peach-browser
A free, open source, local-first password manager for Chrome, Firefox, and Android.
TypeScript
timeline
atlas287 files
public/
codex/
fonts/
models/
scripts/
build-peachscript.pyBuild PeachScript-Regular.otf — 256 historical-runic glyphs.ci.tsclean-chrome-dist.mjsclean-firefox-artifacts.mjspackage-amo-source.shpackage-amo-source.sh — produce peach-3.6.65-source.zip for AMO review.release-firefox.tsrelease.tssetup-chrome-release.sh───────────────────────────────────────────────────────────────────────────── Peach — Chrome Web Store Release Setup Run this once to configure Chrome publishing.sync-chrome-dist.mjs
src/
background/
aes.test.tsaes.tsaes.ts — AES-256-GCM encrypt/decrypt primitives for vault storage.alarms.test.tsalarms.tschirp-identity.test.tschirp-identity.tsLocal-device identity helpers for the chirp-sync architecture.chirp-sync-coordinator.test.tschirp-sync-coordinator.tsChirp Sync — Phase 2 manifest-diff coordinator.chirp-sync-runner.test.tschirp-sync-runner.tsProduction sync runner — composes the live vault adapter, WebSocket transport, and coordinator into the function the dispatcher injects via
setSyncRunner.chirp-sync-static.test.tsIV.7 — Static safety assertions for Chirp Sync.chirp-sync-vault-adapter.test.tschirp-sync-vault-adapter.tsProduction adapter that backs runChirpSyncInitiator with the live vault.clipboard.test.tsclipboard.tsClipboard write + reliable auto-clear — audit fix HV-2.codex-handlers.test.tsTests for src/background/codex-handlers.ts.codex-handlers.tscodex-handlers.ts — message handlers that back the Peach Codex flow.commands.tsKeyboard command handler — routing for summon-inline: 1.entry.lock-port.test.tsLV-5: the lock-on-close onConnect listener accepts only our popup port (legacy bare "popup" or nonce'd "popup-<uuid>") and ignores anything else.entry.tshealth.test.tshealth.tshealth.ts — Pro advanced vault health analysis.license.tsmessages.adversarial.test.tsmessages.adversarial.test.ts — Layer 3 §3.3 adversarial message handler tests.messages.test.tsmessages.tsmessages.ts — the only background message handler.ml.tsnotes.test.tsoffscreen.htmloffscreen.tsOffscreen document script — audit fix HV-2c.paired-devices.test.tspaired-devices.tsPaired-device registry — v3 chirp-sync.passkey-chrome-ceremony.test.tspasskey-chrome-ceremony.test.ts — covers the Chrome chrome.webAuthenticationProxy ceremony path that the Firefox-proxy test file does NOT exercise.passkey-crypto.test.tspasskey-crypto.tspasskey-deny-on-close.test.tspasskey-deny-on-close.test.ts — M8/COR-009passkey-firefox-proxy.test.tspasskey-firefox-proxy.test.ts — covers the v2.12.0 Firefox content-script proxy path.passkey.tspending-vouched-devices.tsPending vouched devices — audit fix MV-7.recovery-pending.tsPersistent flag set while the user has just created a vault and is reading their 12 recovery words but has not yet typed the 3 confirmation words.recovery-words.test.tsrecovery.adversarial.test.tsrecovery.adversarial.test.ts — Layer 3 §3.2 adversarial recovery words tests.self-test.test.tsself-test.tsself-test.ts — Known-Answer Test (KAT) for the Peach crypto stack.sync-alerts.tsPending sync alerts — audit fix HV-1b.sync-trigger.test.tssync-trigger.tssync-trigger.ts — central sync dispatcher.vault-history.test.tsVault history tests.vault.adversarial.test.tsvault.adversarial.test.ts — Layer 3 §3.1 adversarial vault tests.vault.session-escrow.test.tsvault.sync-clamp.test.tsUnit tests for HV-1 — sync timestamp clamp + remote-mutation alerts.vault.test.tsvault.tsvault.ts — sole owner of vault state and chrome.storage vault keys.content/
passkey-toast/
crypto/
argon2.test.tsargon2.tscrypto.test.tsdecompression-bomb.test.tsMV-4: decompression-bomb output bounds on the zstd and pako legs.peachPayload.test.tspeachPayload.tspeachPayload.ts — binary payload format shared by PeachScript and the Peach QR matrix code (spec §2).peachScript.test.tspeachScript.tspeachScript.ts — PeachScript encoding/decoding.totp.tszstd.tsThin wrapper around @bokuweb/zstd-wasm that defers WASM load until the first compress/decompress call and memoises the init promise.
popup/
codex/
aztec.tsaztec.ts — Aztec 2D barcode generation with round-trip verification.browser-bundle.test.tscodex.adversarial.test.tscodex.adversarial.test.ts — Layer 3 §3.4 adversarial Codex tests.codex.suite.test.tscodex.suite.test.ts — cross-cutting regression suite for the Codex pipeline.codex.test.tsconfirmation.tsPick 3 distinct positions in [1, 12] for the recovery-words confirmation gate.erasure.tserasure.ts — Reed-Solomon erasure coding around the WASM library.generate.test.tsgenerate.tsgenerate.ts — full Codex generation pipeline.helpers.tshelpers.ts — shared utilities for Codex generation and restoration.node-wasm.tsNode-only WASM byte loader for Vitest.pdf-import.test.tspdf-import.test.ts — coverage for the testable surface of the PDF import path.pdf-import.tspdf-import.ts — restore from a Codex PDF instead of a camera scan.pdf-layout.tspdf-layout.ts — A4 Codex page geometry shared between the generator and the PDF importer.pdf.tspdf.ts — render the printable Codex PDF.reed-solomon.tsBrowser-safe wrapper around the Reed-Solomon WASM exports.restore.test.tsrestore.test.ts — coverage for ChunkBuffer, parseRawScan, reconstructAndVerify.restore.tsrestore.ts — Peach Codex restoration library (popup-side).rs-loader.tsrs-loader.ts — load the Reed-Solomon erasure WASM module.scanner.tsscanner.ts — camera-based Aztec scanning for Codex restoration.
components/
views/
Add.tsxChirpSync.tsxChirpSync — the v3 Settings → Sync surface.CodexGenerateView.test.tsx@vitest-environment jsdomCodexGenerateView.tsxPeach Codex — generation view.CodexRestoreView.tsxPeach Codex — restoration view.contracts.test.tsx@vitest-environment jsdomEntry.tsxExport.csv.test.ts@vitest-environment jsdomExport.tsxSignal-conditioned views in this file must use <Show>, never a signal-conditioned early return (
if (signal()) return <X/>).Health.test.tsx@vitest-environment jsdomHealth.tsxImport.tsxSignal-conditioned views in this file must use <Show>, never a signal-conditioned early return — see Projects.md §4.1.Lock.tsxNoteEditor.toHtml.test.ts@vitest-environment jsdomNoteEditor.tsxNotesEditor.tsxNotesMode.tsxNotesTOC.tsxOnboarding.tsxPanic.tsxPasskeyApproval.tsxProCelebration.tsxRecoveryWordDisplay.tsxRecoveryWordEntry.tsxSettings.tsxTrashView.tsxvault-search.test.tsvault-search.tsVault.tsxview-test-utils.tsxzxcvbn-strength.test.tsLV-8: the @zxcvbn-ts replacement must score the master-password strength meter on the same 0-4 scale as the old zxcvbn, with dictionaries loaded (language-common is what keeps weak passwords from scoring optimistically).shared/
backup.test.tsbackup.tsbridge.tsbrowser.test.tsbrowser.test.ts — locks down feature-detected browser identification.browser.tsbrowser.ts — feature-detected browser identifier shared by background, popup, and content scripts.chirp-handshake.test.tschirp-handshake.tsPost-chirp pairing handshake.chirp-pairing.test.tschirp-pairing.tsAudio pairing driver — orchestrates the two-chirp exchange that bootstraps trust between two devices in the same room.chirp-payload.test.tschirp-payload.tsAudio pairing payload — 64 bytes on the wire.chirp-sync-transport.test.tsSubnet-probe rate-limit tests.chirp-sync-transport.tsWebSocket sync transport — v3 chirp-sync Phase 2.codex-types.tscodex-types.ts — shared shapes for the Peach Codex.config.tsWeb3Forms access key for the in-app feedback form (Settings → feedback).device-manifest.test.tsdevice-manifest.tsDevice manifest — v2 brief §4.3.domain.homograph.test.tsLV-2: homograph detector tests.domain.tsfavicon.test.tsfavicon.tsResolves a favicon URL for a given domain.generate.test.tsgenerate.tsggwave.test.tsggwave.tsggwave loader — thin async wrapper around the ggwave-wasm module.import-limits.tsImport-path resource bounds — audit fixes MV-4 (decompression bomb) and MV-5 (unbounded file/string allocation).import.test.tsimport.ts
any is intentional throughout this module (L17/I3/QUA-010): import files are user-supplied external JSON whose schemas vary by source app and version (1Password CPG, Bitwarden, CXF, generic CSV).local-network.tsLocal network discovery — minimal helper used by chirp pairing.ml.tsnative.tsMobile platform detection helpers used by popup views to gate Capacitor-only paths.noise-js.test.tsNoise NK auth proof regression test.noise-js.tsNoise NK initiator for Android / Capacitor.noise-xx.test.tsnoise-xx.tsNoise XX (mutual auth) — used for every Phase-2 WebSocket connection after the audio chirp pairing has stamped each side into the other's paired-device registry.passkey-flags.tspasskey-flags.ts — single switch for the Firefox passkey content-script proxy.passkey-utils.test.tspasskey-utils.tspasskey-utils.ts — WebAuthn relying-party-id validation.recovery-word-list.tsrecovery-word-list.ts — 2048-word recovery word list for Peach vault recovery.recovery-words.tsrecovery-words.ts — BIP39-compatible recovery word encoding for Peach vault recovery.shortcuts.test.ts@vitest-environment jsdomshortcuts.tsshortcuts.ts — keybinding schema, defaults, matcher, formatter.storage.tssync-identity.test.tssync-identity.tsSync identity — long-term X25519 keypair tied to the vault, not the device installation.sync-limits.tsSync trust + resource bounds — audit fixes HV-1 (timestamp clamp) and MV-3 (receive-path size bounds).sync-types.tsChirp Sync — type definitions (Master Brief v2).types.tstypes.ts — cross-boundary types and the MessageType union.tests/
fixtures/
.wasm blobs that have not been byte-verified against a reproducible build:history
eeb12f15f2c4add protocolVersion to SYNC_HELLO, reject stale peers with update-required error1 month ago2c0d1e890d44add unified cross-client sync protocol spec in docs/sync-protocol.md1 month ago95e2413471ddfix: Keep pairing relay control in view (v5.2.21)1 month agoded0193884b0fix: Fit pairing birds and QR without scrolling (v5.2.20)1 month ago03f51fb1d371fix: Keep pairing birds below the device header (v5.2.19)1 month agoc5c68565bc6efix: Stabilize Firefox pairing and listener sync status (v5.2.18)1 month ago06cc122e0cb4fix: publish standalone sync recovery breaking notice (v5.2.17)1 month ago80fa1c4f430ddocs: record v5.2.16 store submissions and sync repair warning1 month agod8cd64dc4755fix: warn about device repair after sync security update (v5.2.16)1 month ago59f226d8076cdocs: Record pair-secret race resolution1 month ago987624578e20fix: Serialize encrypted pair-secret updates (v5.2.15)1 month ago689c06ca307bdocs: record v5.2.14 store submissions1 month agoc5ca1fe79968docs: correct PB-26-708 pairing evidence1 month agoee7fdbb0ce28fix: keep pairing consent on the 8-digit safety code (v5.2.14)1 month ago62374dc19cf9docs: finalize cross-platform red-team closeout1 month ago375b881c4f18docs: close PB-26-701 through PB-26-710 register1 month agoc4e8e0b71f63fix: disclose vault trust scope at device approval (PB-26-708, PB-26-709, v5.2.13)1 month agobdcc99ca7c46fix: show trustworthy origins for credential decisions (PB-26-707, PB-26-710, v5.2.12)1 month ago80f09eb7e4bdfix: cap aggregate Codex PDF rendering (PB-26-704, v5.2.11)1 month ago317f2df9a402fix: bound password-policy DOM extraction (PB-26-703, v5.2.10)1 month ago6982d0beb2dafix: budget page-triggered ML inference (PB-26-702, v5.2.9)1 month ago9d36d625ca49style: align sync reassembly deadline flow1 month ago69197437712dfix: expire incomplete sync frames (PB-26-705, v5.2.8)1 month agoebd357713cd6fix: bound sync transport inboxes (PB-26-701, v5.2.7)1 month agob86994371f4fdocs: record PB-26-701..710 remediation plan1 month ago574f41f87d27archive superseded 2026-09-06 security assessment before K3 publication1 month ago277687c32be4feat: Add versioned changelog and cumulative update notices (v5.2.6)1 month agoe4155d95f68efix: Show changelog only for intentional notices (v5.2.5)1 month ago46fd698ce73cfix: Restore legacy Chrome passkey assertions (v5.2.4)1 month ago0a1c5debb187fix: Keep new-entry creation inline when vault is unlocked (v5.2.3)1 month ago3e534fd912b8fix: Restore inline entry editing and constraint legibility (v5.2.2)1 month ago3b0b39558887fix: Preserve Chrome archive paths (v5.2.1)1 month ago3536281cbb50complete red-themed v5.2.0 red-team audit report and support registers1 month agoe055e049afefpublish Kimi K3 independent security assessment PDF for v5.2.0 — 2 findings (0 C/H/M/L, 2 Informational), all 17 prior PB-26-501..611 re-verified at head1 month agoe4b29ebdca3bclose PB-26-601..611: register all 11 as Fixed with locations/tests/save IDs, record closeout in CONTINUITY, roll the batch up to v5.2.01 month ago0def51186dd4fix: package the Chrome archive with the deterministic ZIP writer instead of system zip (audit PB-26-611, v5.1.20)1 month ago261aa512aa67add manifest parity test between source and built output (audit PB-26-610, v5.1.19)1 month ago958f08eb625ffix: overwrite both transport cipher keys with zeros on session drop; snow 0.10 never zeroizes them (audit PB-26-609, v5.1.18)1 month agoafb9e8c96910fix: zeroize the private-key stack copy in require_matching_keypair (audit PB-26-608, v5.1.17)1 month ago7a0792a9de52fix: stop echoing raw background errors in Codex and Adopt views (audit PB-26-607, v5.1.16)1 month agob68bdc98f5f1fix: cap import entry count during parse to bound transient memory (audit PB-26-606, v5.1.15)1 month ago8e348373e1b9fix: pad adoption snapshot frames to the sync bucket ladder (audit PB-26-604, v5.1.14)1 month ago22d6a1a0bb03fix: apply capDeviceName to adoption-sourced PairedDevice records (audit PB-26-603, v5.1.13)1 month agoc067510e1a14fix: enforce MAX_FRAME_BYTES on the final chunk of sync frame reassembly (audit PB-26-602, v5.1.12)1 month agocf2649c42e87fix: compare the challenge responder key with constantTimeEqualBytes instead of short-circuiting every (audit PB-26-605, v5.1.11)1 month ago2343fcaa7564fix: noiseKKResponder rejects small-order X25519 initiator keys before the WASM core (audit PB-26-601, v5.1.10)1 month ago21d00cee79fdpublish independent security assessment PDF for v5.1.9 — 11 findings (0 C/H/M, 6 Low, 5 Informational), all prior PB-26-501..506 re-verified1 month agoc35b53fd6bf5remove release-browser-gate as a blocking release precondition — never completed successfully on any host, underlying checks independently verified1 month ago79d70a62bd52record Linux guest boot blocker after green v5.1.8 CI1 month agobfa655b5c75bdocs: Record September 5 security finding dispositions (v5.1.8)1 month ago
details
Peach
A free, open source, local-first password manager for Chrome, Firefox, and Android.
Peach encrypts your vault on your device. No hosted vault, subscription, or account is required to use it.
Features
- Passwords, cards, and secure notes — keep your private data together in one encrypted vault
- Inline autofill — fill and save credentials without leaving the page
- TOTP built in — generate two-factor codes without a separate authenticator
- Password health — find weak, reused, and exposed passwords
- Portable backups — export and restore with PeachScript or a
.peachfile
Peach Pro adds:
- Peach Sync — end-to-end encrypted sync across paired devices
- Passkeys — save and use passkeys in Chrome and Firefox
- Peach Codex — print an encrypted, scannable backup of your vault
- Advanced vault health, Canary Entries, and duress tools
See the Peach website for current availability and Pro details.
Install
Open Source
Peach is released under the GPL v3. This repository contains Peach's Chrome and Firefox browser extensions. Android is maintained separately.
The source is hosted on Kepr, Asha Software's version control platform.
Security
Vault data is encrypted with AES-256-GCM and protected by Argon2id key derivation. Peach Sync authenticates paired devices and encrypts data in transit.
Implementation details live alongside the code:
Building
bun install --frozen-lockfile
bun run build
Builds are written to dist-chrome/ and dist-firefox/.
Built by Asha Software · [email protected]