peach-browser
A free, open source, local-first password manager for Chrome, Firefox, and Android.
TypeScript
timeline
atlas547 files
.deepsec/This directory holds the deepsec config for the parent repo.
data/
peach-browser/
files/
src/
background/
aes.ts.jsonchirp-identity.ts.jsonchirp-sync-coordinator.ts.jsonchirp-sync-vault-adapter.ts.jsonclipboard.ts.jsoncodex-handlers.ts.jsondesktop-pairing-bg.ts.jsondesktop-pairing-mdns.ts.jsondesktop-pairing-probe.ts.jsondesktop-pairing.ts.jsonhealth.ts.jsonlicense.ts.jsonmessages.ts.jsonoffscreen.ts.jsonpasskey-crypto.ts.jsonpasskey.ts.jsonrecovery-pending.ts.jsonself-test.ts.jsonsync-alerts.ts.jsonsync-trigger.ts.jsonvault.ts.json
content/
popup/
codex/
components/
views/
Add.tsx.jsonAdoptVaultView.tsx.jsonChirpSync.tsx.jsonCodexGenerateView.tsx.jsonCodexRestoreView.tsx.jsonEntry.tsx.jsonExport.tsx.jsonHealth.tsx.jsonImport.tsx.jsonLock.tsx.jsonNoteEditor.tsx.jsonNotesEditor.tsx.jsonNotesMode.tsx.jsonNotesTOC.tsx.jsonOnboarding.tsx.jsonPanic.tsx.jsonRecoveryWordDisplay.tsx.jsonSettings.tsx.jsonvault-search.ts.jsonVault.tsx.json
shared/
backup.ts.jsonchirp-adopt.ts.jsonchirp-handshake.ts.jsonchirp-pairing.ts.jsonchirp-payload.ts.jsonchirp-sync-transport.ts.jsoncodex-types.ts.jsonconfig.ts.jsondevice-manifest.ts.jsondomain.ts.jsongenerate.ts.jsonimport.ts.jsonlocal-network.ts.jsonnative.ts.jsonnoise-js.ts.jsonpasskey-utils.ts.jsonrecovery-word-list.ts.jsonrecovery-words.ts.jsonshortcuts.ts.jsonsync-identity.ts.jsonsync-types.ts.jsontypes.ts.json
runs/
crypto-core/
public/
codex/
fonts/
models/
scripts/
build-noise-core.mjsbuild-peachscript.pyBuild PeachScript-Regular.otf — 256 historical-runic glyphs.check-sw-static-imports.mjsFails the build if any chunk reachable from the MV3 service worker still contains a runtime
import().ci.tsclean-chrome-dist.mjsclean-firefox-artifacts.mjsgenerate-kat.mjsgenerate-kat.mjs — recompute the pinned ciphertext for self-test.ts (PCH-01-020).package-amo-source.shpackage-amo-source.sh — produce peach-3.6.65-source.zip for AMO review.release-firefox.tsrelease.tssetup-chrome-release.sh───────────────────────────────────────────────────────────────────────────── Peach — Chrome Web Store Release Setup Run this once to configure Chrome publishing.sync-chrome-dist.mjssrc/
background/
aes.test.tsaes.tsaes.ts — AES-256-GCM encrypt/decrypt primitives for vault storage.alarms.test.tsalarms.tsclipboard.double-failure.test.tsT-037: clipboard double-failure / alreadyWritten pathclipboard.test.tsclipboard.tsClipboard write + reliable auto-clear — audit fix HV-2.codex-handlers.test.tsTests for src/background/codex-handlers.ts.codex-handlers.tscodex-handlers.ts — message handlers that back the Peach Codex flow.commands.tsKeyboard command handler — routing for summon-inline: 1.device-identity.test.tsdevice-identity.tsLocal-device identity helpers for the sync architecture.entry.lock-port.test.tsLV-5: the lock-on-close onConnect listener accepts only our popup port (legacy bare "popup" or nonce'd "popup-<uuid>") and ignores anything else.entry.tshealth.test.tshealth.tshealth.ts — Pro advanced vault health analysis.license.tslicense.verification.test.tsT-009: License Ed25519 signature verificationlocked-sync-spool.test.tslocked-sync-spool.tsmesh-relay-listener.test.tsmesh-relay-listener.tsmessages.adversarial.test.tsmessages.adversarial.test.ts — Layer 3 §3.3 adversarial message handler tests.messages.batch-sanitize.test.tsT-008: PCH-01-016 batch-add canary/tag sanitizationmessages.create-vault-from-root-key.test.tsmessages.edit-origin.test.tsT-022: GET_ENTRY_FOR_EDIT via sender.url + locked-vault AUTOFILL_QUERYmessages.test.tsmessages.tsmessages.ts — the only background message handler.ml.predictbatch.test.tsT-030: ml.ts predictBatch — batch sizes, softmax stability with extreme weightsml.tsnotes.test.tsoffscreen.htmloffscreen.tsOffscreen document script — audit fix HV-2c.paired-devices.test.tspaired-devices.tsPaired-device registry — v3 sync.passkey-chrome-ceremony.test.tspasskey-chrome-ceremony.test.ts — covers the Chrome chrome.webAuthenticationProxy ceremony path that the Firefox-proxy test file does NOT exercise.passkey-crypto.test.tspasskey-crypto.tspasskey-deny-on-close.test.tspasskey-deny-on-close.test.ts — M8/COR-009passkey-firefox-proxy.test.tspasskey-firefox-proxy.test.ts — covers the v2.12.0 Firefox content-script proxy path.passkey.ed25519.test.tsT-015: Ed25519 passkey round-trippasskey.tspending-vouched-devices.test.tspending-vouched-devices.tsPending vouched devices — audit fix MV-7.recovery-pending.tsPersistent flag set while the user has just created a vault and is reading their 12 recovery words but has not yet typed the 3 confirmation words.recovery-words.test.tsrecovery.adversarial.test.tsrecovery.adversarial.test.ts — Layer 3 §3.2 adversarial recovery words tests.relay-adoption-bg.test.tsrelay-adoption-bg.tsself-test.test.tsself-test.tsself-test.ts — Known-Answer Test (KAT) for the Peach crypto stack.sync-alarm.test.tssync-alarm.tssync-alarm.ts — the 10-minute background sync tick.sync-alerts.test.tssync-alerts.tsPending sync security alerts.sync-coordinator.test.tssync-coordinator.tsVault sync — Phase 2 manifest-diff coordinator.sync-runner.test.tssync-runner.tsProduction sync runner — composes the live vault adapter, WebSocket transport, and coordinator into the function the dispatcher injects via
setSyncRunner.sync-settings.test.tssync-settings.tssync-static.test.tsIV.7 — Static safety assertions for vault sync.sync-trigger.test.tssync-trigger.tssync-trigger.ts — central sync dispatcher.sync-vault-adapter.test.tssync-vault-adapter.tsProduction adapter that backs runSyncInitiator with the live vault.vault-createVaultFromRootKey.test.tsvault-history.test.tsVault history tests.vault.adversarial.test.tsvault.adversarial.test.ts — Layer 3 §3.1 adversarial vault tests.vault.consolidate-passkeys.test.tsT-023: vault.consolidatePasskeyEntries — passkey merge with lastUsed rankingvault.corruption.test.tsT-018: Vault corruption vs wrong-password discrimination (M7/COR-007)vault.duress-adoption.test.tsvault.hibp-padding.test.tsPCH-02-007 regression tests — the HIBP k-anonymity range request must ask for response padding, and the parser must stay correct on padded responses.vault.purge-trash.test.tsT-024: vault.purgeExpiredTrash — retention cutoff boundaryvault.rotate-sync-identity.test.tsT-016: rotateSyncIdentity — new root key, cleared peers, recovery pendingvault.session-escrow.test.tsvault.sync-clamp.test.tsUnit tests for HV-1 — sync timestamp clamp + remote-mutation alerts.vault.test.tsvault.tsvault.ts — sole owner of vault state and chrome.storage vault keys.vault.update-entry-sanitize.test.tsPCH-02-001 regression tests — UPDATE_ENTRY patch path must route canary/tags/passkey through the same sanitizers the add/restore/sync funnels use (sanitizeCanary / sanitizePasskey / sanitizeTags).content/
passkey-toast/
crypto/
argon2.test.tsargon2.tsargon2id.kat.test.tsT-019: Argon2id known-answer test (KAT) + parameter assertioncrypto.test.tsdecompression-bomb.test.tsMV-4: decompression-bomb output bounds on the zstd and pako legs.official-vectors.test.tspeachPayload.binaryreader-bounds.test.tsPCH-02-008 regression tests — BinaryReader must bound every read and fail with the decoder's existing PAYLOAD_TOO_SHORT code on truncated input.peachPayload.bomb.test.tsT-005: peachPayload declared-length decompression bomb (MV-4)peachPayload.test.tspeachPayload.tspeachPayload.ts — binary payload format shared by PeachScript and the Peach QR matrix code (spec §2).peachScript.test.tspeachScript.tspeachScript.ts — PeachScript encoding/decoding.totp.rfc6238.test.tsT-004: TOTP RFC 6238 known-answer vectorstotp.test.tstotp.tszstd.tsThin wrapper around @bokuweb/zstd-wasm that defers WASM load until the first compress/decompress call and memoises the init promise.
drafts/
PCH-02-FIXES/Drafts for all 10 findings of peach-code-review.md (Fable 5, 2026-06-12): 1 Low (PCH-02-001), 9 Informational.
clipboard.hash-match.test.tsPCH-02-010 regression tests (Option B only) — the auto-clear must compare the live clipboard hash (computed inside the offscreen document) against the parked SHA-256 before wiping, and must stay conservative when the comparison is unavailable.INTEGRATION-CONTRACT.mdSource of truth for integrating these drafts.PCH-02-001-vault-patch-sanitizers.patch.mdSeverity: Low (the only non-Informational finding in PCH-02) Target file:
src/background/vault.ts — sanitizeEntryPatch, lines 2375–2388 Report: peach-code-review.md, Finding PCH-02-001PCH-02-003-sas-trust-model-comment.patch.mdSeverity: Informational Target file: src/shared/chirp-handshake.ts:125-154 (the SECURITY block) Report: peach-code-review.md, Finding PCH-02-003PCH-02-004-exact-pin-deps.patch.mdSeverity: Informational Target files: package.json:40-46, bun.lock (regenerated), new WASM-PROVENANCE.md (see deviation note) Report: peach-code-review.md, Finding PCH-02-004PCH-02-005-legacy-pbkdf2-doc.patch.mdSeverity: Informational Target files: src/shared/backup.ts:146 (derivePeachExportKey), src/popup/views/Import.tsx (re-export notice) Report: peach-code-review.md, Finding PCH-02-005PCH-02-007-hibp-add-padding.patch.mdSeverity: Informational Target file: src/background/vault.ts:230 (checkBreach) Report: peach-code-review.md, Finding PCH-02-007PCH-02-008-binaryreader-bounds.patch.mdSeverity: Informational Target file: src/crypto/peachPayload.ts:940-969 (BinaryReader) Report: peach-code-review.md, Finding PCH-02-008PCH-02-010-clipboard-hash-match.patch.mdSeverity: Informational Target files: src/background/clipboard.ts:124-178 (clearClipboardNow), src/background/offscreen.ts, manifest.json (⚠ permission), comment in clipboard.ts:18-19 Report: peach-code-review.md, Finding PCH-02-010peachPayload.binaryreader-bounds.test.tsPCH-02-008 regression tests — BinaryReader must bound every read and fail with the decoder's existing PAYLOAD_TOO_SHORT code on truncated input.README.mdDrafts for all 10 findings of peach-code-review.md (Fable 5, 2026-06-12): 1 Low (PCH-02-001), 9 Informational.vault.hibp-padding.test.tsPCH-02-007 regression tests — the HIBP k-anonymity range request must ask for response padding, and the parser must stay correct on padded responses.vault.update-entry-sanitize.test.tsPCH-02-001 regression tests — UPDATE_ENTRY patch path must route canary/tags/passkey through the same sanitizers the add/restore/sync funnels use (sanitizeCanary / sanitizePasskey / sanitizeTags).WASM-PROVENANCE.mdPeach's vault security rests on a small set of third-party packages that either ship WebAssembly blobs or sit directly on a security path.TEST-EXPANSION/
argon2id.kat.test.tsT-019: Argon2id known-answer test (KAT) + parameter assertionbackup.nfc-fallback.test.tsT-006: backup/import NFC raw-fallback decrypt (LV-1 / PCH-01-001 sibling)clipboard.double-failure.test.tsT-037: clipboard double-failure / alreadyWritten pathcodex.multistripe.test.tsT-017: Codex multi-stripe round-tripcontent.orchestration.test.tsT-011 through T-014: index.ts autofill orchestrationgenerate.empty-pool.test.tsT-025: generate.ts empty-pool guard, 128-char boundary, minLength > maxLengthimport.csv.formulainjection.test.tsT-021: CSV formula-injection on import (round-trip)INTEGRATION-CONTRACT.mdGenerated by session:
test coverage expansion Agent: claude-sonnet-4-6 Priority 1: T-001–T-010 (10 files), Priority 2: T-011–T-024 (11 files, T-011–T-014 in one file), Priority 3: T-025, T-030, T-037 (3 files)license.verification.test.tsT-009: License Ed25519 signature verificationmessages.batch-sanitize.test.tsT-008: PCH-01-016 batch-add canary/tag sanitizationmessages.edit-origin.test.tsT-022: GET_ENTRY_FOR_EDIT via sender.url + locked-vault AUTOFILL_QUERYml.predictbatch.test.tsT-030: ml.ts predictBatch — batch sizes, softmax stability with extreme weightspasskey.ed25519.test.tsT-015: Ed25519 passkey round-trippdf-import.sandbox.test.tsT-007: MV-9 pdf.js sandbox flags regression testpeachPayload.bomb.test.tsT-005: peachPayload declared-length decompression bomb (MV-4)recovery-words.checksum.test.tsT-002: BIP39 checksum rejectionrecovery-words.integrity.test.tsT-001: BIP39 word-list integrityrecovery-words.kek.test.tsT-003: 128-bit prefix-KEK invariant (PCH-01-005 sibling)sync.disconnect.test.tsT-020: WebSocket sync-disconnect handling (PCH-01-026 #9)totp.rfc6238.test.tsT-004: TOTP RFC 6238 known-answer vectorsvault.consolidate-passkeys.test.tsT-023: vault.consolidatePasskeyEntries — passkey merge with lastUsed rankingvault.corruption.test.tsT-018: Vault corruption vs wrong-password discrimination (M7/COR-007)vault.purge-trash.test.tsT-024: vault.purgeExpiredTrash — retention cutoff boundaryvault.rotate-sync-identity.test.tsT-016: rotateSyncIdentity — new root key, cleared peers, recovery pendingmobile/
popup/
codex/
aztec.tsaztec.ts — Aztec 2D barcode generation with round-trip verification.browser-bundle.test.tscodex.adversarial.test.tscodex.adversarial.test.ts — Layer 3 §3.4 adversarial Codex tests.codex.multistripe.test.tsT-017: Codex multi-stripe round-tripcodex.suite.test.tscodex.suite.test.ts — cross-cutting regression suite for the Codex pipeline.codex.test.tsconfirmation.tsPick 3 distinct positions in [1, 12] for the recovery-words confirmation gate.erasure.tserasure.ts — Reed-Solomon erasure coding around the WASM library.generate.test.tsgenerate.tsgenerate.ts — full Codex generation pipeline.helpers.tshelpers.ts — shared utilities for Codex generation and restoration.node-wasm.tsNode-only WASM byte loader for Vitest.pdf-import.clamp.test.tspdf-import.sandbox.test.tsT-007: MV-9 pdf.js sandbox flags regression testpdf-import.test.tspdf-import.test.ts — coverage for the testable surface of the PDF import path.pdf-import.tspdf-import.ts — restore from a Codex PDF instead of a camera scan.pdf-layout.tspdf-layout.ts — A4 Codex page geometry shared between the generator and the PDF importer.pdf.tspdf.ts — render the printable Codex PDF.reed-solomon.tsBrowser-safe wrapper around the Reed-Solomon WASM exports.restore.test.tsrestore.test.ts — coverage for ChunkBuffer, parseRawScan, reconstructAndVerify.restore.tsrestore.ts — Peach Codex restoration library (popup-side).rs-loader.tsrs-loader.ts — load the Reed-Solomon erasure WASM module.scanner.tsscanner.ts — camera-based Aztec scanning for Codex restoration.
components/
GeneratorDrawer.test.tsGeneratorDrawer.tsxLockRuneCanvas.tsxNoteRow.tsxNoteRunes.tsxNoteToolbar.tsxPairingBirds.tsxPairing birds — the two illustrated characters used on the pairing screens.PairingProRequired.tsxPairingQrCode.tsxPeachMark.tsxRecoveryRuneBackground.tsxRuneBackground.tsxRuneCanvas.tsxSyncModeSelector.test.tsx@vitest-environment jsdomSyncModeSelector.tsxSyncModeSelector — the one place the relay choice is made.
views/
Add.tsxAdoptVaultView.test.tsx@vitest-environment jsdomAdoptVaultView.tsxCodexGenerateView.test.tsx@vitest-environment jsdomCodexGenerateView.tsxPeach Codex — generation view.CodexRestoreView.test.tsx@vitest-environment jsdomCodexRestoreView.tsxPeach Codex — restoration view.contracts.test.tsx@vitest-environment jsdomEntry.tsxExport.csv.test.ts@vitest-environment jsdomExport.tsxSignal-conditioned views in this file must use <Show>, never a signal-conditioned early return (
if (signal()) return <X/>).Health.test.tsx@vitest-environment jsdomHealth.tsxImport.tsxSignal-conditioned views in this file must use <Show>, never a signal-conditioned early return — see Projects.md §4.1.InitialSyncView.test.tsx@vitest-environment jsdomInitialSyncView.tsxLock.tsxNoteEditor.toHtml.test.ts@vitest-environment jsdomNoteEditor.tsxNotesEditor.tsxNotesMode.tsxNotesTOC.tsxOnboarding.tsxPairDevice.test.tsx@vitest-environment jsdomPairDevice.tsxPairDevice — the pairing surface, opened from the Settings → Sync card.Panic.tsxPasskeyApproval.tsxProCelebration.tsxRecoveryWordDisplay.tsxRecoveryWordEntry.tsxSettings.tsxTrashView.tsxvault-search.test.tsvault-search.tsVault.tsxview-test-utils.tsxzxcvbn-strength.test.tsLV-8: the @zxcvbn-ts replacement must score the master-password strength meter on the same 0-4 scale as the old zxcvbn, with dictionaries loaded (language-common is what keeps weak passwords from scoring optimistically).shared/
noise-core-wasm/
any is intentional throughout this module (L17/I3/QUA-010): import files are user-supplied external JSON whose schemas vary by source app and version (1Password CPG, Bitwarden, CXF, generic CSV).initial-sync.test.tsinitial-sync.tsmesh-peer-role.tsml.tsnative.tsMobile platform detection helpers used by popup views to gate Capacitor-only paths.noise-blake2s-kat.test.tsnoise-core.tsnoise-js.test.tsNoise NK auth proof regression test.noise-js.tsNoise NK initiator for Android / Capacitor.noise-kk.test.tsnoise.reject-zero-dh.test.tsPCH-02-009 regression tests — every Noise NK DH must reject an all-zero shared secret (low-order / identity peer point) instead of feeding it into the key schedule.pairing-dial.tsThe dialling half of code pairing — shared by device pairing and vault adoption.pairing-handshake.test.tspairing-handshake.tsPairing handshake — Noise NK, the SAS, and the PAIR_IDENTITY frame.pairing-handshake.vault-id.test.tsChange 1 — vault_id in the PAIR_IDENTITY frame.pairing-invitation.test.tspairing-invitation.tspasskey-flags.tspasskey-flags.ts — single switch for the Firefox passkey content-script proxy.passkey-utils.test.tspasskey-utils.tspasskey-utils.ts — WebAuthn relying-party-id validation.recovery-word-list.tsrecovery-word-list.ts — 2048-word recovery word list for Peach vault recovery.recovery-words.checksum.test.tsT-002: BIP39 checksum rejectionrecovery-words.cross-platform.test.tsrecovery-words.integrity.test.tsT-001: BIP39 word-list integrityrecovery-words.kek.test.tsT-003: 128-bit prefix-KEK invariant (PCH-01-005 sibling)recovery-words.tsrecovery-words.ts — BIP39-compatible recovery word encoding for Peach vault recovery.rendezvous.test.tsrendezvous.tsshortcuts.test.ts@vitest-environment jsdomshortcuts.tsshortcuts.ts — keybinding schema, defaults, matcher, formatter.storage.tssync-identity.test.tssync-identity.tsSync identity — long-term X25519 keypair tied to the vault, not the device installation.sync-kk-transport.test.tssync-limits.tsSync trust + resource bounds — audit fixes HV-1 (timestamp clamp) and MV-3 (receive-path size bounds).sync-outcome.test.tssync-outcome.tsWhy a sync run ended, in a form both the service worker and the popup can name.sync-padding.test.tssync-padding.tsE7: frame padding at the relay boundary.sync-transport.test.tsSubnet-probe rate-limit tests.sync-transport.tsWebSocket reconnect transport — Noise KK with both paired static keys.sync-types.tsVault sync — type definitions.sync.disconnect.test.tsT-020: WebSocket sync-disconnect handling (PCH-01-026 #9)types.tstypes.ts — cross-boundary types and the MessageType union.vault-adopt-snapshot.test.tsvault-adopt.test.tsvault-adopt.tstests/
fixtures/
history
5e5b58af45b5receiver auto-accepts the SAS in inverse pairing: both sides derive it from the same Noise handshake hash, so the codes match by construction. Receiver returns true from confirmSas immediately, drops the ADOPTION_SOURCE_SAS push, removes the popup's SAS phase and the RECEIVER_SAS_DECISION round-trip. Phone's 'They match' is the single user gate. Deleted waitForSasConfirmation, resolveReceiverSasConfirmation, the pendingSasConfirmation slot, and the receiver timeout. Updated test fixtures to match. (v4.3.15)3 months ago588994063c7freceiver session was swallowing the real error in its catch block. Log the actual exception via console.error and surface the message in the ADOPTION_SOURCE_RESULT push so the popup shows the real failure instead of the generic 'adoption_failed'. Bump to v4.3.15 to actually publish the logging change. (v4.3.15)3 months ago55d8aadfbe09receiver session was swallowing the real error in its catch block. Log the actual exception via console.error and surface the message in the ADOPTION_SOURCE_RESULT push so the popup shows the real failure instead of the generic 'adoption_failed'. (v4.3.16)3 months agoe97b03ea682asource flow SAS gate: START_ADOPTION_SOURCE now actually waits for the popup to confirm the 8-digit code instead of auto-approving. Mirrors the receiver's id-keyed deferred pattern (SOURCE_SAS_DECISION). Both pairing flows now have symmetric, real SAS gates. (v4.3.15)3 months agoecedb447300fPairingBirds were overlapping on the 'Add a new device' screen — 220px stage held two 108px birds at 28px inset (52px overlap). Widened the stage to 300px and moved the birds in to left/right 12px so they sit ~60px apart. (v4.3.14)3 months agoa4750a51db3cbrowser receiver loop: START_ADOPTION_RECEIVER now accepts the phone's Noise dial, receives ADOPT_GRANT, calls CREATE_VAULT_FROM_ROOT_KEY with the popup-supplied password, and pushes ADOPTION_SOURCE_RESULT. SAS confirmation goes through a new RECEIVER_SAS_DECISION message: the popup confirms via the same chrome.runtime.onMessage pipe the existing source flow already uses. AdoptVaultView re-adds the sas/success/error phases it dropped in the earlier simplification. Source-side requestConsent left as-is (TODO in task brief; touching it would change the existing source-flow test expectations). (v4.3.14)3 months ago146d23dcd148invitation carries vaultStatus: 'empty' for the onboarding receiver (no vault) and 'populated' for the Sync settings source (has vault). The phone reads this to decide its role — source or receiver — instead of guessing. Older invitations without the field parse as 'populated' (the historical default) so the existing sync is unaffected. (v4.3.13)3 months agof65d67bbb5baonboarding: reverse the QR flow. The empty extension now shows a QR (the phone scans it) instead of scanning the phone's QR. New START_ADOPTION_RECEIVER message in the background holds the rendezvous without needing a vault, and AdoptVaultView displays the result. UI-only — the phone-side reversal (sending the vault back over the existing channel) is a separate change. (v4.3.12)3 months agoee7c66358190restore the Sync settings birds: the onboarding testicle-look was the only complaint. Restored PairingBirds.tsx, the birdStage function in PairDevice.tsx, the test assertion, and the bird CSS block. (v4.3.11)3 months ago3f5891a8b076onboarding cleanup: drop the bird-pair avatars from AdoptVaultView (pair and success phases) and PairDevice — the two circles on a bar looked like testicles. Trashed PairingBirds.tsx, removed its first CSS block. Drop the 'Already have a backup?' section from Lock.tsx — the welcome screen already asks, and the test for it. (v4.3.10)3 months ago58c7a0bdb8f3notes mode: move new-note affordance from the bottom of the list to the header bar as a + glyph, so a long note list no longer hides the button below the fold (v4.3.9)3 months ago52793d6ded0asettings card scrollbar: pull the body out of the card's right padding so the thumb sits flush with the right edge, and add a matching thin Webkit scrollbar style for Chrome (v4.3.8)3 months ago52ea861750a0Entry view: notes are no longer in its navigation set, counter, or default-selection path; single nonNoteEntries memo and pickNavigable helper make the invariant hold at every fallback (v4.3.7)3 months ago3453e4d02417vault list: long-press now enters multi-select with the held row selected, and the synthesised mobile contextmenu event is suppressed so it doesn't reopen the menu and undo the gesture (v4.3.6)3 months ago88f4c97bcaabtreat a peer-closed WebSocket after entry exchange as a completed sync, not run_failed; classify mid-protocol disconnects as connection_lost (yellow) so the indicator stops turning red on syncs that demonstrably landed (v4.3.5)3 months agoaee880956950fix: Move Sync now to global status (v4.3.4)3 months agoccb6a770acb0fix: Let vault presence direct pairing (v4.3.3)3 months ago3b8b0dd8f317feat: Keep routine sync quiet (v4.3.2)3 months agoc700871e2778feat: Clean up existing-user Sync onboarding (v4.3.1)3 months agodaf6d2a04ad2feat: Simplify Sync Settings with progressive disclosure (v4.3.0)3 months ago399fb468341bfeat: Make pairing single-confirm and atomic (v4.2.18)3 months ago425e41d0ec00docs: Record first live Peach Sync completion3 months agoa7989ee758fefix: Correct large sync frame chunking (v4.2.17)3 months ago5b989b3f66e2fix: Preserve sync timeout stage (v4.2.16)3 months agoc6bed9d2aebedocs: Queue calmer Sync Settings structure3 months ago27e2e647a814fix: Reconcile paired-device revocations on startup (v4.2.15)3 months ago9faf99d62ad3fix: Repair stale paired-device removal (v4.2.14)\n\n- Remove overlapping paired rows even when a terminal revocation already exists\n- Clear old revocations after a fresh SAS-confirmed direct re-pair\n- Add regressions for both live-state shapes3 months agof1785b58565aadd unpair regression: storage revoke + UI refresh — message handler and Settings test3 months agofee1c9e1e62eadd chrome.alarms periodic sync, SW startup hook, and device-list-change trigger; reclassify network-class outcomes from error (red) to warn (yellow); bump to v4.2.133 months ago0f40221cf386fix the v4.2.11 chunking bug: a non-last chunk sliced at MAX then prepended a marker produced 65520-byte plaintexts the crypto core refused, so multi-chunk frames crashed. Now slices at MAX-1 to leave room, and a real-Noise round-trip test pins the invariant (v4.2.12)3 months ago0b24e17342fdfix the broken sync: split a too-large padded frame across Noise messages, mark the first with a continuation byte; padded frame stays 24 MiB, single-chunk path unchanged, and the bucket ladder is now provably under the 65519-byte Noise plaintext limit (v4.2.11)3 months ago4ab2a08223f8search and vault-security match the real UI: escape closes the list rather than clearing it, the filtered-empty list has its own copy, the generator opens from the list, CSP is asserted on the manifest, and four vendor-bundle greps that only ever matched pdf.js and a QR library are gone3 months agof963b19a27a4createEntryViaForm reveals the 2FA and notes fields through their '+ add' links, which is the only way those inputs exist in the new-entry form3 months agocb6120398385vault-security: the XSS checks asserted the escaped payload was absent from rendered text, which fails on correct escaping — assert instead that no script element, img or inline handler is ever created, and that GET_ENTRIES answers vault_locked once locked3 months agobd082b4a23c5playwright: point the specs at the list overlay — the top search bar is readOnly and only opens the list, so filling it or clicking new-entry from the vault stage could never work3 months agocce5d8227d4eextract the working vault setup into tests/helpers/vault.ts, which asserts it reached the unlocked vault instead of skipping creation silently; port lock-screen, entry-crud, settings, search, vault-security and vault-lifecycle onto it and drop the three assertion-free specs3 months ago9378234431eesync indicator light (pulsing green syncing / solid green healthy / red problem) plus persistent last-attempt reason in Settings and the topbar sync button (v4.2.10)3 months agode6976b06e68every terminating sync path reports a named SyncOutcome with device inventory, persisted last attempt, and [Peach sync] service-worker logs3 months ago7e3d43b00009match device revocation on the revoked long-term key, not just the self-asserted deviceId, so a revoked device cannot return under a fresh id (v4.2.9)3 months ago602463675e06record that the old feedback key had no account behind it, so a 200 success was never evidence of delivery, and narrow B5 to June confirming the test email arrived3 months ago89e76b54a2b7point feedback at the Web3Forms account that actually exists — the previous key was never set up, which is why every submission was accepted and nothing was ever delivered (v4.2.8)3 months ago70f1095eb4c1rewrite the consolidated queue around what actually blocks sync, and record the feedback diagnosis, the website rewrite, and the kapt trick that finds an unattributed Kotlin error3 months ago478a839aacaedelete the SUBMIT_FEEDBACK handler that returned ok while sending nothing, and the 261 lines of pairing-code CSS no component has referenced since the code-entry surface was removed (v4.2.7)3 months agoc8a0fc89e74dcorrect the feedback queue item: the extension's Web3Forms path works, only Android has no endpoint, and the SUBMIT_FEEDBACK handler returns ok while sending nothing3 months ago9369069f7f73record the settings-UX and relay-surfacing session, the adoption relabelling bug the fail-closed gate exposed, the adopt-screen deviation and why, and queue the feedback-backend worker without its credentials3 months ago26cd2586ed62stop the flex column stealing the bird stage's height to fit what is below it, and pay for the two new rows on the invitation screen by moving what the code contains onto the text view where the string is actually visible (v4.2.6)3 months agoc626a5aa8656put 'Show a code instead' under the QR: the same invitation as selectable text with a copy button, for a camera that will not focus (v4.2.5)3 months ago25d58a4fe204surface the relay choice on the invitation screen as a quiet change link that rebuilds the code, and say plainly on the adopt screen that the scanned code carries the relay rather than offering a choice it would overwrite (v4.2.4)3 months ago2fdc9c8169eaextract the three-state relay choice into one SyncModeSelector so Settings and the pairing surfaces cannot drift: exact disclosure line, radio-group semantics, and an empty private URL field that says sync is paused instead of quietly using the public relay (v4.2.3)3 months agoa5b058442cd7fail closed when Private relay is chosen with no URL: one relayInForce gate for sync and pairing, and stop pushing the public relay to peers under a private label (v4.2.2)3 months ago
details
Peach
A free, open source, local-first password manager for Chrome, Firefox, and Android.
Peach encrypts your vault on your device. No hosted vault, subscription, or account is required to use it.
Features
- Passwords, cards, and secure notes — keep your private data together in one encrypted vault
- Inline autofill — fill and save credentials without leaving the page
- TOTP built in — generate two-factor codes without a separate authenticator
- Password health — find weak, reused, and exposed passwords
- Portable backups — export and restore with PeachScript or a
.peachfile
Peach Pro adds:
- Peach Sync — end-to-end encrypted sync across paired devices
- Passkeys — save and use passkeys in Chrome and Firefox
- Peach Codex — print an encrypted, scannable backup of your vault
- Advanced vault health, Canary Entries, and duress tools
See the Peach website for current availability and Pro details.
Install
Open Source
Peach is released under the GPL v3. This repository contains Peach's Chrome and Firefox browser extensions. Android is maintained separately.
The source is hosted on Kepr, Asha Software's version control platform.
Security
Vault data is encrypted with AES-256-GCM and protected by Argon2id key derivation. Peach Sync authenticates paired devices and encrypts data in transit.
Implementation details live alongside the code:
Building
bun install --frozen-lockfile
bun run build
Builds are written to dist-chrome/ and dist-firefox/.
Built by Asha Software · [email protected]