peach-browser
A free, open source, local-first password manager for Chrome, Firefox, and Android.
TypeScript
timeline
atlas328 files
android/
.gradle/
8.14.3/
buildOutputCleanup/
vcs-1/
.idea/
app/
src/
androidTest/
java/
com/
main/
java/
com/
peachpasswords/
app/
AssistStructureParser.ktAutofillPlugin.ktBiometricPlugin.ktFoldPlugin.ktBridges androidx.window's WindowInfoTracker to JS so the WebView can react to foldable posture (tabletop / book / flat).InMemoryVault.ktInMemoryVaultPlugin.ktMainActivity.ktPeachAutofillService.ktSyncKeyPlugin.ktSyncKey — persistent X25519 sync identity stored under the AndroidX Keystore-backed master key.SyncPlugin.ktBridges mDNS discovery of
_peach-sync._tcp services to the TypeScript sync coordinator on Android.VaultBridge.ktres/
drawable-land-hdpi/
drawable-land-mdpi/
drawable-land-xhdpi/
drawable-land-xxhdpi/
drawable-land-xxxhdpi/
drawable-port-hdpi/
drawable-port-mdpi/
drawable-port-xhdpi/
drawable-port-xxhdpi/
drawable-port-xxxhdpi/
drawable-v24/
mipmap-anydpi-v26/
mipmap-xxxhdpi/
test/
java/
com/
build/
reports/
problems/
capacitor-cordova-android-plugins/
build/
.transforms/
7beb45389d36f3be5d46ee1e2c6e8e21/
d7fe5323227bdf5e02f51d947efe076c/
transformed/
bundleLibRuntimeToDirDebug/
intermediates/
aapt_friendly_merged_manifests/
debug/
processDebugManifest/
aar_main_jar/
debug/
syncDebugLibJars/
aar_metadata/
debug/
writeDebugAarMetadata/
annotation_processor_list/
debug/
javaPreCompileDebug/
annotations_typedef_file/
debug/
extractDebugAnnotations/
compile_library_classes_jar/
debug/
bundleLibCompileToJarDebug/
compile_r_class_jar/
debug/
generateDebugRFile/
compile_symbol_list/
debug/
generateDebugRFile/
incremental/
debug/
packageDebugResources/
debug-mergeJavaRes/
mergeDebugAssets/
mergeDebugJniLibFolders/
mergeDebugShaders/
local_only_symbol_list/
debug/
parseDebugLocalResources/
manifest_merge_blame_file/
debug/
processDebugManifest/
merged_java_res/
debug/
mergeDebugJavaResource/
merged_manifest/
debug/
processDebugManifest/
navigation_json/
debug/
extractDeepLinksDebug/
nested_resources_validation_report/
debug/
generateDebugResources/
runtime_library_classes_jar/
debug/
bundleLibRuntimeToJarDebug/
symbol_list_with_package_name/
debug/
generateDebugRFile/
outputs/
src/
main/
gradle/
public/
fonts/
models/
scripts/
build-peachscript.pyBuild PeachScript-Regular.otf — 256 historical-runic glyphs.clean-chrome-dist.mjsclean-firefox-artifacts.mjscopy-mobile-index.jsCopies dist-mobile/src/popup/index.html to dist-mobile/index.html so Capacitor can find the entry point.generate-native-sync-manifest.mjsinstall-native-sync-host.mjssync-chrome-dist.mjs
src/
background/
aes.test.tsaes.tsaes.ts — AES-256-GCM encrypt/decrypt primitives for vault storage.alarms.test.tsalarms.tsclipboard.test.tsclipboard.tscommands.tsKeyboard command handler — routing for summon-inline: 1.entry.tshealth.test.tshealth.tshealth.ts — Pro advanced vault health analysis.index.tslicense.tsmessages.test.tsmessages.tsmessages.ts — the only background message handler.ml-detector.tspairing-server-state.tsTracks the active 6-digit pairing-server session.passkey-crypto.test.tspasskey-crypto.tspasskey-firefox-proxy.test.tspasskey-firefox-proxy.test.ts — covers the v2.12.0 Firefox content-script proxy path.passkey.tssync-coordinator.test.tsBlob sync session tests.sync-coordinator.tsBlob sync session coordinator.sync-identity-glue.tsLocal device id helpers shared between the lifecycle tick and the 6-digit pairing flow.sync-lifecycle.tsSync lifecycle — auto-advertise + incoming pairing subscriber.sync-network.tssync-storage.tssync.test.tssync.tsGATED — peach-sync native host client.vault-history.test.tsVault history tests.vault.test.tsvault.tsvault.ts — sole owner of vault state and chrome.storage vault keys.
content/
content-ml-detector.tsdetect.test.ts@vitest-environment jsdomdetect.tsfield-scoring.tsfill.test.ts@vitest-environment jsdomfill.tsindex.tsinject.tsinject.ts — autofill icon + selector overlay, injected into pages.palette.tsThis file has been retired.passkeys-firefox-relay.tspasskeys-firefox-relay.ts — extension-world relay for the MAIN-world passkey proxy (passkeys-firefox.ts).passkeys-firefox.tspasskeys-firefox.ts — MAIN-world WebAuthn interception for Firefox.policy.test.ts@vitest-environment jsdompolicy.tspolicy.ts — page-scraping helpers for password requirements.save.ts
crypto/
argon2.test.tsargon2.tscrypto.test.tsmayan_decode.tsMayan v2 decoder — anchor-finder + homography pipeline.mayan.test.tsmayan.tsMayan v2 — Peach's proprietary vault backup matrix code.peachPayload.test.tspeachPayload.tspeachPayload.ts — binary payload format shared by PeachScript and the Peach QR matrix code (spec §2).peachQR.tspeachQR.ts — render a Peach binary payload as a printable QR code.peachScript.test.tspeachScript.tspeachScript.ts — PeachScript encoding/decoding.rs.test.tsrs.tsReed-Solomon codec — GF(2^8) with primitive polynomial 0x11D (x^8 + x^4 + x^3 + x^2 + 1, the standard CCSDS / NASA polynomial).totp.tszstd.tsThin wrapper around @bokuweb/zstd-wasm that defers WASM load until the first compress/decompress call and memoises the init promise.
popup/
components/
views/
Add.tsxcontracts.test.tsx@vitest-environment jsdomEntry.tsxExport.tsxSignal-conditioned views in this file must use <Show>, never a signal-conditioned early return (
if (signal()) return <X/>).Health.tsxImport.tsxSignal-conditioned views in this file must use <Show>, never a signal-conditioned early return — see Projects.md §4.1.Lock.tsxNoteEditor.tsxOnboarding.tsxPanic.tsxPasskeyApproval.tsxProCelebration.tsxSettings.tsxSyncPairing.tsxTrashView.tsxVault.tsxview-test-utils.tsxshared/
android-sync-identity.tsAndroid sync identity — persistent X25519 keypair for the Capacitor side.backup.test.tsbackup.tsbiometric.tsbridge.tsbrowser.tsbrowser.ts — feature-detected browser identifier shared by background, popup, and content scripts.capacitor-pairing-handshake.tsCapacitor pairing handshake — WebSocket variant of the desktop INITIATE_PAIR_WITH_PEER flow.capacitor-pairing-server.tsCapacitor pairing server — JS runtime for Android show-mode pairing.capacitor-sync-transport.tsCapacitor (Android) sync transport.chrome-mobile.tsCapacitor-backed chrome.storage.local shim.chrome-shim.tsCapacitor chrome shim.chrome.tsShared chrome shim — uses real Chrome APIs on extension builds, Capacitor-backed shim on mobile builds.domain.tsfavicon.test.tsfavicon.tsResolves a favicon URL for a given domain.fold.tsgenerate.test.tsgenerate.tsimport.test.tsimport.tsin-memory-vault.tsml.tsnative-sync-installer.test.tsnative-sync-manifest-script.test.tsnoise-js.test.tsNoise NK auth proof cross-check.noise-js.tsNoise NK initiator for Android / Capacitor.passkey-flags.tspasskey-flags.ts — single switch for the Firefox passkey content-script proxy.shortcuts.test.ts@vitest-environment jsdomshortcuts.tsshortcuts.ts — keybinding schema, defaults, matcher, formatter.storage.tssync-bridge.test.tssync-bridge.tsSync transport selector.sync-types.tsTypes for Peach sync — full encrypted vault blob transfer.sync-wire.test.tssync-wire.tstypes.tstypes.ts — cross-boundary types and the
MessageType union.tests/
fixtures/
7d738aa11c96, package v2.14.9, native v0.1.14.tsconfig.background.jsontsconfig.jsontsconfig.tests.jsonvite.config.mobile.tsvite.config.tsvitest.config.tshistory
94fda772d1b5fix: Show full used-email picker in entry editor (v4.9.9)2 months agod550f48a729dfix: Restore Advanced control for passkey entries (v4.9.8)2 months ago03887ea0c034docs: define cross-platform contract sync policy2 months ago72efe45f61c2record 2fa-icon-spam fix and v4.9.7 gates in CONTINUITY.md2 months agoda74e3f68636collapse OTP-signaling split-digit boxes (no maxlength) to a single icon on box[0] instead of one per box2 months ago2c20a75301a0record six-fix bugfix session and v4.9.6 gates in CONTINUITY.md2 months agoa945b931a1c5bump version 4.9.5 to 4.9.6 across package.json and both manifests2 months agoc54ae32c7d48treat markup-only or zero-width contenteditable bodies as blank so a new note with nothing typed is never saved2 months ago2adb75e4873erun the main content script in all frames so Peach can fill login forms inside overlay/nested iframes2 months ago4488f3459d17detect single-digit OTP boxes by maxlength attribute so type=number 2FA boxes no longer each get a peach icon2 months ago8b8b37f3866fbrighten the Settings version corner to a gentle readable off-white instead of 10% alpha2 months ago5de797f88705suppress keyboard shortcuts on lock screen so typing a password cannot trigger new-entry and escape2 months ago3b0605503593render passkey entries with favicon or coloured initials instead of search-like key icon2 months ago0a86c74f2b4cfix lock action icon to render accent at rest instead of only on hover2 months agoe3cda06167abfeat: Rename paired devices locally (v4.9.4)2 months ago7c75b22961a9fix: Bound cumulative locked sync inbox (v4.9.3)2 months agof5eeec05e167feat: Add opaque locked background sync spool (v4.9.2)2 months agoe40a67cca1a3clear MV3 session key in lock() so a manual lock is not silently undone by the next SW restart2 months ago0e9a9f1e1ac5strip accentGlow machinery from RuneBackground, runes drift subtly on their own at base opacity2 months agoc2d065090bf8bump version to 4.9.1 and rebuild dist-chrome and dist-firefox2 months ago6d22b523c75frestore PeachMark above lock-screen eyebrow, add peach-lock-mark sizing, tighten eyebrow tracking/weight2 months ago501417f17d18slow down accent glow pulse (0.08-0.20 speed, 5-9s lifetime) and tighten rune row spacing (LINE_H 3.8→2.8)2 months agod72d7694ef20bump version to 4.9.0 in package.json and manifests2 months ago96373f8a028dfix indentation in Lock.tsx unlock view after layout changes2 months agob80860877bb4add canvas null check, mock RuneBackground in tests, all tests pass2 months ago9c22e753d364fix unused variables in glow update loop, lint and typecheck pass clean2 months agofe0416317f36center hero content on unlock view, remove hero art CSS, add text-align center to headline2 months ago6a73c5c3a0bbremove LockRuneCanvas and PeachMark hero art from lock screen, add RuneBackground with accentGlow2 months agofa601515c1a3add accentGlow prop to RuneBackground with sine-wave pulse glow slots2 months ago14c3e3aa08fadocs: record v4.8.9 Chrome and Firefox release2 months ago0da75a28a141docs: record combined credential browser verification2 months ago507ed37227b1fix: preserve TOTP during passkey consolidation (v4.8.9)2 months ago752c6edfb19fdocs: continuity — peach-android v2.14.12 mirrors the 64-char device-name cap2 months ago2a311f0d3062docs: continuity — record device-name cap hardening (v4.8.8)2 months ago847806bd2188feat: cap peer device names at 64 chars on every inbound seam (v4.8.8)2 months agoc387e8a41f26docs: continuity — record sync-alert overflow fix outcome (v4.8.7)2 months ago44a2d34bbdddfix: contain device-trust alert banners inside the 320px shell (v4.8.7)2 months ago65feee9c1752docs: Refresh README for Peach Sync and Android beta2 months agoddbf04f40670docs: continuity — record deletion + biome-repair outcomes and save bundling note (v4.8.6)2 months agoac28263c9b98test: revive two orphaned mesh-propagation receiver tests (v4.8.6)2 months ago41b6448ed641refactor: delete dead GET_ADOPTION_MATERIAL/COMPLETE_PAIRING handlers (v4.8.5)2 months agoae66726c3c86docs: continuity — record Codex Security F1/F2/F3 resolution and verification (v4.8.4)2 months agoe3f31d626cb8style: drop lint violations introduced by security fixes (v4.8.4)2 months ago7cf0e6d4b0c4fix: canary webhook filter rejects IPv4-mapped IPv6 private literals (v4.8.4)2 months ago2945bb7a571afix: bind Firefox passkey completion to the pending ceremony (v4.8.3)2 months agoc3c0d13e0280fix: gate key-material and pairing handlers to extension-page senders (v4.8.2)2 months ago1fc1bb91666btest: fix flaky tampered-ciphertext crypto test (v4.8.1)2 months ago351f84bfff6efeat: collapse sync alert toasts by type with counter + flip + dismiss-all; strip mesh diag (v4.8.0)2 months agode56d93b26cefix: treat wsPort/relayUrl null same as undefined in manifest validation + normalise (v4.7.9)2 months agoceeb0d1edf66fix: accept wsPort:0 as valid no-port sentinel in manifest validation (v4.7.8)2 months ago
details
Peach
A free, open source, local-first password manager for Chrome, Firefox, and Android.
Peach encrypts your vault on your device. No hosted vault, subscription, or account is required to use it.
Features
- Passwords, cards, and secure notes — keep your private data together in one encrypted vault
- Inline autofill — fill and save credentials without leaving the page
- TOTP built in — generate two-factor codes without a separate authenticator
- Password health — find weak, reused, and exposed passwords
- Portable backups — export and restore with PeachScript or a
.peachfile
Peach Pro adds:
- Peach Sync — end-to-end encrypted sync across paired devices
- Passkeys — save and use passkeys in Chrome and Firefox
- Peach Codex — print an encrypted, scannable backup of your vault
- Advanced vault health, Canary Entries, and duress tools
See the Peach website for current availability and Pro details.
Install
Open Source
Peach is released under the GPL v3. This repository contains Peach's Chrome and Firefox browser extensions. Android is maintained separately.
The source is hosted on Kepr, Asha Software's version control platform.
Security
Vault data is encrypted with AES-256-GCM and protected by Argon2id key derivation. Peach Sync authenticates paired devices and encrypts data in transit.
Implementation details live alongside the code:
Building
bun install --frozen-lockfile
bun run build
Builds are written to dist-chrome/ and dist-firefox/.
Built by Asha Software · [email protected]