peach-browser
A free, open source, local-first password manager for Chrome, Firefox, and Android.
TypeScript
timeline
atlas409 files
crypto-core/
fixtures/
public/
codex/
scripts/
build-noise-core.mjsbuild-peachscript.pyBuild PeachScript-Regular.otf — 256 historical-runic glyphs.check-cross-client-adoption.test.tscheck-cross-client-sync.mjscheck-extension-surface.mjscheck-noise-core.mjsPB-26-003: verify the committed Noise WASM still matches crypto-core source.check-sw-static-imports.mjsFails the build if any chunk reachable from the MV3 service worker still contains a runtime
import().ci.tsclean-chrome-dist.mjsclean-firefox-artifacts.mjsgenerate-kat.mjsgenerate-kat.mjs — recompute the pinned ciphertext for self-test.ts (PCH-01-020).manifest-parity.test.tsPB-26-610 — the source manifests are security-reviewed; the built manifests are what ships.package-source.test.tspackage-source.tsrelease-firefox.tsrelease-gate.test.tsrelease-gate.tsPB-26-210: Release browser-gate validation.release-lib.test.tsscripts/release-lib.test.ts PB-26-211: release tool hardening — security tests for the argv-based runner.release-lib.tsscripts/release-lib.ts Shared argv-based runner for release tooling (PB-26-211).release.test.tsrelease.tsroot-derivation-gate.test.tsCampaign task 2.4 — no shipping source may derive device key material from the vault root.run-release-browser-gate.tstest-firefox-passkeys.mjstest-firefox-sender-context.mjsweb-accessible-resources.test.tssrc/
background/
aes.test.tsaes.tsaes.ts — AES-256-GCM encrypt/decrypt primitives for vault storage.alarms.test.tsalarms.tsclipboard.double-failure.test.tsT-037: clipboard double-failure / alreadyWritten pathclipboard.test.tsclipboard.tsClipboard write + reliable auto-clear — audit fix HV-2.codex-handlers.test.tsTests for src/background/codex-handlers.ts.codex-handlers.tscodex-handlers.ts — message handlers that back the Peach Codex flow.commands.test.tscommands.tsKeyboard command handler — routing for summon-inline: 1.device-identity.test.tsdevice-identity.tsLocal-device identity helpers.entry.lock-port.test.tsThe lock-on-close onConnect listener accepts only our nonce'd "popup-<uuid>" port from the extension page and ignores anything else.entry.tshealth.test.tshealth.tshealth.ts — Pro advanced vault health analysis.license.tslicense.verification.test.tsT-009: License Ed25519 signature verificationlocked-sync-spool.test.tslocked-sync-spool.tsmesh-relay-listener.test.tsmesh-relay-listener.tsmessage-policy.test.tsmessage-policy.tsmessages.adversarial.test.tsmessages.adversarial.test.ts — Layer 3 §3.3 adversarial message handler tests.messages.autolock-refresh.test.tsPB-26-107: passive page traffic must not refresh the auto-lock timer.messages.batch-sanitize.test.tsT-008: PCH-01-016 batch-add canary/tag sanitizationmessages.create-vault-from-root-key.test.tsmessages.edit-origin.test.tsT-022: GET_ENTRY_FOR_EDIT via sender.url + locked-vault AUTOFILL_QUERYmessages.entry-write-origin.test.tsPB-26-106: content-script entry mutations must be bound to the entry's own domain set.messages.passkey-offer-decline.test.tsPB-26-109: the passkey offer-decline handler is page-relay, so any page's content script may send it.messages.test.tsmessages.tsmessages.ts — the only background message handler.ml.predictbatch.test.tsT-030: ml.ts predictBatch — batch sizes, softmax stability with extreme weightsml.tsnotes.test.tsoffscreen.htmloffscreen.tsOffscreen document script — audit fix HV-2c.pair-secrets.test.tspair-secrets.tspair-secrets.ts — PB-26-213: the reusable rendezvous secret must never sit in plaintext in chrome.storage.local.paired-devices.test.tspaired-devices.tsPaired-device registry — v3 sync.passkey-chrome-ceremony.test.tspasskey-chrome-ceremony.test.ts — covers the Chrome chrome.webAuthenticationProxy ceremony path that the Firefox-proxy test file does NOT exercise.passkey-crypto.test.tspasskey-crypto.tspasskey-deny-on-close.test.tspasskey-deny-on-close.test.ts — M8/COR-009passkey-firefox-proxy.test.tspasskey-firefox-proxy.test.ts — covers the v2.12.0 Firefox content-script proxy path.passkey.ed25519.test.tsT-015: Ed25519 passkey round-trippasskey.tspending-adoption-holder.test.tspending-adoption-holder.tspending-vouched-devices.test.tspending-vouched-devices.tsPending vouched devices — audit fix MV-7.recovery-pending.test.tsrecovery-pending.tsBackground-owned state set while the user has just created or rotated a vault identity and is confirming their recovery words.recovery-words.test.tsrecovery.adversarial.test.tsrecovery.adversarial.test.ts — Layer 3 §3.2 adversarial recovery words tests.relay-adoption-bg.test.tsrelay-adoption-bg.tsself-test.test.tsself-test.tsself-test.ts — Known-Answer Test (KAT) for the Peach crypto stack.storage-access.test.tsstorage-access.tsPB-26-203: the session-key escrow is only as trustworthy as the boundary around chrome.storage.session.sync-alarm.test.tssync-alarm.tssync-alarm.ts — the 10-minute background sync tick.sync-alerts.test.tssync-alerts.tsPending sync security alerts.sync-coordinator.test.tssync-coordinator.tsVault sync — Phase 2 manifest-diff coordinator.sync-generation.test.tsThe §11 secure-reset contract: the durable generation record, the six states, create-on-miss refusal, archival by generation, crash recovery at every step, and the sync gate.sync-generation.tsThe durable Sync-generation record and its state machine (protocol §11).sync-runner.test.tssync-runner.tsProduction sync runner — composes the live vault adapter, WebSocket transport, and coordinator into the function the dispatcher injects via
setSyncRunner.sync-settings.test.tssync-settings.tssync-static.test.tsIV.7 — Static safety assertions for vault sync.sync-trigger.test.tssync-trigger.tssync-trigger.ts — central sync dispatcher.sync-vault-adapter.test.tssync-vault-adapter.tsProduction adapter that backs runSyncInitiator with the live vault.vault-createVaultFromRootKey.test.tsvault-history.test.tsVault history tests.vault.adversarial.test.tsvault.adversarial.test.ts — Layer 3 §3.1 adversarial vault tests.vault.card-decline.test.tsPB-26-108: declined-card metadata must not be offline-enumerable.vault.consolidate-passkeys.test.tsT-023: vault.consolidatePasskeyEntries — passkey merge with lastUsed rankingvault.corruption.test.tsT-018: Vault corruption vs wrong-password discrimination (M7/COR-007)vault.duress-adoption.test.tsvault.entry-id-namespace.test.tsvault.hibp-padding.test.tsPCH-02-007 regression tests — the HIBP k-anonymity range request must ask for response padding, and the parser must stay correct on padded responses.vault.purge-trash.test.tsT-024: vault.purgeExpiredTrash — retention cutoff boundaryvault.rotate-sync-identity.test.tsT-016: rotateSyncIdentity — new root key, cleared peers, recovery pendingvault.session-escrow.test.tsvault.sync-clamp.test.tsUnit tests for HV-1 — sync timestamp clamp + remote-mutation alerts.vault.test.tsvault.tombstone-ledger.test.tsvault.tsvault.ts — sole owner of vault state and chrome.storage vault keys.vault.update-entry-sanitize.test.tsPCH-02-001 regression tests — UPDATE_ENTRY patch path must route canary/tags/passkey through the same sanitizers the add/restore/sync funnels use (sanitizeCanary / sanitizePasskey / sanitizeTags).content/
passkey-toast/
crypto/
argon2.test.tsargon2.tsargon2id.kat.test.tsT-019: Argon2id known-answer test (KAT) + parameter assertioncrypto.test.tsdecompression-bomb.test.tsMV-4: decompression-bomb output bounds on the zstd and pako legs.official-vectors.test.tspeachPayload.binaryreader-bounds.test.tsPCH-02-008 regression tests — BinaryReader must bound every read and fail with the decoder's existing PAYLOAD_TOO_SHORT code on truncated input.peachPayload.bomb.test.tsT-005: peachPayload declared-length decompression bomb (MV-4)peachPayload.test.tspeachPayload.tspeachPayload.ts — binary payload format shared by PeachScript and the Peach QR matrix code (spec §2).peachScript.bounds.test.tsPB-26-208: PeachScript normalization before limits.peachScript.test.tspeachScript.tspeachScript.ts — PeachScript encoding/decoding.totp.rfc6238.test.tsT-004: TOTP RFC 6238 known-answer vectorstotp.test.tstotp.tszstd.tsThin wrapper around @bokuweb/zstd-wasm that defers WASM load until the first compress/decompress call and memoises the init promise.
popup/
codex/
aztec.tsaztec.ts — Aztec 2D barcode generation with round-trip verification.browser-bundle.test.tscodex.adversarial.test.tscodex.adversarial.test.ts — Layer 3 §3.4 adversarial Codex tests.codex.multistripe.test.tsT-017: Codex multi-stripe round-tripcodex.suite.test.tscodex.suite.test.ts — cross-cutting regression suite for the Codex pipeline.codex.test.tsconfirmation.tsPick 3 distinct positions in [1, 12] for the recovery-words confirmation gate.erasure.tserasure.ts — Reed-Solomon erasure coding around the WASM library.generate.test.tsgenerate.tsgenerate.ts — full Codex generation pipeline.helpers.tshelpers.ts — shared utilities for Codex generation and restoration.node-wasm.tsNode-only WASM byte loader for Vitest.pdf-import.clamp.test.tspdf-import.sandbox.test.tsT-007: MV-9 pdf.js sandbox flags regression testpdf-import.test.tspdf-import.test.ts — coverage for the testable surface of the PDF import path.pdf-import.tspdf-import.ts — restore from a Codex PDF instead of a camera scan.pdf-layout.tspdf-layout.ts — A4 Codex page geometry shared between the generator and the PDF importer.pdf.tspdf.ts — render the printable Codex PDF.reed-solomon.tsBrowser-safe wrapper around the Reed-Solomon WASM exports.restore.test.tsrestore.test.ts — coverage for ChunkBuffer, parseRawScan, reconstructAndVerify.restore.tsrestore.ts — Peach Codex restoration library (popup-side).rs-loader.tsrs-loader.ts — load the Reed-Solomon erasure WASM module.scan-limits.test.tsscan-limits.test.ts — PB-26-207 resource bounds on the Codex scan path.scanner.tsscanner.ts — camera-based Aztec scanning for Codex restoration.
components/
GeneratorDrawer.test.tsGeneratorDrawer.tsxNoteRow.test.tsx@vitest-environment jsdomNoteRow.tsxNoteToolbar.tsxPairingBirds.tsxPairing birds — the two illustrated characters used on the pairing screens.PairingProRequired.tsxPairingQrCode.tsxPeachMark.tsxRecoveryRuneBackground.tsxRuneBackground.tsxRuneCanvas.tsxSyncModeSelector.test.tsx@vitest-environment jsdomSyncModeSelector.tsxSyncModeSelector — the one place the relay choice is made.
views/
Add.tsxAdoptVaultView.test.tsx@vitest-environment jsdomAdoptVaultView.tsxCodexGenerateView.test.tsx@vitest-environment jsdomCodexGenerateView.tsxPeach Codex — generation view.CodexRestoreView.test.tsx@vitest-environment jsdomCodexRestoreView.tsxPeach Codex — restoration view.contracts.test.tsx@vitest-environment jsdomEntry.totp-params.test.tsx@vitest-environment jsdomEntry.tsxExport.csv.test.ts@vitest-environment jsdomExport.tsxSignal-conditioned views in this file must use <Show>, never a signal-conditioned early return (
if (signal()) return <X/>).Health.test.tsx@vitest-environment jsdomHealth.tsxImport.test.tsx@vitest-environment jsdomImport.tsxSignal-conditioned views in this file must use <Show>, never a signal-conditioned early return — see Projects.md §4.1.InitialSyncView.test.tsx@vitest-environment jsdomInitialSyncView.tsxLock.test.tsx@vitest-environment jsdomLock.tsxNoteEditor.toHtml.test.ts@vitest-environment jsdomNoteEditor.tsxNotesEditor.tsxNotesMode.tsxNotesTOC.tsxOnboarding.tsxPairDevice.test.tsx@vitest-environment jsdomPairDevice.tsxPairDevice — the pairing surface, opened from the Settings → Sync card.Panic.tsxPasskeyApproval.tsxProCelebration.tsxRecoveryWordDisplay.tsxRecoveryWordEntry.tsxSettings.tsxTrashView.tsxvault-search.test.tsvault-search.tsVault.tsxview-test-utils.tsxWhatsNew.tsxzxcvbn-strength.test.tsLV-8: the @zxcvbn-ts replacement must score the master-password strength meter on the same 0-4 scale as the old zxcvbn, with dictionaries loaded (language-common is what keeps weak passwords from scoring optimistically).shared/
noise-core-wasm/
any is intentional throughout this module (L17/I3/QUA-010): import files are user-supplied external JSON whose schemas vary by source app and version (1Password CPG, Bitwarden, CXF, generic CSV).initial-sync.test.tsinitial-sync.tslegacy-identity-derivation.test-support.tsRoot→device key derivation, retained for tests only — campaign task 2.4.mesh-peer-role.tsml.tsnoise-blake2s-kat.test.tsnoise-core.tsnoise-js.test.tsNoise NK auth proof regression test.noise-js.tsNoise NK initiator for browser-to-browser sync.noise-kk.test.tsnoise-small-order-dh.test.tsPB-26-014 follow-up — the JS-side DH boundaries in noise-js.ts mirror the Rust core's small-order X25519 blocklist (libhydrogen's contributory-behaviour list).noise.reject-zero-dh.test.tsPCH-02-009 regression tests — every Noise NK DH must reject an all-zero shared secret (low-order / identity peer point) instead of feeding it into the key schedule.pairing-dial.test.tspairing-dial.tsThe WebSocket seam every relay-facing Peach flow shares.pairing-handshake.tsShared pairing primitives used by the live relay-adoption path.pairing-invitation.test.tspairing-invitation.tspasskey-flags.tspasskey-flags.ts — single switch for the Firefox passkey content-script proxy.passkey-utils.test.tspasskey-utils.tspasskey-utils.ts — WebAuthn relying-party-id validation.recovery-word-list.tsrecovery-word-list.ts — 2048-word recovery word list for Peach vault recovery.recovery-words.checksum.test.tsT-002: BIP39 checksum rejectionrecovery-words.cross-platform.test.tsrecovery-words.integrity.test.tsT-001: BIP39 word-list integrityrecovery-words.kek.test.tsT-003: 128-bit prefix-KEK invariant (PCH-01-005 sibling)recovery-words.tsrecovery-words.ts — BIP39-compatible recovery word encoding for Peach vault recovery.release-notes.test.tsrelease-notes.tsCurated release history and post-update notice selection.rendezvous.test.tsrendezvous.tsshortcuts.test.ts@vitest-environment jsdomshortcuts.tsshortcuts.ts — keybinding schema, defaults, matcher, formatter.storage.tssync-entry-envelope.kat.test.tssync-identity.test.tssync-identity.tsSync identity — vault-scoped primitives.sync-kk-transport.test.tssync-limits.tsSync trust + resource bounds — audit fixes HV-1 (timestamp clamp) and MV-3 (receive-path size bounds).sync-outcome.test.tssync-outcome.tsWhy a sync run ended, in a form both the service worker and the popup can name.sync-padding.test.tssync-padding.tsE7: frame padding at the relay boundary.sync-transport.tsWebSocket reconnect transport — Noise KK with both paired static keys.sync-types.tsVault sync — type definitions.sync.disconnect.test.tsT-020: WebSocket sync-disconnect handling (PCH-01-026 #9)types.tstypes.ts — cross-boundary types and the MessageType union.vault-adopt-snapshot.test.tsvault-adopt.test.tsvault-adopt.tstest/
tests/
fixtures/
history
8293ed4e457ebefore Firefox AMO release automation5 months agoc849fd6cfc3erotate private key in gen_license.py (v3.6.104)5 months agof5442cc9c8dcrotate Ed25519 public key — old key was compromised (v3.6.104)5 months agoddff99b7ce87before Ed25519 public key rotation — old key compromised5 months agof5a90484ee76chore: phase 4 verification gate — tsc clean, all three targets build, 2976/2976 tests pass (v3.6.103)5 months ago93a60129744atest: add IV.4 coordinator (HELLO fields, equal-version, clock skew), IV.5 dispatcher, IV.7 static safety assertions; fix test fixtures for new type shapes (v3.6.103)5 months agod14b4d0b8ef7fix: productionSyncRunner returns {ok:false,error} on vault locked instead of throwing; SyncRunResult becomes discriminated union (v3.6.102)5 months ago1969735e961dfix: mDNS onCleanup registered synchronously before dynamic import to avoid SolidJS owner capture miss (v3.6.101)5 months ago7c09d257bea1fix: mDNS peer discovery — look up device in registry and update lastKnownIp before firing TRIGGER_SYNC (v3.6.100)5 months agoc49affb655fcfix: vault_id uses full 32-byte BLAKE3 digest (64 hex chars), up from truncated 8-byte/16-char (v3.6.99)5 months agoc9a5d79ae31efix: add getVaultVersion, addEntryDirect, updateEntryDirect, deleteEntryDirect to vault.ts (v3.6.98)5 months ago5fa72ee8d048fix: per-entry AES-GCM key isolation — HKDF info = entryId + 'sync-entry-v1' instead of shared salt (v3.6.97)5 months ago3f266d2afda8fix: SYNC_HELLO adds version + deviceTime; clock skew warning; equal-version no-op; SYNC_DONE carries counts; coordinator no longer owns session close (v3.6.96)5 months ago557ffe75270bfix: sync trigger — filter to trustSource:'direct' only; persist peach_last_sync_result after successful sync (v3.6.95)5 months ago21d3f786ea14fix: device registry — move from chrome.storage.sync to chrome.storage.local with one-time migration; add peach_last_sync_result storage (v3.6.94)5 months agob92e86329db5chirp-sync master document verification — findings documented, fix phase begins5 months agodf0c022cdbbdchirp-sync master document verification — read-only phase begins5 months agof5e9dc849e45update session notes with v3.6.93 outcome5 months agof4aa4137367afix scale detection to use best-match not first-match, add reliable E2E Playwright test for PDF import5 months ago7a863ef97d46before pro celebration settings fix + codex restore debug iteration5 months ago566a2cd79953fix: Separate Pro activation and replay animations (v3.6.91)5 months agoc5af595106b5before peach star animation parity fix5 months ago44fc6080ab15feat: Enable chirp mesh device manifests (v3.6.90)5 months ago14d9d4bcab05before device manifest mesh propagation5 months ago78cf60b2e953feat: mDNS peer-discovery trigger — startMDNSListener subscribes to native SyncPlugin peerDiscovered events, fires TRIGGER_SYNC reason 'mdns' when app is foregrounded; wired into App.tsx native onMount with onCleanup; 6 listener tests; full suite 2954/2954 (v3.6.89)5 months agocfc7e8821df9feat: productionSyncRunner + startup registration — composes adapter+transport+coordinator with cached-IP fast path and /24 subnet fallback; setSyncRunner wired in entry.ts start(); hydratePersistedSyncState rehydrates lastSyncAt across SW restarts; 13 runner+persistence tests, full suite 2948/2948 (v3.6.88)5 months agoef5de9313daffeat: ChirpSyncVaultAdapter — production adapter backing runChirpSyncInitiator; per-entry AES-GCM envelope under HKDF-derived sync entry key; 13 tests covering vault_id, manifests, encrypt/decrypt round-trip, tombstone merge, id-swap rejection, locked-vault errors (v3.6.87)5 months ago21a0838bcb4evault: applyMergedRemoteEntries — last-write-wins merge for remote entries+tombstones, no fireSyncTrigger to avoid feedback loop (v3.6.86)5 months ago0c7fd088b99cbefore chirp sync production runner — adapter + runner + registration + mDNS listener5 months agoba0337d1a873docs: peach-post-audit-fix-report-v3.6.85.md — per-fix detail, koh log, deferred follow-ups5 months agoa449b27eddbbtest: align contracts.test active-card expectation with Settings-opens-to-card-I (v3.6.85)5 months ago0f3e59b5732atest: Codex regression suite — chunk/stripe constants, planning boundaries, deriveShardCounts, AztecCodeReader regression guards, browser-bundle hygiene, module load gate (v3.6.84)5 months agof86ad225e14efeat: add email field to PeachScript v3 export format — bump payload version, add flags2 byte for login entries, preserve v1/v2 import compatibility (v3.6.83)5 months agof5e09bec3b47feat: wire vault-change, popup-foreground, and manual 'Sync now' triggers — TRIGGER_SYNC + GET_SYNC_STATE messages, ChirpSync Sync now button + result flash (v3.6.82)5 months ago8ad0d17ee9b4feat: add sync-trigger.ts — central sync dispatcher with syncInFlight guard, markLastSyncedAt wiring, state broadcast, dependency-injected runner (v3.6.81)5 months agocf02cd217e1ffix: TOTP picker shows empty-state toast when no TOTP entries for domain; drop 'mobile apps' from Onboarding Pro list (v3.6.80)5 months agoe073840d9292fix: normalizeEntry drops email + additionalUrls on vault read — add both fields to base object, add lock/unlock round-trip tests (v3.6.79)5 months ago95a4903d1acfbefore post-audit fixes — SEV-1 through INFO findings from peach-post-audit-fix-brief.md5 months ago7b06158e69cerestore favicon for visited sites, globe still falls back to initials chip5 months agodbe895fe63e4bump to v3.6.785 months ago727326aea9d8pro activation — card fan, shake, sparkles, ambient dust, easter egg triggers5 months ago2209ccb8d790fix feedback chip glow clipping in stack card body5 months ago5c03d53d4f1dremove Chrome favicon API — always show colored initials chip5 months ago4d29415ccbb6before pro activation celebration — fan, shake, sparkles5 months ago162fa5233f15bump to v3.6.775 months agof7a2710b3f67open settings to card I (Peach Pro) instead of card II (Protection)5 months agod04cd3af06cepre-public audit v3.6.76 — read-only findings5 months agobda660750c74pre-public audit v3.6.76 — read-only phase begins5 months ago5da6bebe36a8settings polish — Peach Pro card first in stack and renumber I-VII; drop Mobile apps from Pro features (mobile is free); rename 'Vault Health' row to 'Advanced Vault Health' (v3.6.76)5 months agobb40658c5731fix Codex PDF restore — accept v3 envelopes (generator emits v3, not v2); extract cellRectFor / decodeAztecFromArgb / imageDataToArgb; add 16 tests including 36-code full-page grid integration round-trip5 months ago
details
Peach
A free, open source, local-first password manager for Chrome, Firefox, and Android.
Peach encrypts your vault on your device. No hosted vault, subscription, or account is required to use it.
Features
- Passwords, cards, and secure notes — keep your private data together in one encrypted vault
- Inline autofill — fill and save credentials without leaving the page
- TOTP built in — generate two-factor codes without a separate authenticator
- Password health — find weak, reused, and exposed passwords
- Portable backups — export and restore with PeachScript or a
.peachfile
Peach Pro adds:
- Peach Sync — end-to-end encrypted sync across paired devices
- Passkeys — save and use passkeys in Chrome and Firefox
- Peach Codex — print an encrypted, scannable backup of your vault
- Advanced vault health, Canary Entries, and duress tools
See the Peach website for current availability and Pro details.
Install
Open Source
Peach is released under the GPL v3. This repository contains Peach's Chrome and Firefox browser extensions. Android is maintained separately.
The source is hosted on Kepr, Asha Software's version control platform.
Security
Vault data is encrypted with AES-256-GCM and protected by Argon2id key derivation. Peach Sync authenticates paired devices and encrypts data in transit.
Implementation details live alongside the code:
Building
bun install --frozen-lockfile
bun run build
Builds are written to dist-chrome/ and dist-firefox/.
Built by Asha Software · [email protected]