padding wire contracts, the two real gaps found on Android, and why E6 and E4 do not fit this architecture3 months agoba39b05bd7e8pad sync frames to size buckets before encryption so the relay cannot read vault size or operation type off traffic shape (v4.1.9)3 months agoc62fe9f5c847pin that each reconnect derives fresh session keys, and record why intra-session rekeying buys nothing on a one-shot session (v4.1.8)3 months ago22016a5dbc67pin that the duress vault derives no root key, so every sync operation fails closed and no second vault id exists (v4.1.7)3 months ago158d6d9fe504say plainly at the point of removal that revocation stops future changes but recovery words survive it (v4.1.6)3 months ago0dcc53fd9e7frecord which peer timestamp each bound covers, and clamp revocation timestamps for display (v4.1.5)3 months ago1ef99bf947b0propagate device revocation as terminal signed records in manifest v0x02, so removing a device survives a peer vouching it back (v4.1.4)3 months agof9fa8bc4f93aname a rotating device from local state instead of the vouching peer's manifest claim, and stop a third-party issuer renaming a paired record (v4.1.3)3 months ago28e4cc72b69crecord the 8-digit SAS wire contract, its cross-platform KATs, the stale assertions the handoff left behind, and the relay redeploy still owed3 months agod37e6a6763d5test: pin official cryptographic vectors (v4.1.1)3 months ago9dde66e57d3dfeat: share Noise through Rust WASM and JNI core (v4.1.0)3 months ago924fa824995dfeat: add safe inverse vault adoption (v4.0.48)3 months agob6a62bdc472efeat: add relay-first vault adoption (v4.0.47)3 months ago61a600251c9bfix: gate vault adoption on both confirmations (v4.0.46)3 months ago91e964e65906fix: propagate mesh relay settings (v4.0.45)3 months agoc6c9978bbb7cfeat: add secure relay sync fallback (v4.0.44)3 months ago9c0983a25210feat: require mutual KK reconnect auth (v4.0.43)3 months ago7229580119fbfeat: require pairing key proof (v4.0.42)3 months ago4d35c2a90536feat: add rotating relay rendezvous state (v4.0.41)3 months ago3901ccee1835refactor: remove retired sync transport paths (v4.0.40)3 months agoefefabc50cb3fix: enforce relay-safe sync frame limits (v4.0.39)3 months ago157f3326d8f1fix: bind sync manifests to authenticated peer identity (v4.0.38)3 months agof92006bbfad8mark the XX-vs-NK ongoing-sync blocker in CONTINUITY.md resolved, pointing at HANDSHAKE_STANDARDIZE_ON_NK.md and this session's saves3 months agoc730b3f3bfe8reconcile stale Noise-XX comments with the NK reconnect path, default PairedDevice.wsPort to the real 49142 listener, and add the real 7-frame RelayMessage contract from Android's RelayFrames.kt (targetDeviceId is the NK static pubkey hex, not a device-id string)3 months ago66a788d0df33dial Android's Noise NK reconnect listener (49142) for ongoing sync, replacing the Noise XX/8765 path that could never complete against it3 months ago2d111c938645queue the relay and adoption-device-id items with the real Android frame contract, the browser framing convention, and the XX-vs-NK sync handshake divergence that actually blocks relay3 months ago2639f70867darecord that the kepr lockfile flag needs no fix and that the chirp rename verification is mechanical rather than visual3 months agoed5d1c0e57ebreconcile the last chirp-era names: peach-chirp-* CSS classes become peach-pair-*, the three CHIRP_-prefixed device messages drop the prefix, stale comments stop pointing at deleted files, and the dead peach-pair-pro-chirp rule goes (v4.0.37)3 months agoba8d30d4cb70record the queue sweep: the three fixes, the adoption sync bug and its untested status, and the correction to the sync-static.test.ts claim on line 2693 months ago35602e4a18c2seed the reconnect address cache when a vault is adopted, so an adopted browser can reach its first sync instead of failing subnet_unknown forever in the MV3 service worker (v4.0.36)3 months agofacf0df18c16raise recovery-words.test.ts testTimeout to 30s so real Argon2id derivations survive full-suite CPU contention instead of failing at the 5s default (v4.0.35)3 months ago888f1652d895rename the persisted device-identity keys to peach_device_id / peach_device_name now that no paired devices exist to orphan (v4.0.34)3 months ago8f9ae6790be4record the length fix, the new golden vector, and what the rename deliberately left alone (v4.0.33)3 months agob82564183743rename the sync layer off the chirp name: sync-coordinator/runner/transport/vault-adapter, device-identity, pairing-handshake, vault-adopt, and drop the orphaned audio-frame types (v4.0.32)3 months ago1672cc400bcerename the pairing surface to say what it is: code-pairing modules, PairDevice view, PairingBirds, PAIR_WITH_CODE/CODE_PAIR_* messages (v4.0.31)3 months agoab3f2d5e6a51pin the pairing token at 4 bytes so a code is 16 characters in 4 groups, refuse any other size at encode, and keep decode lenient for older 8-byte peers (v4.0.30)3 months agof4dd1094715dflag chirp-handshake's listener-side helpers as unusable from a browser and close out the session record (v4.0.29)3 months ago
details
Peach
A free, open source, local-first password manager for Chrome, Firefox, and Android.
Peach encrypts your vault on your device. No hosted vault, subscription, or account is required to use it.
Features
- Passwords, cards, and secure notes — keep your private data together in one encrypted vault
- Inline autofill — fill and save credentials without leaving the page
- TOTP built in — generate two-factor codes without a separate authenticator
- Password health — find weak, reused, and exposed passwords
- Portable backups — export and restore with PeachScript or a
.peachfile
Peach Pro adds:
- Peach Sync — end-to-end encrypted sync across paired devices
- Passkeys — save and use passkeys in Chrome and Firefox
- Peach Codex — print an encrypted, scannable backup of your vault
- Advanced vault health, Canary Entries, and duress tools
See the Peach website for current availability and Pro details.
Install
Open Source
Peach is released under the GPL v3. This repository contains Peach's Chrome and Firefox browser extensions. Android is maintained separately.
The source is hosted on Kepr, Asha Software's version control platform.
Security
Vault data is encrypted with AES-256-GCM and protected by Argon2id key derivation. Peach Sync authenticates paired devices and encrypts data in transit.
Implementation details live alongside the code:
Building
bun install --frozen-lockfile
bun run build
Builds are written to dist-chrome/ and dist-firefox/.
Built by Asha Software · [email protected]