peach-browser
A free, open source, local-first password manager for Chrome, Firefox, and Android.
TypeScript
timeline
atlas420 files
crypto-core/
fixtures/
public/
codex/
scripts/
build-noise-core.mjsbuild-peachscript.pyBuild PeachScript-Regular.otf — 256 historical-runic glyphs.bun-ambient.d.tsAmbient declarations for the Bun APIs the release scripts use.check-cross-client-adoption.test.tscheck-cross-client-sync.mjscheck-extension-surface.mjscheck-noise-core.mjsPB-26-003: verify the committed Noise WASM still matches crypto-core source.check-sw-static-imports.mjsFails the build if any chunk reachable from the MV3 service worker still contains a runtime
import().ci.tsclean-chrome-dist.mjsclean-firefox-artifacts.mjscross-client-gradle.init.gradlegenerate-kat.mjsgenerate-kat.mjs — recompute the pinned ciphertext for self-test.ts (PCH-01-020).manifest-parity.test.tsPB-26-610 — the source manifests are security-reviewed; the built manifests are what ships.package-source.test.tspackage-source.tsprocess-readiness.d.mtsTypes for the plain-JavaScript readiness helper (PB-26-904).process-readiness.mjsprocess-readiness.test.tsrelease-firefox.tsrelease-gate.test.tsrelease-gate.tsPB-26-210: Release browser-gate validation.release-lib.test.tsscripts/release-lib.test.ts PB-26-211: release tool hardening — security tests for the argv-based runner.release-lib.tsscripts/release-lib.ts Shared argv-based runner for release tooling (PB-26-211).release.test.tsrelease.tsroot-derivation-gate.test.tsCampaign task 2.4 — no shipping source may derive device key material from the vault root.run-release-browser-gate.tstest-firefox-passkeys.mjstest-firefox-sender-context.mjsweb-accessible-resources.test.tssrc/
background/
aes.test.tsaes.tsaes.ts — AES-256-GCM encrypt/decrypt primitives for vault storage.alarms.test.tsalarms.tsclipboard.double-failure.test.tsT-037: clipboard double-failure / alreadyWritten pathclipboard.test.tsclipboard.tsClipboard write + reliable auto-clear — audit fix HV-2.codex-handlers.test.tsTests for src/background/codex-handlers.ts.codex-handlers.tscodex-handlers.ts — message handlers that back the Peach Codex flow.commands.test.tscommands.tsKeyboard command handler — routing for summon-inline: 1.device-identity.test.tsdevice-identity.tsLocal-device identity helpers.entry.lock-port.test.tsThe lock-on-close onConnect listener accepts only our nonce'd "popup-<uuid>" port from the extension page and ignores anything else.entry.tshealth.test.tshealth.tshealth.ts — Pro advanced vault health analysis.license.tslicense.verification.test.tsT-009: License Ed25519 signature verificationlocked-sync-spool.test.tslocked-sync-spool.tsmesh-relay-listener.test.tsmesh-relay-listener.tsmessage-policy.test.tsmessage-policy.tsmessages.adversarial.test.tsmessages.adversarial.test.ts — Layer 3 §3.3 adversarial message handler tests.messages.autolock-refresh.test.tsPB-26-107: passive page traffic must not refresh the auto-lock timer.messages.batch-sanitize.test.tsT-008: PCH-01-016 batch-add canary/tag sanitizationmessages.create-vault-from-root-key.test.tsmessages.edit-origin.test.tsT-022: GET_ENTRY_FOR_EDIT via sender.url + locked-vault AUTOFILL_QUERYmessages.entry-write-origin.test.tsPB-26-106: content-script entry mutations must be bound to the entry's own domain set.messages.passkey-offer-decline.test.tsPB-26-109: the passkey offer-decline handler is page-relay, so any page's content script may send it.messages.test.tsmessages.tsmessages.ts — the only background message handler.ml.predictbatch.test.tsT-030: ml.ts predictBatch — batch sizes, softmax stability with extreme weightsml.tsnotes.test.tsoffscreen.htmloffscreen.tsOffscreen document script — audit fix HV-2c.pair-secrets.test.tspair-secrets.tspair-secrets.ts — PB-26-213: the reusable rendezvous secret must never sit in plaintext in chrome.storage.local.paired-devices.test.tspaired-devices.tsPaired-device registry — v3 sync.passkey-chrome-ceremony.test.tspasskey-chrome-ceremony.test.ts — covers the Chrome chrome.webAuthenticationProxy ceremony path that the Firefox-proxy test file does NOT exercise.passkey-crypto.test.tspasskey-crypto.tspasskey-deny-on-close.test.tspasskey-deny-on-close.test.ts — M8/COR-009passkey-firefox-proxy.test.tspasskey-firefox-proxy.test.ts — covers the v2.12.0 Firefox content-script proxy path.passkey.ed25519.test.tsT-015: Ed25519 passkey round-trippasskey.tspending-adoption-holder.test.tspending-adoption-holder.tspending-vouched-devices.test.tspending-vouched-devices.tsPending vouched devices — audit fix MV-7.recovery-pending.test.tsrecovery-pending.tsBackground-owned state set while the user has just created or rotated a vault identity and is confirming their recovery words.recovery-words.test.tsrecovery.adversarial.test.tsrecovery.adversarial.test.ts — Layer 3 §3.2 adversarial recovery words tests.relay-adoption-bg.test.tsrelay-adoption-bg.tsself-test.test.tsself-test.tsself-test.ts — Known-Answer Test (KAT) for the Peach crypto stack.storage-access.test.tsstorage-access.tsPB-26-203: the session-key escrow is only as trustworthy as the boundary around chrome.storage.session.sync-alarm.test.tssync-alarm.tssync-alarm.ts — the 10-minute background sync tick.sync-alerts.test.tssync-alerts.tsPending sync security alerts.sync-coordinator.test.tssync-coordinator.tsVault sync — Phase 2 manifest-diff coordinator.sync-generation.test.tsThe §11 secure-reset contract: the durable generation record, the six states, create-on-miss refusal, archival by generation, crash recovery at every step, and the sync gate.sync-generation.tsThe durable Sync-generation record and its state machine (protocol §11).sync-runner.test.tssync-runner.tsProduction sync runner — composes the live vault adapter, WebSocket transport, and coordinator into the function the dispatcher injects via
setSyncRunner.sync-settings.test.tssync-settings.tssync-static.test.tsIV.7 — Static safety assertions for vault sync.sync-trigger.test.tssync-trigger.tssync-trigger.ts — central sync dispatcher.sync-vault-adapter.test.tssync-vault-adapter.tsProduction adapter that backs runSyncInitiator with the live vault.vault-createVaultFromRootKey.test.tsvault-history.test.tsVault history tests.vault.adversarial.test.tsvault.adversarial.test.ts — Layer 3 §3.1 adversarial vault tests.vault.card-decline.test.tsPB-26-108: declined-card metadata must not be offline-enumerable.vault.consolidate-passkeys.test.tsT-023: vault.consolidatePasskeyEntries — passkey merge with lastUsed rankingvault.corruption.test.tsT-018: Vault corruption vs wrong-password discrimination (M7/COR-007)vault.duress-adoption.test.tsvault.entry-id-namespace.test.tsvault.hibp-padding.test.tsPCH-02-007 regression tests — the HIBP k-anonymity range request must ask for response padding, and the parser must stay correct on padded responses.vault.purge-trash.test.tsT-024: vault.purgeExpiredTrash — retention cutoff boundaryvault.rotate-sync-identity.test.tsT-016: rotateSyncIdentity — new root key, cleared peers, recovery pendingvault.session-escrow.test.tsvault.sync-clamp.test.tsUnit tests for HV-1 — sync timestamp clamp + remote-mutation alerts.vault.test.tsvault.tombstone-ledger.test.tsvault.tsvault.ts — sole owner of vault state and chrome.storage vault keys.vault.update-entry-sanitize.test.tsPCH-02-001 regression tests — UPDATE_ENTRY patch path must route canary/tags/passkey through the same sanitizers the add/restore/sync funnels use (sanitizeCanary / sanitizePasskey / sanitizeTags).content/
passkey-toast/
crypto/
argon2.test.tsargon2.tsargon2id.kat.test.tsT-019: Argon2id known-answer test (KAT) + parameter assertioncrypto.test.tsdecompression-bomb.test.tsMV-4: decompression-bomb output bounds on the zstd and pako legs.official-vectors.test.tspeachPayload.binaryreader-bounds.test.tsPCH-02-008 regression tests — BinaryReader must bound every read and fail with the decoder's existing PAYLOAD_TOO_SHORT code on truncated input.peachPayload.bomb.test.tsT-005: peachPayload declared-length decompression bomb (MV-4)peachPayload.test.tspeachPayload.tspeachPayload.ts — binary payload format shared by PeachScript and the Peach QR matrix code (spec §2).peachScript.bounds.test.tsPB-26-208: PeachScript normalization before limits.peachScript.test.tspeachScript.tspeachScript.ts — PeachScript encoding/decoding.totp.rfc6238.test.tsT-004: TOTP RFC 6238 known-answer vectorstotp.test.tstotp.tszstd.tsThin wrapper around @bokuweb/zstd-wasm that defers WASM load until the first compress/decompress call and memoises the init promise.
popup/
codex/
aztec.tsaztec.ts — Aztec 2D barcode generation with round-trip verification.browser-bundle.test.tscodex.adversarial.test.tscodex.adversarial.test.ts — Layer 3 §3.4 adversarial Codex tests.codex.multistripe.test.tsT-017: Codex multi-stripe round-tripcodex.suite.test.tscodex.suite.test.ts — cross-cutting regression suite for the Codex pipeline.codex.test.tsconfirmation.tsPick 3 distinct positions in [1, 12] for the recovery-words confirmation gate.erasure.tserasure.ts — Reed-Solomon erasure coding around the WASM library.generate.test.tsgenerate.tsgenerate.ts — full Codex generation pipeline.helpers.tshelpers.ts — shared utilities for Codex generation and restoration.node-wasm.tsNode-only WASM byte loader for Vitest.pdf-import.clamp.test.tspdf-import.sandbox.test.tsT-007: MV-9 pdf.js sandbox flags regression testpdf-import.test.tspdf-import.test.ts — coverage for the testable surface of the PDF import path.pdf-import.tspdf-import.ts — restore from a Codex PDF instead of a camera scan.pdf-layout.tspdf-layout.ts — A4 Codex page geometry shared between the generator and the PDF importer.pdf.tspdf.ts — render the printable Codex PDF.reed-solomon.tsBrowser-safe wrapper around the Reed-Solomon WASM exports.restore.test.tsrestore.test.ts — coverage for ChunkBuffer, parseRawScan, reconstructAndVerify.restore.tsrestore.ts — Peach Codex restoration library (popup-side).rs-loader.tsrs-loader.ts — load the Reed-Solomon erasure WASM module.scan-limits.test.tsscan-limits.test.ts — PB-26-207 resource bounds on the Codex scan path.scanner.tsscanner.ts — camera-based Aztec scanning for Codex restoration.
components/
GeneratorDrawer.test.tsGeneratorDrawer.tsxNoteRow.test.tsx@vitest-environment jsdomNoteRow.tsxNoteToolbar.tsxPairingBirds.tsxPairing birds — the two illustrated characters used on the pairing screens.PairingProRequired.tsxPairingQrCode.tsxPeachMark.tsxRecoveryRuneBackground.tsxRuneBackground.tsxRuneCanvas.tsxSyncModeSelector.test.tsx@vitest-environment jsdomSyncModeSelector.tsxSyncModeSelector — the one place the relay choice is made.
views/
Add.tsxAdoptVaultView.test.tsx@vitest-environment jsdomAdoptVaultView.tsxCodexGenerateView.test.tsx@vitest-environment jsdomCodexGenerateView.tsxPeach Codex — generation view.CodexRestoreView.test.tsx@vitest-environment jsdomCodexRestoreView.tsxPeach Codex — restoration view.contracts.test.tsx@vitest-environment jsdomEntry.totp-params.test.tsx@vitest-environment jsdomEntry.tsxExport.csv.test.ts@vitest-environment jsdomExport.tsxSignal-conditioned views in this file must use <Show>, never a signal-conditioned early return (
if (signal()) return <X/>).Health.test.tsx@vitest-environment jsdomHealth.tsxImport.test.tsx@vitest-environment jsdomImport.tsxSignal-conditioned views in this file must use <Show>, never a signal-conditioned early return — see Projects.md §4.1.InitialSyncView.test.tsx@vitest-environment jsdomInitialSyncView.tsxLock.test.tsx@vitest-environment jsdomLock.tsxNoteEditor.toHtml.test.ts@vitest-environment jsdomNoteEditor.tsxNotesEditor.tsxNotesMode.tsxNotesTOC.tsxOnboarding.tsxPairDevice.test.tsx@vitest-environment jsdomPairDevice.tsxPairDevice — the pairing surface, opened from the Settings → Sync card.Panic.tsxPasskeyApproval.tsxProCelebration.tsxProNudge.test.tsx@vitest-environment jsdomProNudge.tsxRecoveryWordDisplay.tsxRecoveryWordEntry.tsxSettings.tsxTrashView.tsxvault-search.test.tsvault-search.tsVault.tsxview-test-utils.tsxWhatsNew.tsxzxcvbn-strength.test.tsLV-8: the @zxcvbn-ts replacement must score the master-password strength meter on the same 0-4 scale as the old zxcvbn, with dictionaries loaded (language-common is what keeps weak passwords from scoring optimistically).shared/
noise-core-wasm/
any is intentional throughout this module (L17/I3/QUA-010): import files are user-supplied external JSON whose schemas vary by source app and version (1Password CPG, Bitwarden, CXF, generic CSV).initial-sync.test.tsinitial-sync.tslegacy-identity-derivation.test-support.tsRoot→device key derivation, retained for tests only — campaign task 2.4.mesh-peer-role.tsml.tsnoise-blake2s-kat.test.tsnoise-core.tsnoise-js.test.tsNoise NK auth proof regression test.noise-js.tsNoise NK initiator for browser-to-browser sync.noise-kk.test.tsnoise-small-order-dh.test.tsPB-26-014 follow-up — the JS-side DH boundaries in noise-js.ts mirror the Rust core's small-order X25519 blocklist (libhydrogen's contributory-behaviour list).noise.reject-zero-dh.test.tsPCH-02-009 regression tests — every Noise NK DH must reject an all-zero shared secret (low-order / identity peer point) instead of feeding it into the key schedule.pairing-dial.test.tspairing-dial.tsThe WebSocket seam every relay-facing Peach flow shares.pairing-handshake.tsShared pairing primitives used by the live relay-adoption path.pairing-invitation.test.tspairing-invitation.tspasskey-flags.tspasskey-flags.ts — single switch for the Firefox passkey content-script proxy.passkey-utils.test.tspasskey-utils.tspasskey-utils.ts — WebAuthn relying-party-id validation.pro-nudge.test.tspro-nudge.tsrecovery-word-list.tsrecovery-word-list.ts — 2048-word recovery word list for Peach vault recovery.recovery-words.checksum.test.tsT-002: BIP39 checksum rejectionrecovery-words.cross-platform.test.tsrecovery-words.integrity.test.tsT-001: BIP39 word-list integrityrecovery-words.kek.test.tsT-003: 128-bit prefix-KEK invariant (PCH-01-005 sibling)recovery-words.tsrecovery-words.ts — BIP39-compatible recovery word encoding for Peach vault recovery.release-notes.test.tsrelease-notes.tsCurated release history and post-update notice selection.rendezvous.test.tsrendezvous.tsshortcuts.test.ts@vitest-environment jsdomshortcuts.tsshortcuts.ts — keybinding schema, defaults, matcher, formatter.storage.tssync-entry-envelope.kat.test.tssync-identity.test.tssync-identity.tsSync identity — vault-scoped primitives.sync-kk-transport.test.tssync-limits.tsSync trust + resource bounds — audit fixes HV-1 (timestamp clamp) and MV-3 (receive-path size bounds).sync-outcome.test.tssync-outcome.tsWhy a sync run ended, in a form both the service worker and the popup can name.sync-padding.test.tssync-padding.tsE7: frame padding at the relay boundary.sync-transport.tsWebSocket reconnect transport — Noise KK with both paired static keys.sync-types.tsVault sync — type definitions.sync.disconnect.test.tsT-020: WebSocket sync-disconnect handling (PCH-01-026 #9)types.tstypes.ts — cross-boundary types and the MessageType union.vault-adopt-snapshot.test.tsvault-adopt.test.tsvault-adopt.tstest/
tests/
fixtures/
history
1cd43b988080fix Codex PDF restore — decode canvas pixels directly via AztecCodeReader instead of BrowserAztecCodeReader (which silently fails on canvas elements); shrink detached window to 320x550 (v3.6.75)5 months agoe32372210412fix Codex PDF import — crop actual code regions instead of even canvas/6 slices; shrink detached window from 460x720 to 340x560 (v3.6.74)5 months ago0ba54a112996marketing card mirrors new layout — Email · Password · Edit under muted Copy eyebrow5 months ago4760eddc39a7before inline popup demo refresh — marketing card + peachpasswords.com hero5 months ago343f605f656adeep-link detached popup to codex-restore on ?codex=pdf — App.tsx routes past onboarding/lock straight into the restore flow (v3.6.73)5 months ago3d870e4370ebwrap copy actions under a single muted Copy eyebrow — Email/Username/Password buttons replace repetitive Copy email / Copy username / Copy password (inject.ts + marketing card, v3.6.72)5 months ago34cda6281b85measure inline popup card height after render — clip raw to content, no dead space5 months ago23dc656843effix detached popup URL — resolve via manifest action.default_popup instead of hardcoded popup.html (v3.6.71)5 months ago785cca9b28d7detach popup to chrome.windows for PDF import — survive file dialog focus loss, replace emoji icons with SVGs, lift guidance text contrast (v3.6.70)5 months ago0a34bc3ebed3render inline popup raw with real inject.ts tokens — drop shell, match dark theme, IBM Plex Mono labels, peach-accent button5 months ago9cc02dce0a40add inline popup marketing frame (08-inline)5 months ago59def6918680match peachpasswords.com fonts in marketing frames and remove green dot beside url5 months ago569fd42c72a9chore: Export Chrome store images as JPEGs (v3.6.69)5 months agoe18a621e72ffchore: Generate store assets at required sizes (v3.6.68)5 months agob27f0ab87fa3fix: Polish settings and Codex card geometry (v3.6.67)5 months agoe3acfa5fe9f3fix: Prevent folded Pro card subtitle clipping (v3.6.66)5 months ago1b294a2404c2produce peach-3.6.65-source.zip; verified content-identical rebuild from clean checkout5 months ago0e2eb416f250exclude LOG.md from AMO source archive — koh-internal history5 months ago31ee70ec4da4add .amoignore exclusion list and scripts/package-amo-source.sh5 months ago049f4916c04fadd README.amo.md for AMO reviewer reproduction of peach-3.6.65 build5 months ago5ef71af9c9f9before AMO source archive for peach-3.6.655 months agoe5e254e53ce7fix: Add Firefox data collection consent manifest (v3.6.65)5 months ago2af360f19338before firefox addon validation fix5 months ago5496f743042brevert: back to 8d0feb87be79, no changes5 months ago801e34e46347before highlight + benchmark fixes5 months ago8d0feb87be79fix: add padding-top to focused settings card so Peach Pro date is not clipped (v3.6.65)5 months agoc357f3ae06befix: add padding-top to focused settings card so Peach Pro date is not clipped5 months agob97c3e7ecc32before Peach Pro date visibility fix5 months ago4d2b19516c66fix: Update onboarding features and Codex restore (v3.6.64)5 months agod99308b4fb2afix: Polish and harden feedback flow (v3.6.63)5 months ago893de0a2c330feat: wire feedback form to Web3Forms (temporary, pre-Vesper) (v3.6.62)5 months agoa0f34330d095add src/shared/config.ts with WEB3FORMS_KEY constant5 months ago0c8adf9bff2bbefore Web3Forms feedback integration5 months agoefe6b2aee64evault history shows 3 latest inline + older dropdown; center version corner; fix Pro card date clipping; health loading screen for all users + title renamed to Advanced Vault Health; health view stays mounted during entry edit to prevent freeze on cancel (v3.6.61)5 months agocbceefec3283add padding-bottom to settings card scroll body — prevents last-item cutoff (v3.6.60)5 months agoa18bee50abe2remove emoji icons from codex done guidance items (v3.6.59)5 months ago35180c74591dbump to v3.6.585 months ago19624c4eed59replace canvas-based HybridBinarizer round-trip with in-memory GlobalHistogramBinarizer path — no DOM needed, works in both browser and node, eliminates AZTEC_CONTENT_MISMATCH root cause; add 200-payload unit test, 20-envelope integration test, and 100KB vault pipeline test (204 tests passing)5 months ago262165751c44before in-memory BitMatrix round-trip verification rewrite5 months agoe10e3e024e80replace bwip-js browser Aztec encoder with ZXing AztecEncoder — eliminates bwip-js/ZXing mode-encoding incompatibility (AZTEC_CONTENT_MISMATCH root cause), removes 918 kB bwip-js chunk from all browser builds (v3.6.57)5 months agoa86783166653fix email field dropped in sanitizeEntryDraft; identity suggestions include entry.email; aztec retry on content mismatch with diagnostic logging; live Aztec gallery on generating screen (v3.6.56)5 months ago3d77e1828fa3before email-save fix, aztec retry/diagnostics, codex generating UI5 months agoda63b6122caffix Codex generation — bwip-js not bundled due to @vite-ignore on dynamic import (v3.6.55)5 months ago805ccac4d45elight-mode shell border matched to dark-mode visual weight — near-invisible border and adapted shadows (v3.6.54)5 months ago35710e90bb08remove Small text-size option; force Settings html/body and ghost buttons dark regardless of global theme (v3.6.53)5 months agod87a4e8869d5before switching to chrome.windows.update for text-size resize5 months ago4132c0637d08popup reloads when switching to small text size, restores view and entry state after reload (v3.6.52)5 months ago9bc42bcae846before small text-size popup reload and state restore5 months ago03ae61226dd9small text-size zoom moved from html to body — html fills popup frame, no right-edge black strip (v3.6.51)5 months agob781c373cddbbefore small text-size black bar fix — move zoom from html to body5 months ago
details
Peach
A free, open source, local-first password manager for Chrome, Firefox, and Android.
Peach encrypts your vault on your device. No hosted vault, subscription, or account is required to use it.
Features
- Passwords, cards, and secure notes — keep your private data together in one encrypted vault
- Inline autofill — fill and save credentials without leaving the page
- TOTP built in — generate two-factor codes without a separate authenticator
- Password health — find weak, reused, and exposed passwords
- Portable backups — export and restore with PeachScript or a
.peachfile
Peach Pro adds:
- Peach Sync — end-to-end encrypted sync across paired devices
- Passkeys — save and use passkeys in Chrome and Firefox
- Peach Codex — print an encrypted, scannable backup of your vault
- Advanced vault health, Canary Entries, and duress tools
See the Peach website for current availability and Pro details.
Install
Open Source
Peach is released under the GPL v3. This repository contains Peach's Chrome and Firefox browser extensions. Android is maintained separately.
The source is hosted on Kepr, Asha Software's version control platform.
Security
Vault data is encrypted with AES-256-GCM and protected by Argon2id key derivation. Peach Sync authenticates paired devices and encrypts data in transit.
Implementation details live alongside the code:
Building
bun install --frozen-lockfile
bun run build
Builds are written to dist-chrome/ and dist-firefox/.
Built by Asha Software · [email protected]