peach-browser
A free, open source, local-first password manager for Chrome, Firefox, and Android.
TypeScript
timeline
atlas384 files
crypto-core/
public/
codex/
scripts/
build-noise-core.mjsbuild-peachscript.pyBuild PeachScript-Regular.otf — 256 historical-runic glyphs.check-noise-core.mjsPB-26-003: verify the committed Noise WASM still matches crypto-core source.check-sw-static-imports.mjsFails the build if any chunk reachable from the MV3 service worker still contains a runtime
import().ci.tsclean-chrome-dist.mjsclean-firefox-artifacts.mjsgenerate-kat.mjsgenerate-kat.mjs — recompute the pinned ciphertext for self-test.ts (PCH-01-020).package-source.test.tspackage-source.tsrelease-firefox.tsrelease-gate.test.tsrelease-gate.tsPB-26-210: Release browser-gate validation.release-lib.test.tsscripts/release-lib.test.ts PB-26-211: release tool hardening — security tests for the argv-based runner.release-lib.tsscripts/release-lib.ts Shared argv-based runner for release tooling (PB-26-211).release.test.tsrelease.tsrun-release-browser-gate.tstest-firefox-passkeys.mjstest-firefox-sender-context.mjsweb-accessible-resources.test.tssrc/
background/
aes.test.tsaes.tsaes.ts — AES-256-GCM encrypt/decrypt primitives for vault storage.alarms.test.tsalarms.tsclipboard.double-failure.test.tsT-037: clipboard double-failure / alreadyWritten pathclipboard.test.tsclipboard.tsClipboard write + reliable auto-clear — audit fix HV-2.codex-handlers.test.tsTests for src/background/codex-handlers.ts.codex-handlers.tscodex-handlers.ts — message handlers that back the Peach Codex flow.commands.test.tscommands.tsKeyboard command handler — routing for summon-inline: 1.device-identity.test.tsdevice-identity.tsLocal-device identity helpers for the sync architecture.entry.lock-port.test.tsThe lock-on-close onConnect listener accepts only our nonce'd "popup-<uuid>" port from the extension page and ignores anything else.entry.tshealth.test.tshealth.tshealth.ts — Pro advanced vault health analysis.license.tslicense.verification.test.tsT-009: License Ed25519 signature verificationlocked-sync-spool.test.tslocked-sync-spool.tsmesh-relay-listener.test.tsmesh-relay-listener.tsmessage-policy.test.tsmessage-policy.tsmessages.adversarial.test.tsmessages.adversarial.test.ts — Layer 3 §3.3 adversarial message handler tests.messages.autolock-refresh.test.tsPB-26-107: passive page traffic must not refresh the auto-lock timer.messages.batch-sanitize.test.tsT-008: PCH-01-016 batch-add canary/tag sanitizationmessages.create-vault-from-root-key.test.tsmessages.edit-origin.test.tsT-022: GET_ENTRY_FOR_EDIT via sender.url + locked-vault AUTOFILL_QUERYmessages.entry-write-origin.test.tsPB-26-106: content-script entry mutations must be bound to the entry's own domain set.messages.passkey-offer-decline.test.tsPB-26-109: the passkey offer-decline handler is page-relay, so any page's content script may send it.messages.test.tsmessages.tsmessages.ts — the only background message handler.ml.predictbatch.test.tsT-030: ml.ts predictBatch — batch sizes, softmax stability with extreme weightsml.tsnotes.test.tsoffscreen.htmloffscreen.tsOffscreen document script — audit fix HV-2c.pair-secrets.test.tspair-secrets.tspair-secrets.ts — PB-26-213: the reusable rendezvous secret must never sit in plaintext in chrome.storage.local.paired-devices.test.tspaired-devices.tsPaired-device registry — v3 sync.passkey-chrome-ceremony.test.tspasskey-chrome-ceremony.test.ts — covers the Chrome chrome.webAuthenticationProxy ceremony path that the Firefox-proxy test file does NOT exercise.passkey-crypto.test.tspasskey-crypto.tspasskey-deny-on-close.test.tspasskey-deny-on-close.test.ts — M8/COR-009passkey-firefox-proxy.test.tspasskey-firefox-proxy.test.ts — covers the v2.12.0 Firefox content-script proxy path.passkey.ed25519.test.tsT-015: Ed25519 passkey round-trippasskey.tspending-vouched-devices.test.tspending-vouched-devices.tsPending vouched devices — audit fix MV-7.recovery-pending.test.tsrecovery-pending.tsBackground-owned state set while the user has just created or rotated a vault identity and is confirming their recovery words.recovery-words.test.tsrecovery.adversarial.test.tsrecovery.adversarial.test.ts — Layer 3 §3.2 adversarial recovery words tests.relay-adoption-bg.test.tsrelay-adoption-bg.tsself-test.test.tsself-test.tsself-test.ts — Known-Answer Test (KAT) for the Peach crypto stack.storage-access.test.tsstorage-access.tsPB-26-203: the session-key escrow is only as trustworthy as the boundary around chrome.storage.session.sync-alarm.test.tssync-alarm.tssync-alarm.ts — the 10-minute background sync tick.sync-alerts.test.tssync-alerts.tsPending sync security alerts.sync-coordinator.test.tssync-coordinator.tsVault sync — Phase 2 manifest-diff coordinator.sync-runner.test.tssync-runner.tsProduction sync runner — composes the live vault adapter, WebSocket transport, and coordinator into the function the dispatcher injects via
setSyncRunner.sync-settings.test.tssync-settings.tssync-static.test.tsIV.7 — Static safety assertions for vault sync.sync-trigger.test.tssync-trigger.tssync-trigger.ts — central sync dispatcher.sync-vault-adapter.test.tssync-vault-adapter.tsProduction adapter that backs runSyncInitiator with the live vault.vault-createVaultFromRootKey.test.tsvault-history.test.tsVault history tests.vault.adversarial.test.tsvault.adversarial.test.ts — Layer 3 §3.1 adversarial vault tests.vault.card-decline.test.tsPB-26-108: declined-card metadata must not be offline-enumerable.vault.consolidate-passkeys.test.tsT-023: vault.consolidatePasskeyEntries — passkey merge with lastUsed rankingvault.corruption.test.tsT-018: Vault corruption vs wrong-password discrimination (M7/COR-007)vault.duress-adoption.test.tsvault.entry-id-namespace.test.tsvault.hibp-padding.test.tsPCH-02-007 regression tests — the HIBP k-anonymity range request must ask for response padding, and the parser must stay correct on padded responses.vault.purge-trash.test.tsT-024: vault.purgeExpiredTrash — retention cutoff boundaryvault.rotate-sync-identity.test.tsT-016: rotateSyncIdentity — new root key, cleared peers, recovery pendingvault.session-escrow.test.tsvault.sync-clamp.test.tsUnit tests for HV-1 — sync timestamp clamp + remote-mutation alerts.vault.test.tsvault.tombstone-ledger.test.tsvault.tsvault.ts — sole owner of vault state and chrome.storage vault keys.vault.update-entry-sanitize.test.tsPCH-02-001 regression tests — UPDATE_ENTRY patch path must route canary/tags/passkey through the same sanitizers the add/restore/sync funnels use (sanitizeCanary / sanitizePasskey / sanitizeTags).content/
passkey-toast/
crypto/
argon2.test.tsargon2.tsargon2id.kat.test.tsT-019: Argon2id known-answer test (KAT) + parameter assertioncrypto.test.tsdecompression-bomb.test.tsMV-4: decompression-bomb output bounds on the zstd and pako legs.official-vectors.test.tspeachPayload.binaryreader-bounds.test.tsPCH-02-008 regression tests — BinaryReader must bound every read and fail with the decoder's existing PAYLOAD_TOO_SHORT code on truncated input.peachPayload.bomb.test.tsT-005: peachPayload declared-length decompression bomb (MV-4)peachPayload.test.tspeachPayload.tspeachPayload.ts — binary payload format shared by PeachScript and the Peach QR matrix code (spec §2).peachScript.bounds.test.tsPB-26-208: PeachScript normalization before limits.peachScript.test.tspeachScript.tspeachScript.ts — PeachScript encoding/decoding.totp.rfc6238.test.tsT-004: TOTP RFC 6238 known-answer vectorstotp.test.tstotp.tszstd.tsThin wrapper around @bokuweb/zstd-wasm that defers WASM load until the first compress/decompress call and memoises the init promise.
popup/
codex/
aztec.tsaztec.ts — Aztec 2D barcode generation with round-trip verification.browser-bundle.test.tscodex.adversarial.test.tscodex.adversarial.test.ts — Layer 3 §3.4 adversarial Codex tests.codex.multistripe.test.tsT-017: Codex multi-stripe round-tripcodex.suite.test.tscodex.suite.test.ts — cross-cutting regression suite for the Codex pipeline.codex.test.tsconfirmation.tsPick 3 distinct positions in [1, 12] for the recovery-words confirmation gate.erasure.tserasure.ts — Reed-Solomon erasure coding around the WASM library.generate.test.tsgenerate.tsgenerate.ts — full Codex generation pipeline.helpers.tshelpers.ts — shared utilities for Codex generation and restoration.node-wasm.tsNode-only WASM byte loader for Vitest.pdf-import.clamp.test.tspdf-import.sandbox.test.tsT-007: MV-9 pdf.js sandbox flags regression testpdf-import.test.tspdf-import.test.ts — coverage for the testable surface of the PDF import path.pdf-import.tspdf-import.ts — restore from a Codex PDF instead of a camera scan.pdf-layout.tspdf-layout.ts — A4 Codex page geometry shared between the generator and the PDF importer.pdf.tspdf.ts — render the printable Codex PDF.reed-solomon.tsBrowser-safe wrapper around the Reed-Solomon WASM exports.restore.test.tsrestore.test.ts — coverage for ChunkBuffer, parseRawScan, reconstructAndVerify.restore.tsrestore.ts — Peach Codex restoration library (popup-side).rs-loader.tsrs-loader.ts — load the Reed-Solomon erasure WASM module.scan-limits.test.tsscan-limits.test.ts — PB-26-207 resource bounds on the Codex scan path.scanner.tsscanner.ts — camera-based Aztec scanning for Codex restoration.
components/
GeneratorDrawer.test.tsGeneratorDrawer.tsxNoteRow.test.tsx@vitest-environment jsdomNoteRow.tsxNoteToolbar.tsxPairingBirds.tsxPairing birds — the two illustrated characters used on the pairing screens.PairingProRequired.tsxPairingQrCode.tsxPeachMark.tsxRecoveryRuneBackground.tsxRuneBackground.tsxRuneCanvas.tsxSyncModeSelector.test.tsx@vitest-environment jsdomSyncModeSelector.tsxSyncModeSelector — the one place the relay choice is made.
views/
Add.tsxAdoptVaultView.test.tsx@vitest-environment jsdomAdoptVaultView.tsxCodexGenerateView.test.tsx@vitest-environment jsdomCodexGenerateView.tsxPeach Codex — generation view.CodexRestoreView.test.tsx@vitest-environment jsdomCodexRestoreView.tsxPeach Codex — restoration view.contracts.test.tsx@vitest-environment jsdomEntry.totp-params.test.tsx@vitest-environment jsdomEntry.tsxExport.csv.test.ts@vitest-environment jsdomExport.tsxSignal-conditioned views in this file must use <Show>, never a signal-conditioned early return (
if (signal()) return <X/>).Health.test.tsx@vitest-environment jsdomHealth.tsxImport.test.tsx@vitest-environment jsdomImport.tsxSignal-conditioned views in this file must use <Show>, never a signal-conditioned early return — see Projects.md §4.1.InitialSyncView.test.tsx@vitest-environment jsdomInitialSyncView.tsxLock.test.tsx@vitest-environment jsdomLock.tsxNoteEditor.toHtml.test.ts@vitest-environment jsdomNoteEditor.tsxNotesEditor.tsxNotesMode.tsxNotesTOC.tsxOnboarding.tsxPairDevice.test.tsx@vitest-environment jsdomPairDevice.tsxPairDevice — the pairing surface, opened from the Settings → Sync card.Panic.tsxPasskeyApproval.tsxProCelebration.tsxRecoveryWordDisplay.tsxRecoveryWordEntry.tsxSettings.tsxTrashView.tsxvault-search.test.tsvault-search.tsVault.tsxview-test-utils.tsxzxcvbn-strength.test.tsLV-8: the @zxcvbn-ts replacement must score the master-password strength meter on the same 0-4 scale as the old zxcvbn, with dictionaries loaded (language-common is what keeps weak passwords from scoring optimistically).shared/
noise-core-wasm/
any is intentional throughout this module (L17/I3/QUA-010): import files are user-supplied external JSON whose schemas vary by source app and version (1Password CPG, Bitwarden, CXF, generic CSV).initial-sync.test.tsinitial-sync.tsmesh-peer-role.tsml.tsnoise-blake2s-kat.test.tsnoise-core.tsnoise-js.test.tsNoise NK auth proof regression test.noise-js.tsNoise NK initiator for browser-to-browser sync.noise-kk.test.tsnoise-small-order-dh.test.tsPB-26-014 follow-up — the JS-side DH boundaries in noise-js.ts mirror the Rust core's small-order X25519 blocklist (libhydrogen's contributory-behaviour list).noise.reject-zero-dh.test.tsPCH-02-009 regression tests — every Noise NK DH must reject an all-zero shared secret (low-order / identity peer point) instead of feeding it into the key schedule.pairing-dial.test.tspairing-dial.tsThe WebSocket seam every relay-facing Peach flow shares.pairing-handshake.tsShared pairing primitives used by the live relay-adoption path.pairing-invitation.test.tspairing-invitation.tspasskey-flags.tspasskey-flags.ts — single switch for the Firefox passkey content-script proxy.passkey-utils.test.tspasskey-utils.tspasskey-utils.ts — WebAuthn relying-party-id validation.recovery-word-list.tsrecovery-word-list.ts — 2048-word recovery word list for Peach vault recovery.recovery-words.checksum.test.tsT-002: BIP39 checksum rejectionrecovery-words.cross-platform.test.tsrecovery-words.integrity.test.tsT-001: BIP39 word-list integrityrecovery-words.kek.test.tsT-003: 128-bit prefix-KEK invariant (PCH-01-005 sibling)recovery-words.tsrecovery-words.ts — BIP39-compatible recovery word encoding for Peach vault recovery.rendezvous.test.tsrendezvous.tsshortcuts.test.ts@vitest-environment jsdomshortcuts.tsshortcuts.ts — keybinding schema, defaults, matcher, formatter.storage.tssync-identity.test.tssync-identity.tsSync identity — long-term X25519 keypair tied to the vault, not the device installation.sync-kk-transport.test.tssync-limits.tsSync trust + resource bounds — audit fixes HV-1 (timestamp clamp) and MV-3 (receive-path size bounds).sync-outcome.test.tssync-outcome.tsWhy a sync run ended, in a form both the service worker and the popup can name.sync-padding.test.tssync-padding.tsE7: frame padding at the relay boundary.sync-transport.tsWebSocket reconnect transport — Noise KK with both paired static keys.sync-types.tsVault sync — type definitions.sync.disconnect.test.tsT-020: WebSocket sync-disconnect handling (PCH-01-026 #9)types.tstypes.ts — cross-boundary types and the MessageType union.vault-adopt-snapshot.test.tsvault-adopt.test.tsvault-adopt.tstest/
tests/
fixtures/
history
f17d41070deachore: trim .kohignore to generic build/junk patterns4 months ago0dd9958ab928chore: tidy .kohignore after open-source prep4 months ago691c0326a8e9chore: open source prep — remove internal docs/drafts/audits, add security/ with public reports, GPL-3 LICENSE, public README + CONTRIBUTING, harden .gitignore, normalize test fixtures to example.com4 months ago95191a8b9de1docs: record PCH-01-002 BLAKE2s cross-repo integration + PCH-01-015 test coverage — browser v3.9.1 / android v2.2.9, byte-identical KAT proven, breaking wire change ships in lockstep (v3.9.1)4 months agofeaa8b521493chore: version bump 3.9.0 → 3.9.1 (manifests + package.json) + build Chrome/Firefox/Mobile — PCH-01-002 Noise BLAKE2s conformance (coordinated breaking wire change w/ peach-android v2.2.9) (v3.9.1)4 months ago71e94384a67dtest: de-flake CodexRestoreView PCH-01-015 test — poll until the real-WASM reconstruct dispatch drains so test async can't leak into the next test (v3.9.0)4 months ago83c1766c1a8ctest: PCH-01-002 cross-repo BLAKE2s KAT — export initHash/hkdf2 from noise-xx.ts + noise-js.ts, pin initHash + HKDF-BLAKE2s vectors byte-identical to peach-android CrossPlatformKATTest (proven matching) (v3.9.0)4 months ago4a07efb9b3a4fix: PCH-01-002 Noise initHash + hkdf2 derive over BLAKE2s to match the declared pattern name (noise-xx.ts + noise-js.ts) — standard HKDF-Expand via fresh HMAC-BLAKE2s per block (works around @stablelib HKDF/BLAKE2s restoreState bug), byte-identical to peach-android BouncyCastle; deterministic BLAKE2s handshake-hash KAT; fix stale snow comments; HMAC-SHA256 auth proof unchanged (v3.9.0)4 months ago4c7b8f1172f4test: PCH-01-015 CodexRestoreView passes untrimmed passphrase to RESTORE_FROM_CODEX — integration test drives the real PDF→ChunkBuffer→ready flow + whitespace-block case (v3.9.0)4 months agodf9ee6501da9docs: record PCH-01 integration outcome — findings + 003b + cross-repo HKDF separator, v3.9.0/android v2.2.8, 3206 tests, 002 deferred (v3.9.0)4 months agoca72ebdee815chore: version bump 3.8.1 → 3.9.0 (manifests + package.json) + build Chrome/Firefox/Mobile — PCH-01 hardening release; dist manifests at 3.9.0, ggwave new Function=0 (v3.9.0)4 months ago1260764d8263docs: record PCH-01-002 Noise BLAKE2s deferred pending Android coordination (v3.8.1)4 months agobc6cdb06f264fix: PCH-01-026 ten minor code-quality items — remove dead save.ts MutationObserver; ChunkBuffer.add never-throws via tryBase64UrlToBytes; generate.ts step renumber; sum per-stripe t for PDF totalExpected; parseCSV single-parse {entries,totalItems}; chunk range-before-duplicate; reed-solomon try/finally frees; surface+close on sync WS error (drop dead errors array); drop SAVE_NOTE as-any cast (026-06 already resolved by PCH-01-019) (v3.8.1)4 months ago0511f34134fcfix: PCH-01-024 update stale chirp-handshake SAS warning to reflect the mandatory extension-side gateOnSAS gate; pin the open item to Android; add gateOnSAS regression test (v3.8.1)4 months ago483a5e0d75c5fix: PCH-01-023 coarsen vault-history snapshot entryCount to a size bucket — plaintext field no longer leaks exact vault size or per-write deltas; UI reads 'up to N' (v3.8.1)4 months ago00ca18f952cedocs: PCH-01-022 correct stale non-extractable claim in deriveSyncSigningKeypair doc — Ed25519 signing key is intentionally extractable for JWK public-key recovery (v3.8.1)4 months ago2c9a3fd05dadfix: PCH-01-021 gate clipboard alarm clear on the clear-owed flag (CLEAR_HASH_KEY) — stale alarm on a cold worker skips offscreen churn; dead bookkeeping is now load-bearing (v3.8.1)4 months ago3867c5eae0a1docs: PCH-01-005 document recovery-escrow 128-bit prefix-KEK construction at rootKeyToWords, wordsToRootKeyMaterial, generateAndWrapRootKey (v3.8.1)4 months ago750fbd091ff3fix: PCH-01-020 pin expected ciphertext so unlock self-test is a real KAT — add scripts/generate-kat.mjs + constant-time compare against committed vector in self-test.ts (v3.8.1)4 months agoda4b30abc2c9fix: PCH-01-019 thread otpauth algorithm/digits/period through TOTP generation + storage — new optional totpAlgorithm/Digits/Period on entry (backward-compatible bare-seed default SHA1/6/30), import + sanitizeEntryDraft whitelist + GET_ENTRY_FOR_FILL (v3.8.1)4 months agob2e695e079b3fix: PCH-01-018 gate destructive message types (DESTROY_VAULT/CLEAR_VAULT_ENTRIES/RESTORE_VAULT_SNAPSHOT/RESTORE_FROM_CODEX) to extension-page senders — content-script XSS can no longer escalate to vault destruction (v3.8.1)4 months ago32a9f43d7d6bfix: PCH-01-017 validate verifyCode pattern, finite timestamp, and vaultBlob length in handleRestoreFromCodex before metadata reaches storage/sync-version (v3.8.1)4 months agob9da7a952686fix: PCH-01-016 run sanitizeCanary + new bounded sanitizeTags inside sanitizeEntryDraft (and restore path) — closes MV-6 whitelist bypass on batch-add/import (v3.8.1)4 months agoc85d657224ccfix: PCH-01-015 Codex restore passes untrimmed passphrase, trims only for the emptiness check (Lock.tsx parity) — master password with surrounding whitespace now restores (v3.8.1)4 months ago5e75cc36d81afix: PCH-01-014 clamp Codex PDF page count (MAX_PDF_PAGES=250) and per-page render dimensions (A4-at-max-scale budget) — caps decode work a crafted PDF can demand (v3.8.1)4 months ago8989d7885b21fix: PCH-01-013 enforce 16/32 fingerprint length before payload comparison in reconstructAndVerify — empty/short declared fingerprint no longer passes trivially (AUD-004 parity) (v3.8.1)4 months ago3d3cfda6a120fix: PCH-01-012 require Number.isInteger on i/t/s/S in parseRawScan and parseChunkEnvelope — reject NaN/Infinity/fractional chunk indices at parse time (v3.8.1)4 months agoa384d9d6d53dfix: PCH-01-011 cap envelope stripe count S at MAX_STRIPE_COUNT (64) at accept time — prevents O(S) allocation DoS on Codex restore from a crafted code (v3.8.1)4 months ago95f03cf1813bfix: PCH-01-010 deriveShardCounts rejects dataShards above MAX_DATA_SHARDS_PER_STRIPE — makes the stripe-inversion unique, prevents wedged restore from a crafted total (v3.8.1)4 months agocdac7526ea77fix: PCH-01-009 rehydrate rootKey in unlockWithKey biometric path via deriveRootKeyFromDerivedKey — sync + recovery-word access work after biometric unlock (v3.8.1)4 months ago14cea33605e5fix: PCH-01-008 re-escrow new derived key to chrome.storage.session after changePassword + changePasswordWithNewKey swaps — SW restore survives a password change (v3.8.1)4 months agode64511b0d62fix: PCH-01-007 gate three document-level inject keydown handlers on e.isTrusted — page-synthesised keys can no longer drive inline selection/fill (v3.8.1)4 months ago0efc6954e26cfix: HKDF null-byte separator in deriveEntryKey per-entry sync info (entryId\x00sync-entry-v1) — coordinated wire change with peach-android (brief PCH-01-005) (v3.8.1)4 months ago048fd9fcc6defix: PCH-01-003b bind NK post-handshake auth proof to Noise handshakeHash on prover + verifier — extension-only round, unilateral-safe (Android uses SAS, no auth proof) (v3.8.1)4 months agocf887cb18434fix: subnet probe pins responder static before Noise XX msg3 so a scanned LAN host never receives our long-term identity (report PCH-01-003 / brief PCH-01-018) (v3.8.1)4 months agoe37a085ed620fix: PCH-01-004 move peach_chirp_device_id to chrome.storage.local with first-read sync migration — prevents cross-profile sync-identity collision (v3.8.1)4 months ago7dfe6433a0edfix: PCH-01-025 CSS.escape + try/catch label[for] selector in detect.ts — prevents autofill abort on legal CSS-special ids (v3.8.1)4 months ago12953927f2d5fix: PCH-01-006 GET_ENTRY_FOR_EDIT origin re-validation mirroring MV-1 fill path; tab-context domain gate + explicitSummon escape hatch, popup path unbroken (v3.8.1)4 months agocf11fa1a0223fix: PCH-01-001 NFC-normalize export/restore passphrase at peachPayload deriveKey chokepoint + raw fallback on import (v3.8.1)4 months ago212e1bdc1142draft: fixes integration contract + README — brief↔report numbering map, per-file integration order, deferral flags, ~63-test estimate4 months ago7c15a4dd2f38draft: PCH-01-002..005, 007..024, 025, 026(×10) + HKDF-separator patch drafts — all remaining report findings with verified hunks and tests4 months agof1c260cdf8efdraft: PCH-01-001 + PCH-01-006 patches — NFC export KDF chokepoint and GET_ENTRY_FOR_EDIT origin re-validation4 months ago05b3da635643add internal review notes — full static review of crypto/autofill/sync/codex: (export KDF NFC gap, GET_ENTRY_FOR_EDIT origin check)4 months agoab73fa45ab62docs: session notes — v3.8.1 MV-10 session record (tabs perm + ggwave WAR removed, both manifests, deferred Fable review, promotion pending) (v3.8.1)4 months ago114cba28587fchore: version bump 3.8.0 → 3.8.1 (manifests + package.json) + build Chrome/Firefox/Mobile; dist manifests confirm tabs removed and ggwave WAR removed, ggwave.js still ships for popup import (v3.8.1)4 months agoa509a3a584a6fix: MV-10b remove ggwave web-accessible-resource from both manifests — ggwave is loaded only from the popup (extension page) via import(chrome.runtime.getURL); no content script or page needs it, so WAR (matches <all_urls>) was unnecessary and enabled extension fingerprinting (v3.8.1)4 months ago93a2a4e8d471fix: MV-10a remove redundant tabs permission from both manifests — url/title/favicon already granted by <all_urls> host_permissions; query/sendMessage/create/event-listener call sites need no tabs perm (v3.8.1)4 months ago892970c9aa96docs: record audit-fix integration outcome — findings + 8 UI items, v3.8.0, 3141 tests; android MF-4 parity v2.2.4 (v3.8.0)4 months agoc3aa9b96509echore: version bump 3.7.1 → 3.8.0 (security hardening release) + build Chrome/Firefox/Mobile; offscreen Chrome-only, ggwave new Function=0 (v3.8.0)4 months agobdf8177948ccfeat: UI-5 view-recovery-words requires master password re-entry (GET_RECOVERY_WORDS{password}); maps wrong_password/recovery_not_setup inline, reveals 12-word grid on success4 months ago
details
Peach
A free, open source, local-first password manager for Chrome, Firefox, and Android.
Peach encrypts your vault on your device. No hosted vault, subscription, or account is required to use it.
Features
- Passwords, cards, and secure notes — keep your private data together in one encrypted vault
- Inline autofill — fill and save credentials without leaving the page
- TOTP built in — generate two-factor codes without a separate authenticator
- Password health — find weak, reused, and exposed passwords
- Portable backups — export and restore with PeachScript or a
.peachfile
Peach Pro adds:
- Peach Sync — end-to-end encrypted sync across paired devices
- Passkeys — save and use passkeys in Chrome and Firefox
- Peach Codex — print an encrypted, scannable backup of your vault
- Advanced vault health, Canary Entries, and duress tools
See the Peach website for current availability and Pro details.
Install
Open Source
Peach is released under the GPL v3. This repository contains Peach's Chrome and Firefox browser extensions. Android is maintained separately.
The source is hosted on Kepr, Asha Software's version control platform.
Security
Vault data is encrypted with AES-256-GCM and protected by Argon2id key derivation. Peach Sync authenticates paired devices and encrypts data in transit.
Implementation details live alongside the code:
Building
bun install --frozen-lockfile
bun run build
Builds are written to dist-chrome/ and dist-firefox/.
Built by Asha Software · [email protected]