peach-browser
A free, open source, local-first password manager for Chrome, Firefox, and Android.
TypeScript
timeline
atlas271 files
public/
codex/
fonts/
models/
scripts/
build-peachscript.pyBuild PeachScript-Regular.otf — 256 historical-runic glyphs.ci.tsclean-chrome-dist.mjsclean-firefox-artifacts.mjspackage-amo-source.shpackage-amo-source.sh — produce peach-3.6.65-source.zip for AMO review.release-firefox.tsrelease.tssetup-chrome-release.sh───────────────────────────────────────────────────────────────────────────── Peach — Chrome Web Store Release Setup Run this once to configure Chrome publishing.sync-chrome-dist.mjs
src/
background/
aes.test.tsaes.tsaes.ts — AES-256-GCM encrypt/decrypt primitives for vault storage.alarms.test.tsalarms.tschirp-identity.tsLocal-device identity helpers for the chirp-sync architecture.chirp-sync-coordinator.test.tschirp-sync-coordinator.tsChirp Sync — Phase 2 manifest-diff coordinator.chirp-sync-runner.test.tschirp-sync-runner.tsProduction sync runner — composes the live vault adapter, WebSocket transport, and coordinator into the function the dispatcher injects via
setSyncRunner.chirp-sync-static.test.tsIV.7 — Static safety assertions for Chirp Sync.chirp-sync-vault-adapter.test.tschirp-sync-vault-adapter.tsProduction adapter that backs runChirpSyncInitiator with the live vault.clipboard.test.tsclipboard.tscodex-handlers.test.tsTests for src/background/codex-handlers.ts.codex-handlers.tscodex-handlers.ts — message handlers that back the Peach Codex flow.commands.tsKeyboard command handler — routing for summon-inline: 1.entry.tshealth.test.tshealth.tshealth.ts — Pro advanced vault health analysis.index.tslicense.tsmessages.adversarial.test.tsmessages.adversarial.test.ts — Layer 3 §3.3 adversarial message handler tests.messages.test.tsmessages.tsmessages.ts — the only background message handler.ml.tsnotes.test.tspaired-devices.test.tspaired-devices.tsPaired-device registry — v3 chirp-sync.passkey-chrome-ceremony.test.tspasskey-chrome-ceremony.test.ts — covers the Chrome chrome.webAuthenticationProxy ceremony path that the Firefox-proxy test file does NOT exercise.passkey-crypto.test.tspasskey-crypto.tspasskey-deny-on-close.test.tspasskey-deny-on-close.test.ts — M8/COR-009passkey-firefox-proxy.test.tspasskey-firefox-proxy.test.ts — covers the v2.12.0 Firefox content-script proxy path.passkey.tsrecovery-pending.tsPersistent flag set while the user has just created a vault and is reading their 12 recovery words but has not yet typed the 3 confirmation words.recovery-words.test.tsrecovery.adversarial.test.tsrecovery.adversarial.test.ts — Layer 3 §3.2 adversarial recovery words tests.self-test.test.tsself-test.tsself-test.ts — Known-Answer Test (KAT) for the Peach crypto stack.sync-trigger.test.tssync-trigger.tssync-trigger.ts — central sync dispatcher.vault-history.test.tsVault history tests.vault.adversarial.test.tsvault.adversarial.test.ts — Layer 3 §3.1 adversarial vault tests.vault.test.tsvault.tsvault.ts — sole owner of vault state and chrome.storage vault keys.content/
passkey-toast/
crypto/
argon2.test.tsargon2.tscrypto.test.tspeachPayload.test.tspeachPayload.tspeachPayload.ts — binary payload format shared by PeachScript and the Peach QR matrix code (spec §2).peachScript.test.tspeachScript.tspeachScript.ts — PeachScript encoding/decoding.totp.tszstd.tsThin wrapper around @bokuweb/zstd-wasm that defers WASM load until the first compress/decompress call and memoises the init promise.
popup/
codex/
aztec.tsaztec.ts — Aztec 2D barcode generation with round-trip verification.browser-bundle.test.tscodex.adversarial.test.tscodex.adversarial.test.ts — Layer 3 §3.4 adversarial Codex tests.codex.suite.test.tscodex.suite.test.ts — cross-cutting regression suite for the Codex pipeline.codex.test.tsconfirmation.tsPick 3 distinct positions in [1, 12] for the recovery-words confirmation gate.erasure.tserasure.ts — Reed-Solomon erasure coding around the WASM library.generate.test.tsgenerate.tsgenerate.ts — full Codex generation pipeline.helpers.tshelpers.ts — shared utilities for Codex generation and restoration.node-wasm.tsNode-only WASM byte loader for Vitest.pdf-import.test.tspdf-import.test.ts — coverage for the testable surface of the PDF import path.pdf-import.tspdf-import.ts — restore from a Codex PDF instead of a camera scan.pdf-layout.tspdf-layout.ts — A4 Codex page geometry shared between the generator and the PDF importer.pdf.tspdf.ts — render the printable Codex PDF.reed-solomon.tsBrowser-safe wrapper around the Reed-Solomon WASM exports.restore.test.tsrestore.test.ts — coverage for ChunkBuffer, parseRawScan, reconstructAndVerify.restore.tsrestore.ts — Peach Codex restoration library (popup-side).rs-loader.tsrs-loader.ts — load the Reed-Solomon erasure WASM module.scanner.tsscanner.ts — camera-based Aztec scanning for Codex restoration.
components/
views/
Add.tsxChirpSync.tsxChirpSync — the v3 Settings → Sync surface.CodexGenerateView.test.tsx@vitest-environment jsdomCodexGenerateView.tsxPeach Codex — generation view.CodexRestoreView.tsxPeach Codex — restoration view.contracts.test.tsx@vitest-environment jsdomEntry.tsxExport.csv.test.ts@vitest-environment jsdomExport.tsxSignal-conditioned views in this file must use <Show>, never a signal-conditioned early return (
if (signal()) return <X/>).Health.test.tsx@vitest-environment jsdomHealth.tsxImport.tsxSignal-conditioned views in this file must use <Show>, never a signal-conditioned early return — see Projects.md §4.1.Lock.tsxNoteEditor.toHtml.test.ts@vitest-environment jsdomNoteEditor.tsxNotesEditor.tsxNotesMode.tsxNotesTOC.tsxOnboarding.tsxPanic.tsxPasskeyApproval.tsxProCelebration.tsxRecoveryWordDisplay.tsxRecoveryWordEntry.tsxSettings.tsxTrashView.tsxVault.tsxview-test-utils.tsxshared/
backup.test.tsbackup.tsbridge.tsbrowser.test.tsbrowser.test.ts — locks down feature-detected browser identification.browser.tsbrowser.ts — feature-detected browser identifier shared by background, popup, and content scripts.chirp-handshake.test.tschirp-handshake.tsPost-chirp pairing handshake.chirp-pairing.test.tschirp-pairing.tsAudio pairing driver — orchestrates the two-chirp exchange that bootstraps trust between two devices in the same room.chirp-payload.test.tschirp-payload.tsAudio pairing payload — 64 bytes on the wire.chirp-sync-transport.test.tsSubnet-probe rate-limit tests.chirp-sync-transport.tsWebSocket sync transport — v3 chirp-sync Phase 2.codex-types.tscodex-types.ts — shared shapes for the Peach Codex.config.tsWeb3Forms access key for the in-app feedback form (Settings → feedback).device-manifest.test.tsdevice-manifest.tsDevice manifest — v2 brief §4.3.domain.tsfavicon.test.tsfavicon.tsResolves a favicon URL for a given domain.generate.test.tsgenerate.tsggwave.test.tsggwave.tsggwave loader — thin async wrapper around the ggwave-wasm module.import.test.tsimport.ts
any is intentional throughout this module (L17/I3/QUA-010): import files are user-supplied external JSON whose schemas vary by source app and version (1Password CPG, Bitwarden, CXF, generic CSV).local-network.tsLocal network discovery — minimal helper used by chirp pairing.ml.tsnative.tsMobile platform detection helpers used by popup views to gate Capacitor-only paths.noise-js.test.tsNoise NK auth proof regression test.noise-js.tsNoise NK initiator for Android / Capacitor.noise-xx.test.tsnoise-xx.tsNoise XX (mutual auth) — used for every Phase-2 WebSocket connection after the audio chirp pairing has stamped each side into the other's paired-device registry.passkey-flags.tspasskey-flags.ts — single switch for the Firefox passkey content-script proxy.passkey-utils.test.tspasskey-utils.tspasskey-utils.ts — WebAuthn relying-party-id validation.recovery-word-list.tsrecovery-word-list.ts — 2048-word recovery word list for Peach vault recovery.recovery-words.tsrecovery-words.ts — BIP39-compatible recovery word encoding for Peach vault recovery.shortcuts.test.ts@vitest-environment jsdomshortcuts.tsshortcuts.ts — keybinding schema, defaults, matcher, formatter.storage.tssync-identity.test.tssync-identity.tsSync identity — long-term X25519 keypair tied to the vault, not the device installation.sync-types.tsChirp Sync — type definitions (Master Brief v2).types.tstypes.ts — cross-boundary types and the MessageType union.tests/
fixtures/
history
f875282e49e1L3/SEC-008: replace SHA-1 with SHA-256 for card fingerprint; note HIBP SHA-1 contract5 months agobdecd747802fL2/SEC-004: check event.source in passkey toast closed listener5 months agod99374a2ca9bL1/THREAT-004: add isUnlocked guard to GET_ENTRIES handler5 months agodf4696f637edL-orphan: tighten username heuristic and isLoginForm signup detection (10 orphan reds cleared)5 months ago6d4cdaded53dbefore Phase 5 — LOW + INFO L1-L18 + orphan disposition5 months ago3fed037ef968Phase 4 complete — all MEDIUM UI/quality findings resolved5 months ago1db3573bd284M15/THREAT-006: sanitize note HTML with allow-list — strip iframe/base/meta/form/script5 months ago24ef36cf45b3M14/SEC-007: gate DEBUG_INJECT_INCOMING_PAIRING behind production mode check5 months ago6470e03ca8cdM5/QUA-009: add Codex message types to MessageType union5 months ago4716fba90272M4/QUA-006: log takeVaultSnapshot failures and notify popup on quota5 months ago76fd3d0637f7M3/QUA-005: surface clipboard write failures to user5 months ago3b81fc8ed88eM2/QUA-002: add runtime payload validation at message handler trust boundary5 months ago13f21e71dd16M1/QUA-001: resolve setNativeValue import/local declaration conflict5 months agoe48b2c96ca80before Phase 4 — MEDIUM UI/quality M1-M5, M14-M155 months agof93c36757d9fNOTE comment on lastUnlockFailureReason — flag worker-context fragility (Phase 3 ambiguity #1 followup)5 months agod468573bc9e7CAUTION comment on noiseSessionStub — flag latent break if performResponderAuth ever uses session arg (Phase 2 ambiguity #2 followup)5 months agod3a178f30bffPhase 3 complete — all MEDIUM vault/sync findings resolved5 months agofad5dfeb3dd9M13/SEC-005: verify publicKeyHex against completed handshake in PAIRING_COMPLETED5 months ago31cc6fe0e97aM12/SEC-003: encrypt sync identity private key under derived vault key5 months ago27a13a833aa5M11/COR-014: verify peer is paired before running blob sync session5 months agoddca1d438ac7M10/COR-012: validate incoming vault blob shape before writing5 months ago47c6f243081fM9/COR-010: fix Firefox passkey requestId millisecond collision5 months agoe1c408181343M8/COR-009: deny all pending passkey requests on popup close5 months ago2be6150ec6d1M7/COR-007: distinguish vault corruption from wrong password5 months ago37c409102a5dM6/COR-004: make changePassword single atomic writeSlot call5 months ago6b7be6db17e9before Phase 3 — MEDIUM vault/sync M6-M135 months ago5ec50e357ae3Phase 2 complete — all HIGH findings resolved5 months ago2cba0b06e237H4/COR-002: changePassword re-wraps existing root key instead of generating new one5 months agof9d291f0ea22H3/COR-005: lock vault if reloadEntriesAfterSync fails after sync apply5 months ago35336be9b375H2/COR-006/SEC-006/CRYPTO-11: implement deriveRootKeyFromDerivedKey via pw_root_* wrapping; call migrateToRecovery on unlock5 months agof3db4b95c247H1/THREAT-002: wire performInitiatorAuth/performResponderAuth into production sync5 months ago1a50a54a5decbefore Phase 2 — HIGH findings H1-H45 months ago9b0ef8533cactest infra: fix recovery.adversarial beforeEach context-arg bug; non-list word for 13-word test; vault wrong-unlock timeouts (54 reds cleared)5 months agoc3b41306469dfix: COR-003 stamp peach_last_modified_at on local vault mutations (v2.45.4)5 months ago45f6eddadb59fix: COR-001 preserve recovery escrow during password rewrap (v2.45.3)5 months ago72b453994169fix: SEC-002/THREAT-003 delete TEST handlers (v2.45.2)5 months ago5c4a71d3e83bfix: SEC-001/THREAT-001 whitelist Firefox passkey relay (v2.45.1)5 months ago53eceac206fcdocs: queue audit fix phases5 months ago1b669ded385bbefore complete audit fix spec threat-tier sequence5 months agoeaa64b25d3a7add 5-layer pre-release audit reports (security, correctness, adversarial, code-quality, threat-model)5 months ago309a32ce8a2cadd 6 adversarial test files (~2050 tests across vault, recovery, messages, codex, sync, content)5 months ago613915a9625bbefore comprehensive pre-release audit (5 layers, 5 parallel subagents)5 months agoebd0620a556abump version to 2.45.05 months ago4ed3038d4f03add Section 8 Codex tests — compression, erasure coding, chunk envelope, verify code, handler dispatch5 months agof7a954eb040eadd Section 6 sync Pro gate tests and Section 7 recovery words tests with vault bug fixes5 months agoed6298c4cb0eadd Section 3 notes tests, Section 4 sync screen tests, Section 5 sync info sheet tests5 months ago15de0ce01d2cextract generator policy to testable module and add Section 1 + Section 2 tests5 months agobe8ded95ecdebefore regression test suite v2.42.0 implementation5 months ago4cb0505cbd71replace flushView+assert with vi.waitFor in TOTP copy test — 220ms click timer outlasts 0ms flush5 months agod6b451606313before TOTP copy test fix — 220ms timer vs flushView mismatch5 months ago
details
Peach
A free, open source, local-first password manager for Chrome, Firefox, and Android.
Peach encrypts your vault on your device. No hosted vault, subscription, or account is required to use it.
Features
- Passwords, cards, and secure notes — keep your private data together in one encrypted vault
- Inline autofill — fill and save credentials without leaving the page
- TOTP built in — generate two-factor codes without a separate authenticator
- Password health — find weak, reused, and exposed passwords
- Portable backups — export and restore with PeachScript or a
.peachfile
Peach Pro adds:
- Peach Sync — end-to-end encrypted sync across paired devices
- Passkeys — save and use passkeys in Chrome and Firefox
- Peach Codex — print an encrypted, scannable backup of your vault
- Advanced vault health, Canary Entries, and duress tools
See the Peach website for current availability and Pro details.
Install
Open Source
Peach is released under the GPL v3. This repository contains Peach's Chrome and Firefox browser extensions. Android is maintained separately.
The source is hosted on Kepr, Asha Software's version control platform.
Security
Vault data is encrypted with AES-256-GCM and protected by Argon2id key derivation. Peach Sync authenticates paired devices and encrypts data in transit.
Implementation details live alongside the code:
Building
bun install --frozen-lockfile
bun run build
Builds are written to dist-chrome/ and dist-firefox/.
Built by Asha Software · [email protected]