peach-browser
A free, open source, local-first password manager for Chrome, Firefox, and Android.
TypeScript
timeline
atlas269 files
public/
codex/
fonts/
models/
scripts/
build-peachscript.pyBuild PeachScript-Regular.otf — 256 historical-runic glyphs.ci.tsclean-chrome-dist.mjsclean-firefox-artifacts.mjspackage-amo-source.shpackage-amo-source.sh — produce peach-3.6.65-source.zip for AMO review.release-firefox.tsrelease.tssetup-chrome-release.sh───────────────────────────────────────────────────────────────────────────── Peach — Chrome Web Store Release Setup Run this once to configure Chrome publishing.sync-chrome-dist.mjs
src/
background/
aes.test.tsaes.tsaes.ts — AES-256-GCM encrypt/decrypt primitives for vault storage.alarms.test.tsalarms.tschirp-identity.tsLocal-device identity helpers for the chirp-sync architecture.chirp-sync-coordinator.test.tschirp-sync-coordinator.tsChirp Sync — Phase 2 manifest-diff coordinator.chirp-sync-runner.test.tschirp-sync-runner.tsProduction sync runner — composes the live vault adapter, WebSocket transport, and coordinator into the function the dispatcher injects via
setSyncRunner.chirp-sync-static.test.tsIV.7 — Static safety assertions for Chirp Sync.chirp-sync-vault-adapter.test.tschirp-sync-vault-adapter.tsProduction adapter that backs runChirpSyncInitiator with the live vault.clipboard.test.tsclipboard.tscodex-handlers.test.tsTests for src/background/codex-handlers.ts.codex-handlers.tscodex-handlers.ts — message handlers that back the Peach Codex flow.commands.tsKeyboard command handler — routing for summon-inline: 1.entry.tshealth.test.tshealth.tshealth.ts — Pro advanced vault health analysis.index.tslicense.tsmessages.adversarial.test.tsmessages.adversarial.test.ts — Layer 3 §3.3 adversarial message handler tests.messages.test.tsmessages.tsmessages.ts — the only background message handler.ml.tsnotes.test.tspaired-devices.test.tspaired-devices.tsPaired-device registry — v3 chirp-sync.passkey-chrome-ceremony.test.tspasskey-chrome-ceremony.test.ts — covers the Chrome chrome.webAuthenticationProxy ceremony path that the Firefox-proxy test file does NOT exercise.passkey-crypto.test.tspasskey-crypto.tspasskey-deny-on-close.test.tspasskey-deny-on-close.test.ts — M8/COR-009passkey-firefox-proxy.test.tspasskey-firefox-proxy.test.ts — covers the v2.12.0 Firefox content-script proxy path.passkey.tsrecovery-pending.tsPersistent flag set while the user has just created a vault and is reading their 12 recovery words but has not yet typed the 3 confirmation words.recovery-words.test.tsrecovery.adversarial.test.tsrecovery.adversarial.test.ts — Layer 3 §3.2 adversarial recovery words tests.self-test.test.tsself-test.tsself-test.ts — Known-Answer Test (KAT) for the Peach crypto stack.sync-trigger.test.tssync-trigger.tssync-trigger.ts — central sync dispatcher.vault-history.test.tsVault history tests.vault.adversarial.test.tsvault.adversarial.test.ts — Layer 3 §3.1 adversarial vault tests.vault.test.tsvault.tsvault.ts — sole owner of vault state and chrome.storage vault keys.content/
passkey-toast/
crypto/
argon2.test.tsargon2.tscrypto.test.tspeachPayload.test.tspeachPayload.tspeachPayload.ts — binary payload format shared by PeachScript and the Peach QR matrix code (spec §2).peachScript.test.tspeachScript.tspeachScript.ts — PeachScript encoding/decoding.totp.tszstd.tsThin wrapper around @bokuweb/zstd-wasm that defers WASM load until the first compress/decompress call and memoises the init promise.
popup/
codex/
aztec.tsaztec.ts — Aztec 2D barcode generation with round-trip verification.browser-bundle.test.tscodex.adversarial.test.tscodex.adversarial.test.ts — Layer 3 §3.4 adversarial Codex tests.codex.suite.test.tscodex.suite.test.ts — cross-cutting regression suite for the Codex pipeline.codex.test.tsconfirmation.tsPick 3 distinct positions in [1, 12] for the recovery-words confirmation gate.erasure.tserasure.ts — Reed-Solomon erasure coding around the WASM library.generate.test.tsgenerate.tsgenerate.ts — full Codex generation pipeline.helpers.tshelpers.ts — shared utilities for Codex generation and restoration.node-wasm.tsNode-only WASM byte loader for Vitest.pdf-import.test.tspdf-import.test.ts — coverage for the testable surface of the PDF import path.pdf-import.tspdf-import.ts — restore from a Codex PDF instead of a camera scan.pdf-layout.tspdf-layout.ts — A4 Codex page geometry shared between the generator and the PDF importer.pdf.tspdf.ts — render the printable Codex PDF.reed-solomon.tsBrowser-safe wrapper around the Reed-Solomon WASM exports.restore.test.tsrestore.test.ts — coverage for ChunkBuffer, parseRawScan, reconstructAndVerify.restore.tsrestore.ts — Peach Codex restoration library (popup-side).rs-loader.tsrs-loader.ts — load the Reed-Solomon erasure WASM module.scanner.tsscanner.ts — camera-based Aztec scanning for Codex restoration.
components/
views/
Add.tsxChirpSync.tsxChirpSync — the v3 Settings → Sync surface.CodexGenerateView.test.tsx@vitest-environment jsdomCodexGenerateView.tsxPeach Codex — generation view.CodexRestoreView.tsxPeach Codex — restoration view.contracts.test.tsx@vitest-environment jsdomEntry.tsxExport.csv.test.ts@vitest-environment jsdomExport.tsxSignal-conditioned views in this file must use <Show>, never a signal-conditioned early return (
if (signal()) return <X/>).Health.test.tsx@vitest-environment jsdomHealth.tsxImport.tsxSignal-conditioned views in this file must use <Show>, never a signal-conditioned early return — see Projects.md §4.1.Lock.tsxNoteEditor.toHtml.test.ts@vitest-environment jsdomNoteEditor.tsxNotesEditor.tsxNotesMode.tsxNotesTOC.tsxOnboarding.tsxPanic.tsxPasskeyApproval.tsxProCelebration.tsxRecoveryWordDisplay.tsxRecoveryWordEntry.tsxSettings.tsxTrashView.tsxVault.tsxview-test-utils.tsxshared/
backup.test.tsbackup.tsbridge.tsbrowser.test.tsbrowser.test.ts — locks down feature-detected browser identification.browser.tsbrowser.ts — feature-detected browser identifier shared by background, popup, and content scripts.chirp-handshake.test.tschirp-handshake.tsPost-chirp pairing handshake.chirp-pairing.test.tschirp-pairing.tsAudio pairing driver — orchestrates the two-chirp exchange that bootstraps trust between two devices in the same room.chirp-payload.test.tschirp-payload.tsAudio pairing payload — 64 bytes on the wire.chirp-sync-transport.test.tsSubnet-probe rate-limit tests.chirp-sync-transport.tsWebSocket sync transport — v3 chirp-sync Phase 2.codex-types.tscodex-types.ts — shared shapes for the Peach Codex.config.tsWeb3Forms access key for the in-app feedback form (Settings → feedback).device-manifest.test.tsdevice-manifest.tsDevice manifest — v2 brief §4.3.domain.tsfavicon.test.tsfavicon.tsResolves a favicon URL for a given domain.generate.test.tsgenerate.tsggwave.test.tsggwave.tsggwave loader — thin async wrapper around the ggwave-wasm module.import.test.tsimport.ts
any is intentional throughout this module (L17/I3/QUA-010): import files are user-supplied external JSON whose schemas vary by source app and version (1Password CPG, Bitwarden, CXF, generic CSV).local-network.tsLocal network discovery — minimal helper used by chirp pairing.ml.tsnative.tsMobile platform detection helpers used by popup views to gate Capacitor-only paths.noise-js.test.tsNoise NK auth proof regression test.noise-js.tsNoise NK initiator for Android / Capacitor.noise-xx.test.tsnoise-xx.tsNoise XX (mutual auth) — used for every Phase-2 WebSocket connection after the audio chirp pairing has stamped each side into the other's paired-device registry.passkey-flags.tspasskey-flags.ts — single switch for the Firefox passkey content-script proxy.passkey-utils.test.tspasskey-utils.tspasskey-utils.ts — WebAuthn relying-party-id validation.recovery-word-list.tsrecovery-word-list.ts — 2048-word recovery word list for Peach vault recovery.recovery-words.tsrecovery-words.ts — BIP39-compatible recovery word encoding for Peach vault recovery.shortcuts.test.ts@vitest-environment jsdomshortcuts.tsshortcuts.ts — keybinding schema, defaults, matcher, formatter.storage.tssync-identity.test.tssync-identity.tsSync identity — long-term X25519 keypair tied to the vault, not the device installation.sync-types.tsChirp Sync — type definitions (Master Brief v2).types.tstypes.ts — cross-boundary types and the MessageType union.tests/
fixtures/
history
819c2b01c71cfix(security): enforce Firefox passkey rpId against the browser-attested sender origin, not page-supplied payload.origin — closes cross-origin assertion/credential forgery; verify clientDataJSON origin; scope HAS_CREDENTIALS+GET_PASSKEY_FOR_DOMAIN to caller origin (CRITICAL) (v3.6.123)5 months ago77d4f52c16bbindependent security audit — full line-by-line review begins5 months ago00429fe70a82refactor: remove dead chrome.storage.sync paired-device migration — registry is local-only, no sync evacuation path needed; zero storage.sync references in paired-devices.ts (v3.6.122)5 months ago811c39d3ce63audit resolution complete — all findings resolved v3.6.1215 months ago9767a70364eafix(data): PeachScript passkey entry encodes all login fields — totp, notes, tags, email, canary, additionalUrls, passwordChangedAt, breach preserved on export; backward-compatible via JSON blob (v3.6.121)5 months ago2b15bb2c1fddfix(security): Firefox passkey rpId↔origin validation — reject cross-origin rpId spoofing in handleFirefoxPasskeyCreate/Get via new isValidRpId (v3.6.120)5 months agodd13df9e1692fix(sync): derive sync identity from rootKey not derivedKey — vault_id, Noise XX static key, Ed25519 signing key and per-entry envelope keys stay stable across password rotation (v3.6.119)5 months ago2de264de1091feat: expose getRootKeyHex — stable per-vault root key, invariant across password change (already escrowed via recovery words + pw_root_*); foundation for password-independent sync identity (v3.6.118)5 months ago13728285815bdocs: inline notes for tombstone accumulation, per-entry LWW limitation, flags2 format caution; expand Projects.md §3.8 with full permission list and justifications (v3.6.117)5 months ago3bc26b9c7542fix(security): GET_ENTRY_FOR_FILL sends 6-digit TOTP code not seed — autofill+tray can't derive future codes; edit form uses new GET_ENTRY_FOR_EDIT to keep the seed; correct stale HKDF comment in chirp-sync-vault-adapter (v3.6.116)5 months ago9a0edc58db45fix(sw): await restoreFromSession before setupMessageHandler — no spurious lock screen on service-worker respawn (v3.6.115)5 months ago2c1167340654fix(data): updateEntry and deleteEntry roll back in-memory state on persist failure — no disk/memory divergence on quota error (v3.6.114)5 months agob0d0f5e59a28fix(sync): per-entry modifiedAt/deletedAt monotonic — clock-skew no longer discards local edits in LWW merge (v3.6.113)5 months agob5de3f75e43afix(sync): sync_received writes do not advance vault version — no-op sync optimisation restored, prevents ping-pong (v3.6.112)5 months ago19da2c5da38dfix(data): normalizeEntry preserves passwordChangedAt — aged-password health uses correct date across lock/unlock (v3.6.111)5 months ago66b318659107fix: DESTROY_VAULT preserves peach_license and peach_pro_celebrated — Pro survives vault reset; drop unused beforeEach import unblocking typecheck (v3.6.110)5 months ago49d919333ee0audit resolution — all findings — begins at v3.6.1095 months agoc51527dada23add comprehensive live audit report — findings plus CONFIRMED-CORRECT inventory (docs only)5 months ago1318b332a48bcomprehensive live audit v3.6.109 — read-only phase begins5 months agoe50cd95264aafix: complete*Request safe-wraps 'Invalid requestId' from Chrome-cancelled requests (conditional-UI gets cancel fast); onRequestCanceled now clears unlock waiters; log every proxy entry point; 3 new tests (v3.6.109)5 months ago5c2e4bb0970adiag: log every branch in handleCreateRequest, setupPasskeyProxy, attachPasskeyProxy, denyAllPendingPasskeyRequests — instant-fail with no SW errors leaves no signal otherwise (v3.6.108)5 months ago549991994e90test: add passkey-chrome-ceremony.test.ts (20 tests) and browser.test.ts (17 tests) — locks down isUvpaa unconditional true, locked-vault wait-for-unlock, page-origin clientDataJSON, signCount persistence, Pro gating, attach-target selection; covers Chromium derivatives (Brave/Edge/Vivaldi/Opera/Arc) and Firefox derivatives (LibreWolf/Floorp) via feature detection (v3.6.107)5 months ago46a7aa189940before comprehensive passkey test coverage5 months ago2c99399f84d6fix: isUvpaa returns true unconditionally (was gated on unlock — caused 'passkey can't be created on this device'); handleCreateRequest now waits for unlock instead of immediately rejecting (v3.6.106)5 months ago9b1e359cf8d6fix: clientDataJSON.origin uses page origin (active tab) instead of https://<rpId> — fixes passkey create/get on Google subdomains (v3.6.105)5 months agoccf38e50bdc9before passkey clientDataJSON origin fix5 months ago3401db8ce65afeat: TOTP popup on multi-digit OTP boxes — no icon, fill all boxes at once (v3.6.104)5 months ago601ee3c2c1abfix: skip individual OTP digit boxes (maxlength=1) in all icon injection paths (v3.6.103)5 months agof262c65e6083support email-first, password-step, and all multi-step login flows (v3.6.102)5 months ago2b15820d0bc0before form detection regression investigation5 months ago7ab9d24c2796release v3.6.101 to Firefox AMO (signed xpi)5 months ago7a2e7c26d978rename extension to 'Peach Password Manager' and bump to v3.6.1015 months ago953f200f4fd4add release.ts, setup-chrome-release.sh, and release/release:chrome npm scripts5 months agod4460bd9f432before chrome release pipeline setup5 months ago1eb81220588efix: inline popup search reaches full vault + back-arrow returns to silver platter (v3.6.100)5 months agod9877efa8475before fix: vault-wide search from silver platter + back-to-platter affordance5 months agoa79d48cbd868docs: record v3.6.99 inline popup search affordance + carried-over v3.6.985 months agoaa7bb5ef2536feat: add type-to-search escape hatch from inline popup silver platter (v3.6.99)5 months ago827c7e4a4890fix: Codex restore preserves stringified slot payloads + bootstrap native sync runner from popup (v3.6.98)5 months ago8266c804b32ebefore saving carried-over codex slot fix + native sync bootstrap + adding inline-popup search affordance5 months agod450644cd03ddocs: record shared Koh discipline memory5 months agod4cbd1899697before adding koh discipline memory5 months ago31c72b10861afix: Improve Codex PDF restore parity and shortfall handling (v3.6.95)5 months ago3845dc12335fbefore codex master repair — all fixes5 months ago170ec6d1d817docs: Add detailed Codex import findings5 months ago7bcab6978a52docs: Record Codex import exploration findings5 months agod5781a023a33checkpoint: before Codex import/page-count exploration5 months agoc0bfacc04e65update tests to allow empty login passwords — reflects email+OTP account support5 months ago72b4d869e53dallow login entries with no password — support email+OTP accounts; update Get Peach Pro URL to Polar checkout (v3.6.94)5 months ago35bc480f3621add web-ext sign script, source packaging, and one-command release (v3.6.93)5 months ago
details
Peach
A free, open source, local-first password manager for Chrome, Firefox, and Android.
Peach encrypts your vault on your device. No hosted vault, subscription, or account is required to use it.
Features
- Passwords, cards, and secure notes — keep your private data together in one encrypted vault
- Inline autofill — fill and save credentials without leaving the page
- TOTP built in — generate two-factor codes without a separate authenticator
- Password health — find weak, reused, and exposed passwords
- Portable backups — export and restore with PeachScript or a
.peachfile
Peach Pro adds:
- Peach Sync — end-to-end encrypted sync across paired devices
- Passkeys — save and use passkeys in Chrome and Firefox
- Peach Codex — print an encrypted, scannable backup of your vault
- Advanced vault health, Canary Entries, and duress tools
See the Peach website for current availability and Pro details.
Install
Open Source
Peach is released under the GPL v3. This repository contains Peach's Chrome and Firefox browser extensions. Android is maintained separately.
The source is hosted on Kepr, Asha Software's version control platform.
Security
Vault data is encrypted with AES-256-GCM and protected by Argon2id key derivation. Peach Sync authenticates paired devices and encrypts data in transit.
Implementation details live alongside the code:
Building
bun install --frozen-lockfile
bun run build
Builds are written to dist-chrome/ and dist-firefox/.
Built by Asha Software · [email protected]