peach-browser
A free, open source, local-first password manager for Chrome, Firefox, and Android.
TypeScript
timeline
atlas292 files
public/
codex/
fonts/
models/
scripts/
build-peachscript.pyBuild PeachScript-Regular.otf — 256 historical-runic glyphs.ci.tsclean-chrome-dist.mjsclean-firefox-artifacts.mjsgenerate-kat.mjsgenerate-kat.mjs — recompute the pinned ciphertext for self-test.ts (PCH-01-020).package-amo-source.shpackage-amo-source.sh — produce peach-3.6.65-source.zip for AMO review.release-firefox.tsrelease.tssetup-chrome-release.sh───────────────────────────────────────────────────────────────────────────── Peach — Chrome Web Store Release Setup Run this once to configure Chrome publishing.sync-chrome-dist.mjs
src/
background/
aes.test.tsaes.tsaes.ts — AES-256-GCM encrypt/decrypt primitives for vault storage.alarms.test.tsalarms.tschirp-identity.test.tschirp-identity.tsLocal-device identity helpers for the chirp-sync architecture.chirp-sync-coordinator.test.tschirp-sync-coordinator.tsChirp Sync — Phase 2 manifest-diff coordinator.chirp-sync-runner.test.tschirp-sync-runner.tsProduction sync runner — composes the live vault adapter, WebSocket transport, and coordinator into the function the dispatcher injects via
setSyncRunner.chirp-sync-static.test.tsIV.7 — Static safety assertions for Chirp Sync.chirp-sync-vault-adapter.test.tschirp-sync-vault-adapter.tsProduction adapter that backs runChirpSyncInitiator with the live vault.clipboard.test.tsclipboard.tsClipboard write + reliable auto-clear — audit fix HV-2.codex-handlers.test.tsTests for src/background/codex-handlers.ts.codex-handlers.tscodex-handlers.ts — message handlers that back the Peach Codex flow.commands.tsKeyboard command handler — routing for summon-inline: 1.entry.lock-port.test.tsLV-5: the lock-on-close onConnect listener accepts only our popup port (legacy bare "popup" or nonce'd "popup-<uuid>") and ignores anything else.entry.tshealth.test.tshealth.tshealth.ts — Pro advanced vault health analysis.license.tsmessages.adversarial.test.tsmessages.adversarial.test.ts — Layer 3 §3.3 adversarial message handler tests.messages.test.tsmessages.tsmessages.ts — the only background message handler.ml.tsnotes.test.tsoffscreen.htmloffscreen.tsOffscreen document script — audit fix HV-2c.paired-devices.test.tspaired-devices.tsPaired-device registry — v3 chirp-sync.passkey-chrome-ceremony.test.tspasskey-chrome-ceremony.test.ts — covers the Chrome chrome.webAuthenticationProxy ceremony path that the Firefox-proxy test file does NOT exercise.passkey-crypto.test.tspasskey-crypto.tspasskey-deny-on-close.test.tspasskey-deny-on-close.test.ts — M8/COR-009passkey-firefox-proxy.test.tspasskey-firefox-proxy.test.ts — covers the v2.12.0 Firefox content-script proxy path.passkey.tspending-vouched-devices.tsPending vouched devices — audit fix MV-7.recovery-pending.tsPersistent flag set while the user has just created a vault and is reading their 12 recovery words but has not yet typed the 3 confirmation words.recovery-words.test.tsrecovery.adversarial.test.tsrecovery.adversarial.test.ts — Layer 3 §3.2 adversarial recovery words tests.self-test.test.tsself-test.tsself-test.ts — Known-Answer Test (KAT) for the Peach crypto stack.sync-alerts.tsPending sync alerts — audit fix HV-1b.sync-trigger.test.tssync-trigger.tssync-trigger.ts — central sync dispatcher.vault-history.test.tsVault history tests.vault.adversarial.test.tsvault.adversarial.test.ts — Layer 3 §3.1 adversarial vault tests.vault.session-escrow.test.tsvault.sync-clamp.test.tsUnit tests for HV-1 — sync timestamp clamp + remote-mutation alerts.vault.test.tsvault.tsvault.ts — sole owner of vault state and chrome.storage vault keys.content/
passkey-toast/
crypto/
argon2.test.tsargon2.tscrypto.test.tsdecompression-bomb.test.tsMV-4: decompression-bomb output bounds on the zstd and pako legs.peachPayload.test.tspeachPayload.tspeachPayload.ts — binary payload format shared by PeachScript and the Peach QR matrix code (spec §2).peachScript.test.tspeachScript.tspeachScript.ts — PeachScript encoding/decoding.totp.test.tstotp.tszstd.tsThin wrapper around @bokuweb/zstd-wasm that defers WASM load until the first compress/decompress call and memoises the init promise.
popup/
codex/
aztec.tsaztec.ts — Aztec 2D barcode generation with round-trip verification.browser-bundle.test.tscodex.adversarial.test.tscodex.adversarial.test.ts — Layer 3 §3.4 adversarial Codex tests.codex.suite.test.tscodex.suite.test.ts — cross-cutting regression suite for the Codex pipeline.codex.test.tsconfirmation.tsPick 3 distinct positions in [1, 12] for the recovery-words confirmation gate.erasure.tserasure.ts — Reed-Solomon erasure coding around the WASM library.generate.test.tsgenerate.tsgenerate.ts — full Codex generation pipeline.helpers.tshelpers.ts — shared utilities for Codex generation and restoration.node-wasm.tsNode-only WASM byte loader for Vitest.pdf-import.clamp.test.tspdf-import.test.tspdf-import.test.ts — coverage for the testable surface of the PDF import path.pdf-import.tspdf-import.ts — restore from a Codex PDF instead of a camera scan.pdf-layout.tspdf-layout.ts — A4 Codex page geometry shared between the generator and the PDF importer.pdf.tspdf.ts — render the printable Codex PDF.reed-solomon.tsBrowser-safe wrapper around the Reed-Solomon WASM exports.restore.test.tsrestore.test.ts — coverage for ChunkBuffer, parseRawScan, reconstructAndVerify.restore.tsrestore.ts — Peach Codex restoration library (popup-side).rs-loader.tsrs-loader.ts — load the Reed-Solomon erasure WASM module.scanner.tsscanner.ts — camera-based Aztec scanning for Codex restoration.
components/
views/
Add.tsxChirpSync.tsxChirpSync — the v3 Settings → Sync surface.CodexGenerateView.test.tsx@vitest-environment jsdomCodexGenerateView.tsxPeach Codex — generation view.CodexRestoreView.test.tsx@vitest-environment jsdomCodexRestoreView.tsxPeach Codex — restoration view.contracts.test.tsx@vitest-environment jsdomEntry.tsxExport.csv.test.ts@vitest-environment jsdomExport.tsxSignal-conditioned views in this file must use <Show>, never a signal-conditioned early return (
if (signal()) return <X/>).Health.test.tsx@vitest-environment jsdomHealth.tsxImport.tsxSignal-conditioned views in this file must use <Show>, never a signal-conditioned early return — see Projects.md §4.1.Lock.tsxNoteEditor.toHtml.test.ts@vitest-environment jsdomNoteEditor.tsxNotesEditor.tsxNotesMode.tsxNotesTOC.tsxOnboarding.tsxPanic.tsxPasskeyApproval.tsxProCelebration.tsxRecoveryWordDisplay.tsxRecoveryWordEntry.tsxSettings.tsxTrashView.tsxvault-search.test.tsvault-search.tsVault.tsxview-test-utils.tsxzxcvbn-strength.test.tsLV-8: the @zxcvbn-ts replacement must score the master-password strength meter on the same 0-4 scale as the old zxcvbn, with dictionaries loaded (language-common is what keeps weak passwords from scoring optimistically).shared/
backup.test.tsbackup.tsbridge.tsbrowser.test.tsbrowser.test.ts — locks down feature-detected browser identification.browser.tsbrowser.ts — feature-detected browser identifier shared by background, popup, and content scripts.chirp-handshake.test.tschirp-handshake.tsPost-chirp pairing handshake.chirp-pairing.test.tschirp-pairing.tsAudio pairing driver — orchestrates the two-chirp exchange that bootstraps trust between two devices in the same room.chirp-payload.test.tschirp-payload.tsAudio pairing payload — 64 bytes on the wire.chirp-sync-transport.test.tsSubnet-probe rate-limit tests.chirp-sync-transport.tsWebSocket sync transport — v3 chirp-sync Phase 2.codex-types.tscodex-types.ts — shared shapes for the Peach Codex.config.tsWeb3Forms access key for the in-app feedback form (Settings → feedback).device-manifest.test.tsdevice-manifest.tsDevice manifest — v2 brief §4.3.domain.homograph.test.tsLV-2: homograph detector tests.domain.tsfavicon.test.tsfavicon.tsResolves a favicon URL for a given domain.generate.test.tsgenerate.tsggwave.test.tsggwave.tsggwave loader — thin async wrapper around the ggwave-wasm module.import-limits.tsImport-path resource bounds — audit fixes MV-4 (decompression bomb) and MV-5 (unbounded file/string allocation).import.test.tsimport.ts
any is intentional throughout this module (L17/I3/QUA-010): import files are user-supplied external JSON whose schemas vary by source app and version (1Password CPG, Bitwarden, CXF, generic CSV).local-network.tsLocal network discovery — minimal helper used by chirp pairing.ml.tsnative.tsMobile platform detection helpers used by popup views to gate Capacitor-only paths.noise-blake2s-kat.test.tsnoise-js.test.tsNoise NK auth proof regression test.noise-js.tsNoise NK initiator for Android / Capacitor.noise-xx.test.tsnoise-xx.tsNoise XX (mutual auth) — used for every Phase-2 WebSocket connection after the audio chirp pairing has stamped each side into the other's paired-device registry.passkey-flags.tspasskey-flags.ts — single switch for the Firefox passkey content-script proxy.passkey-utils.test.tspasskey-utils.tspasskey-utils.ts — WebAuthn relying-party-id validation.recovery-word-list.tsrecovery-word-list.ts — 2048-word recovery word list for Peach vault recovery.recovery-words.tsrecovery-words.ts — BIP39-compatible recovery word encoding for Peach vault recovery.shortcuts.test.ts@vitest-environment jsdomshortcuts.tsshortcuts.ts — keybinding schema, defaults, matcher, formatter.storage.tssync-identity.test.tssync-identity.tsSync identity — long-term X25519 keypair tied to the vault, not the device installation.sync-limits.tsSync trust + resource bounds — audit fixes HV-1 (timestamp clamp) and MV-3 (receive-path size bounds).sync-types.tsChirp Sync — type definitions (Master Brief v2).types.tstypes.ts — cross-boundary types and the MessageType union.tests/
fixtures/
.wasm blobs that have not been byte-verified against a reproducible build:history
cd0db594925fcomplete Browser secure reset after verified legacy clear1 month ago7fe8fc12bd0efix Browser Sync reset UX, revoke errors, Cmd+C handling, and migration notice1 month agobbfeb080e279accept PB-26-907 as a recorded owner decision1 month ago7ad27f981898record the independent review outcome in continuity1 month ago85dc226e3d80guard the decoy snapshot write path and correct the gate contract (v5.2.45)1 month ago00d35eb4423fresolve all 17 findings of the 2026-09-10 independent audit (v5.2.45)1 month ago3d0561ff4894publish independent audit of 5.2.44 with two High findings, coverage ledger and findings register1 month agocf83534a92fffail-closed malformed ledger and document locked-spool custody divergence (v5.2.44)1 month ago19cc6123e901extract process-readiness wait with 120s adoption budget and bounded diagnostics1 month ago7fa035f54246add bidirectional adoption v2 process conformance gate (v5.2.42)1 month agoba600c808284refresh the handoff to state what is actually left1 month agodf0d764bc93drecord the matrix coverage and the two rows that remain1 month ago1136f6f812bddrive thirteen matrix scenarios plus the manifest adversarial cases1 month ago4c9c7d9d496drecord how far the cross-client matrix got and what it still needs1 month agof62d0bc1c630expand the cross-client matrix from two scenarios to eleven1 month ago74725082f6derecord how the cross-client matrix harness must be extended1 month ago5dc5080ef785record the adapter coverage session in continuity1 month agod8bc7d691d63extract the source session adapter and cover every callback exhaustively1 month agob229cb5bda92record the secure reset session and the owner decisions in continuity1 month ago80bf58c56bfcimplement the secure reset generation state machine1 month ago7da5fef92c4crecord the seven-item campaign handoff for the next session1 month ago5e4f4668b57fcut the release browser gate from CI and accept the secure-reset contract (v5.2.40)1 month ago1a3b49ac1934draft the secure-reset and breaking-migration contract as sync-protocol §11 for owner review1 month ago4406c838cc56record the version-parity fix and the release-readiness audit1 month ago8635173c58d5sync the extension manifests to package.json and gate product-version parity against drift (v5.2.39)1 month ago4d370427d4b6record the §18.1 slice checkpoint and session save identifiers1 month agob9eed11845d4record the §18.1 closure, green gates, and the §18.4 resume plan1 month ago444d98d8f3f4feat: implement frozen Adoption v2 transcript and pending identity recovery (v5.2.38)1 month ago4e04c3621ecdseal the browser device identity under its own key with pre-vault, root and unlock wraps so adoption v2 can present an identity before a vault exists (v5.2.37)1 month ago6b6b9fb38897record the cross-client remediation handoff for the next session1 month agobf41b0386893freeze the adoption v2 transcript, field names, ordering guarantees and version gate in the shared spec1 month agoa31e6dadfa2amirror Android's manifest bounds and reject wsPort 0 so both clients judge a signed manifest identically (v5.2.36)1 month ago2bbd5cf9fdadfail closed when a revocation issuer cannot be resolved, matching Android and the documented contract (v5.2.35)1 month ago0099d0e2d527agree one canonical revocation record across Browser and Android, issuer bound to known-key history (Browser v5.2.34)1 month ago43c9a5b81271align Sync protocol v3 parity, freeze the local identity schema, and gate root-derived device keys out of production (v5.2.33)1 month ago6a44a458e7e5enforce signed revocation history and cross-client manifest v5 (v5.2.32)1 month ago086afa1eb15aharden immutable device identity, atomic revocations, and decoy sync teardown (v5.2.31)1 month ago93638f8f0f13wip: enforce Browser extension permission inventory and fix passphrase separator collisions (v5.2.30); focused tests, typecheck, lint, and cross-client process gate pass1 month ago2f0ade96362cdocs: record release browser gate code review findings1 month ago7be8deee7444docs: make Sync transcript evidence and cold-lock expectations truthful1 month agoa411cc866918wip: wire PB-26-210 browser gate into CI and bump v5.2.27; macOS Chrome service-worker gate remains environment-blocked1 month ago78679e4a8651add interim independent audit findings report and PDF1 month ago2a1e1f452169docs: record incomplete Sync and assessment closeout1 month ago2a74d657694ddocs: Record settled Sync parity saves1 month ago54ccdbf8d8f3fix: Settle cross-client Sync and revocation parity (v5.2.26)1 month ago1be1a75580c7docs: define revocation-safe browser re-pairing1 month ago68e79607733cfix: rotate copied browser identity during adoption (v5.2.25)1 month agod81f77dc4b6cfix: unify sync transcript and enforce cross-client gate (v5.2.24)1 month ago68c8cfc69519docs: record cross-client protocol verification outcome1 month ago5ebeb29c160erecord protocolVersion outcome in continuity1 month ago
details
Peach
A free, open source, local-first password manager for Chrome, Firefox, and Android.
Peach encrypts your vault on your device. No hosted vault, subscription, or account is required to use it.
Features
- Passwords, cards, and secure notes — keep your private data together in one encrypted vault
- Inline autofill — fill and save credentials without leaving the page
- TOTP built in — generate two-factor codes without a separate authenticator
- Password health — find weak, reused, and exposed passwords
- Portable backups — export and restore with PeachScript or a
.peachfile
Peach Pro adds:
- Peach Sync — end-to-end encrypted sync across paired devices
- Passkeys — save and use passkeys in Chrome and Firefox
- Peach Codex — print an encrypted, scannable backup of your vault
- Advanced vault health, Canary Entries, and duress tools
See the Peach website for current availability and Pro details.
Install
Open Source
Peach is released under the GPL v3. This repository contains Peach's Chrome and Firefox browser extensions. Android is maintained separately.
The source is hosted on Kepr, Asha Software's version control platform.
Security
Vault data is encrypted with AES-256-GCM and protected by Argon2id key derivation. Peach Sync authenticates paired devices and encrypts data in transit.
Implementation details live alongside the code:
Building
bun install --frozen-lockfile
bun run build
Builds are written to dist-chrome/ and dist-firefox/.
Built by Asha Software · [email protected]