peach-browser
A free, open source, local-first password manager for Chrome, Firefox, and Android.
TypeScript
timeline
atlas165 files
public/
src/
background/
aes.test.tsaes.tsalarms.test.tsalarms.tsclipboard.test.tsclipboard.tscommands.tsKeyboard command handler — routing for summon-autofill: 1.entry.tsindex.tslicense.tsmessages.test.tsmessages.tsml-detector.tspasskey-crypto.test.tspasskey-crypto.tspasskey.tssync-network.tssync-storage.tssync.tsvault.test.tsvault.ts
content/
crypto/
argon2.test.tsargon2.tscjk.test.tsCJK encode/decode vectors (spec §10.1).cjk.tsCJK Phrase Encoding -------------------cjkExport.tsExport pipeline for a CJK phrase backup (spec §4.1, §5).cjkImport.tsImport pipeline for a CJK phrase backup (spec §4.2, §9).cjkPassphrase.test.tscjkPassphrase.tsExport passphrase validation, strength estimation, and generation (spec §6).cjkPayload.test.tsBinary payload assembly and extraction (spec §2, §10.2).cjkPayload.tsBinary payload layout for a CJK phrase (spec §2).cjkRoundTrip.test.tsFull export → import round-trip (spec §10.3) and size sanity (§10.4).cjkSerialise.test.tsVault serialisation round-trip for the full-fidelity v3 payload.cjkSerialise.tsFull-fidelity vault serialisation for the CJK phrase backup (v3).crypto.test.tsindex.tstotp.tszstd.tsThin wrapper around @bokuweb/zstd-wasm that defers WASM load until the first compress/decompress call and memoises the init promise.
popup/
views/
Add.tsxcjk-export.test.tsx@vitest-environment jsdomCJKExport.tsxCJK phrase export flow (spec §7).CJKImport.tsxCJK phrase import flow (spec §8).contracts.test.tsx@vitest-environment jsdomEntry.tsxExport.tsxGenerator.tsxHealth.tsxImport.tsxLock.tsxNoteEditor.tsxPasskeyApproval.tsxPasskeyEntry.tsxSettings.tsxSyncPairing.tsxTrashView.tsxVault.tsxview-test-utils.tsx
shared/
tests/
fixtures/
09386e1 (branch main) Test environment: macOS 15.3 (Darwin 25.3.0), white-box source review of the published repository at /Users/june/projects/peach-browser.peach_audit_v1425.mdSource audit: peach_audit_v1424.md (score 70/100) Remediation spec: peach_remediation_spec.md Audit date: 2026-04-21 Auditor: June ([email protected]) / assisted by Claude Code Version under test: Peach post-remediation (working tree at /Users/june/projects/peach-browser) Scope: verification of findings closed by the PR 1 + PR 2 remediation bundle.peach_audit_v1430.mdDate: 2026-04-22 Scope: Everything except sync (per peach_audit_instructions.docx §1.4) Baseline: v1.4.29 Deliverable version: v1.4.30peach_completion_spec.mdGenerated: 2026-04-20 Current version: 1.1.1 Target: production-quality, daily-driver password managerpeach_daily_driver_build_guide.docxpeach_daily_driver_build_guide.mdpeachpeach_demo_update_spec.mdTarget: peachpasswords.com — HeroDemo.astro Extension version: 1.4.12 Goal: make the website demo show the real extension as faithfully as possiblepeach_faithful_spec.mdv1.4.1 targetpeach_gaps_spec.mdGenerated: 2026-04-20 Current version: 1.2.2 Scope: All features promised on peachpasswords.com that are not yet implemented, plus the licensing system required to sell anything.peach_icon_injection_spec.mdPeach v1.4.0 targetpeach_passkeys_spec.mdPeach v1.5.0 targetpeach_shine_spec.mdPeach v1.4.0 targetpeach_sync_spec.mdGenerated: 2026-04-20 Scope: The complete peer-to-peer sync system for Peach Pro.peach_vault_integrity_spec.md*For implementation by Opus.peach-site.pngplaywright.config.tsstatus.mdGenerated: 2026-04-19 Version: 1.0.4 Type: Chrome Extension (Manifest V3)test-extension.mjstsconfig.background.jsontsconfig.jsontsconfig.tests.jsonvite.config.tsvitest.config.ts
history
c08326b6cda4expand hidden vault threat model in duress settings — clarifies what it protects against and what it doesn't5 months ago0a5a9828b51dpad .peach export to fixed size buckets (1KB/4KB/16KB/64KB/256KB) — prevents vault size inference from file size5 months agoe4ce0773cbbcadd zxcvbn strength gate (score ≥ 3) to PeachScript backup password export — prevents weak backup passwords5 months ago98fd3c5d6af4add rune decoder fuzz corpus — 17 edge cases covering off-by-one, surrogates, BOM, RTL, whitespace, DoS timing5 months ago22eb4b086791before security review fixes + Codex crash resolution — v2.51.0 target5 months ago0f4f5c81fffddocs: Refresh comprehensive audit report (v2.50.2)5 months ago18699cfb4043layer 5 refreshed threat model audit evidence5 months ago3986ae7fe563layer 4 refreshed quality and dependency audit evidence5 months agoae34eb9fb229layer 3 refreshed adversarial test audit evidence5 months ago2bfe90568efflayer 2 refreshed correctness audit evidence5 months ago4a1a760e453blayer 1 refreshed security audit evidence5 months ago5e28086808b8before performing peach comprehensive audit report5 months ago20339c232ec2v2.50.2 — second audit complete — 7/findings resolved — ready for Chrome and Firefox store submission5 months agoaabcd7149782bump version to 2.50.2 — second audit complete (7/findings resolved)5 months agof5bf6c4b5297AUD-007: expand adversarial payload sweep — 23 new variants × 38 handlers — 3078 tests pass5 months ago9f523400090dAUD-001: add rollup ^4.0.0 npm override to resolve transitive CVEs in @crxjs/vite-plugin5 months ago35d37116b93abefore AUD-001 @crxjs/vite-plugin upgrade — risky build-tool change5 months agoade57321a70fAUD-005: document extractable passkey key architectural tradeoff5 months ago7d6b4e5e48bdAUD-002: add payload validation for SEARCH_VAULT, COPY, ML_PREDICT_BATCH5 months ago9c2f6f2c9d34AUD-003: document canary webhook data disclosure in Entry settings UI and messages.ts5 months agoaa736dabac67AUD-004: extend Codex chunk hash and vault fingerprint to 128 bits with legacy 16-char fallback5 months ago8dda840a1a99AUD-006: reject sync timestamps beyond 5-minute clock skew budget5 months ago70c8750fd4f7before second audit fixes — findings AUD-001 through AUD-0075 months agoa52ed6dec231fix inline popup vault-locked detection — error string case mismatch (vault_locked vs VAULT_LOCKED) (v2.50.1)5 months ago2b5b0182cea3before inline popup vault-locked detection fix5 months ago715be6641d3ddocs: Add comprehensive pre-release audit report (v2.50.0)5 months ago8a0de1495074audit layer 5 threat model verification complete5 months ago362d9f9041f6audit layer 4 quality and dependency verification complete5 months agod9a6b4333c83audit layer 3 adversarial verification complete5 months agodbad8820dba0audit layer 2 current-code verification complete5 months agodf89f97b758faudit layer 1 current-code verification complete5 months ago64e9e51fad5dv2.50.0 — pre-release audit cycle (findings: 36 fixed, 1 deferred ANDROID, 1 accepted BUILD-DEP); manifest + package + lock bumped5 months agobeedabaee514before comprehensive audit report5 months ago46f3a940fc87docs: KNOWN_ISSUES.md — document L8 (ANDROID-DEFERRED-001) and L7 rollup residue (BUILD-DEP-001) deferrals5 months agofd5e23e83d9fpre-release audit complete — 38/findings resolved — 0 remaining — ready for store submission5 months agoaefd91f77276L18/I1+I2: verify CRYPTO-11 (deriveRootKeyFromDerivedKey active) and SEC-009 (AAD domain separation) both implemented5 months agoc2ec6e84637aL17/QUA-010: document intentional any usage in import.ts (external schema heterogeneity)5 months agoa3e298dd0300L16/SEC-010: validate incoming license signature before storing in applyIncomingVault5 months ago987a154bae24L15/SEC-009: slot-id domain separation in AES-GCM AAD (slot_a_v1, slot_b_v1, pw_root_v1, sync_identity_v1) with legacy VERSION_BYTE decrypt-fallback for migration5 months ago8b3a7582c2aeL14/COR-015: document verifyMainPassword real-vs-decoy intentionality5 months agofced847c8e54L13/COR-013: verify M4 covers all snapshot failure paths — single internal catch handles all callers5 months agoba629d89dda6L12/COR-011: add foreground idle autolock interval for native (Android)5 months ago54d245d5cf0fL11/COR-008: rollback in-memory entries if persistEntries fails in addEntry5 months agobd387b3b4237L10/THREAT-009: document reproducible build process (REPRODUCIBLE_BUILD.md, .nvmrc, engines)5 months ago1efabc88f7f7L9/THREAT-008: extend Codex chunk integrity hash from 32 to 64 bits5 months ago5bbbd6642f42L8/THREAT-007: deferred — Android SyncPlugin.kt not in current repo (mobile code removed); follow-up when Android target restored5 months ago9adfd28ef358L7/QUA-008: upgrade web-ext to 10.x, npm audit fix on production deps (0 prod vulns)5 months ago0a09511d4c3fL6/QUA-007: remove stale @ts-ignore directives in Lock.tsx — chrome types resolve cleanly5 months ago705a2fcd8d9aL5/QUA-004: standardize error codes to snake_case across messages.ts, vault.ts and add ErrorCode type union5 months ago214299cfc6f6L4/QUA-003: enable noUnusedLocals and noUnusedParameters; remove dead identifiers across src and tests5 months ago
details
Peach
A free, open source, local-first password manager for Chrome, Firefox, and Android.
Peach encrypts your vault on your device. No hosted vault, subscription, or account is required to use it.
Features
- Passwords, cards, and secure notes — keep your private data together in one encrypted vault
- Inline autofill — fill and save credentials without leaving the page
- TOTP built in — generate two-factor codes without a separate authenticator
- Password health — find weak, reused, and exposed passwords
- Portable backups — export and restore with PeachScript or a
.peachfile
Peach Pro adds:
- Peach Sync — end-to-end encrypted sync across paired devices
- Passkeys — save and use passkeys in Chrome and Firefox
- Peach Codex — print an encrypted, scannable backup of your vault
- Advanced vault health, Canary Entries, and duress tools
See the Peach website for current availability and Pro details.
Install
Open Source
Peach is released under the GPL v3. This repository contains Peach's Chrome and Firefox browser extensions. Android is maintained separately.
The source is hosted on Kepr, Asha Software's version control platform.
Security
Vault data is encrypted with AES-256-GCM and protected by Argon2id key derivation. Peach Sync authenticates paired devices and encrypts data in transit.
Implementation details live alongside the code:
Building
bun install --frozen-lockfile
bun run build
Builds are written to dist-chrome/ and dist-firefox/.
Built by Asha Software · [email protected]