peach-browser
A free, open source, local-first password manager for Chrome, Firefox, and Android.
TypeScript
timeline
atlas420 files
crypto-core/
fixtures/
public/
codex/
scripts/
build-noise-core.mjsbuild-peachscript.pyBuild PeachScript-Regular.otf — 256 historical-runic glyphs.bun-ambient.d.tsAmbient declarations for the Bun APIs the release scripts use.check-cross-client-adoption.test.tscheck-cross-client-sync.mjscheck-extension-surface.mjscheck-noise-core.mjsPB-26-003: verify the committed Noise WASM still matches crypto-core source.check-sw-static-imports.mjsFails the build if any chunk reachable from the MV3 service worker still contains a runtime
import().ci.tsclean-chrome-dist.mjsclean-firefox-artifacts.mjscross-client-gradle.init.gradlegenerate-kat.mjsgenerate-kat.mjs — recompute the pinned ciphertext for self-test.ts (PCH-01-020).manifest-parity.test.tsPB-26-610 — the source manifests are security-reviewed; the built manifests are what ships.package-source.test.tspackage-source.tsprocess-readiness.d.mtsTypes for the plain-JavaScript readiness helper (PB-26-904).process-readiness.mjsprocess-readiness.test.tsrelease-firefox.tsrelease-gate.test.tsrelease-gate.tsPB-26-210: Release browser-gate validation.release-lib.test.tsscripts/release-lib.test.ts PB-26-211: release tool hardening — security tests for the argv-based runner.release-lib.tsscripts/release-lib.ts Shared argv-based runner for release tooling (PB-26-211).release.test.tsrelease.tsroot-derivation-gate.test.tsCampaign task 2.4 — no shipping source may derive device key material from the vault root.run-release-browser-gate.tstest-firefox-passkeys.mjstest-firefox-sender-context.mjsweb-accessible-resources.test.tssrc/
background/
aes.test.tsaes.tsaes.ts — AES-256-GCM encrypt/decrypt primitives for vault storage.alarms.test.tsalarms.tsclipboard.double-failure.test.tsT-037: clipboard double-failure / alreadyWritten pathclipboard.test.tsclipboard.tsClipboard write + reliable auto-clear — audit fix HV-2.codex-handlers.test.tsTests for src/background/codex-handlers.ts.codex-handlers.tscodex-handlers.ts — message handlers that back the Peach Codex flow.commands.test.tscommands.tsKeyboard command handler — routing for summon-inline: 1.device-identity.test.tsdevice-identity.tsLocal-device identity helpers.entry.lock-port.test.tsThe lock-on-close onConnect listener accepts only our nonce'd "popup-<uuid>" port from the extension page and ignores anything else.entry.tshealth.test.tshealth.tshealth.ts — Pro advanced vault health analysis.license.tslicense.verification.test.tsT-009: License Ed25519 signature verificationlocked-sync-spool.test.tslocked-sync-spool.tsmesh-relay-listener.test.tsmesh-relay-listener.tsmessage-policy.test.tsmessage-policy.tsmessages.adversarial.test.tsmessages.adversarial.test.ts — Layer 3 §3.3 adversarial message handler tests.messages.autolock-refresh.test.tsPB-26-107: passive page traffic must not refresh the auto-lock timer.messages.batch-sanitize.test.tsT-008: PCH-01-016 batch-add canary/tag sanitizationmessages.create-vault-from-root-key.test.tsmessages.edit-origin.test.tsT-022: GET_ENTRY_FOR_EDIT via sender.url + locked-vault AUTOFILL_QUERYmessages.entry-write-origin.test.tsPB-26-106: content-script entry mutations must be bound to the entry's own domain set.messages.passkey-offer-decline.test.tsPB-26-109: the passkey offer-decline handler is page-relay, so any page's content script may send it.messages.test.tsmessages.tsmessages.ts — the only background message handler.ml.predictbatch.test.tsT-030: ml.ts predictBatch — batch sizes, softmax stability with extreme weightsml.tsnotes.test.tsoffscreen.htmloffscreen.tsOffscreen document script — audit fix HV-2c.pair-secrets.test.tspair-secrets.tspair-secrets.ts — PB-26-213: the reusable rendezvous secret must never sit in plaintext in chrome.storage.local.paired-devices.test.tspaired-devices.tsPaired-device registry — v3 sync.passkey-chrome-ceremony.test.tspasskey-chrome-ceremony.test.ts — covers the Chrome chrome.webAuthenticationProxy ceremony path that the Firefox-proxy test file does NOT exercise.passkey-crypto.test.tspasskey-crypto.tspasskey-deny-on-close.test.tspasskey-deny-on-close.test.ts — M8/COR-009passkey-firefox-proxy.test.tspasskey-firefox-proxy.test.ts — covers the v2.12.0 Firefox content-script proxy path.passkey.ed25519.test.tsT-015: Ed25519 passkey round-trippasskey.tspending-adoption-holder.test.tspending-adoption-holder.tspending-vouched-devices.test.tspending-vouched-devices.tsPending vouched devices — audit fix MV-7.recovery-pending.test.tsrecovery-pending.tsBackground-owned state set while the user has just created or rotated a vault identity and is confirming their recovery words.recovery-words.test.tsrecovery.adversarial.test.tsrecovery.adversarial.test.ts — Layer 3 §3.2 adversarial recovery words tests.relay-adoption-bg.test.tsrelay-adoption-bg.tsself-test.test.tsself-test.tsself-test.ts — Known-Answer Test (KAT) for the Peach crypto stack.storage-access.test.tsstorage-access.tsPB-26-203: the session-key escrow is only as trustworthy as the boundary around chrome.storage.session.sync-alarm.test.tssync-alarm.tssync-alarm.ts — the 10-minute background sync tick.sync-alerts.test.tssync-alerts.tsPending sync security alerts.sync-coordinator.test.tssync-coordinator.tsVault sync — Phase 2 manifest-diff coordinator.sync-generation.test.tsThe §11 secure-reset contract: the durable generation record, the six states, create-on-miss refusal, archival by generation, crash recovery at every step, and the sync gate.sync-generation.tsThe durable Sync-generation record and its state machine (protocol §11).sync-runner.test.tssync-runner.tsProduction sync runner — composes the live vault adapter, WebSocket transport, and coordinator into the function the dispatcher injects via
setSyncRunner.sync-settings.test.tssync-settings.tssync-static.test.tsIV.7 — Static safety assertions for vault sync.sync-trigger.test.tssync-trigger.tssync-trigger.ts — central sync dispatcher.sync-vault-adapter.test.tssync-vault-adapter.tsProduction adapter that backs runSyncInitiator with the live vault.vault-createVaultFromRootKey.test.tsvault-history.test.tsVault history tests.vault.adversarial.test.tsvault.adversarial.test.ts — Layer 3 §3.1 adversarial vault tests.vault.card-decline.test.tsPB-26-108: declined-card metadata must not be offline-enumerable.vault.consolidate-passkeys.test.tsT-023: vault.consolidatePasskeyEntries — passkey merge with lastUsed rankingvault.corruption.test.tsT-018: Vault corruption vs wrong-password discrimination (M7/COR-007)vault.duress-adoption.test.tsvault.entry-id-namespace.test.tsvault.hibp-padding.test.tsPCH-02-007 regression tests — the HIBP k-anonymity range request must ask for response padding, and the parser must stay correct on padded responses.vault.purge-trash.test.tsT-024: vault.purgeExpiredTrash — retention cutoff boundaryvault.rotate-sync-identity.test.tsT-016: rotateSyncIdentity — new root key, cleared peers, recovery pendingvault.session-escrow.test.tsvault.sync-clamp.test.tsUnit tests for HV-1 — sync timestamp clamp + remote-mutation alerts.vault.test.tsvault.tombstone-ledger.test.tsvault.tsvault.ts — sole owner of vault state and chrome.storage vault keys.vault.update-entry-sanitize.test.tsPCH-02-001 regression tests — UPDATE_ENTRY patch path must route canary/tags/passkey through the same sanitizers the add/restore/sync funnels use (sanitizeCanary / sanitizePasskey / sanitizeTags).content/
passkey-toast/
crypto/
argon2.test.tsargon2.tsargon2id.kat.test.tsT-019: Argon2id known-answer test (KAT) + parameter assertioncrypto.test.tsdecompression-bomb.test.tsMV-4: decompression-bomb output bounds on the zstd and pako legs.official-vectors.test.tspeachPayload.binaryreader-bounds.test.tsPCH-02-008 regression tests — BinaryReader must bound every read and fail with the decoder's existing PAYLOAD_TOO_SHORT code on truncated input.peachPayload.bomb.test.tsT-005: peachPayload declared-length decompression bomb (MV-4)peachPayload.test.tspeachPayload.tspeachPayload.ts — binary payload format shared by PeachScript and the Peach QR matrix code (spec §2).peachScript.bounds.test.tsPB-26-208: PeachScript normalization before limits.peachScript.test.tspeachScript.tspeachScript.ts — PeachScript encoding/decoding.totp.rfc6238.test.tsT-004: TOTP RFC 6238 known-answer vectorstotp.test.tstotp.tszstd.tsThin wrapper around @bokuweb/zstd-wasm that defers WASM load until the first compress/decompress call and memoises the init promise.
popup/
codex/
aztec.tsaztec.ts — Aztec 2D barcode generation with round-trip verification.browser-bundle.test.tscodex.adversarial.test.tscodex.adversarial.test.ts — Layer 3 §3.4 adversarial Codex tests.codex.multistripe.test.tsT-017: Codex multi-stripe round-tripcodex.suite.test.tscodex.suite.test.ts — cross-cutting regression suite for the Codex pipeline.codex.test.tsconfirmation.tsPick 3 distinct positions in [1, 12] for the recovery-words confirmation gate.erasure.tserasure.ts — Reed-Solomon erasure coding around the WASM library.generate.test.tsgenerate.tsgenerate.ts — full Codex generation pipeline.helpers.tshelpers.ts — shared utilities for Codex generation and restoration.node-wasm.tsNode-only WASM byte loader for Vitest.pdf-import.clamp.test.tspdf-import.sandbox.test.tsT-007: MV-9 pdf.js sandbox flags regression testpdf-import.test.tspdf-import.test.ts — coverage for the testable surface of the PDF import path.pdf-import.tspdf-import.ts — restore from a Codex PDF instead of a camera scan.pdf-layout.tspdf-layout.ts — A4 Codex page geometry shared between the generator and the PDF importer.pdf.tspdf.ts — render the printable Codex PDF.reed-solomon.tsBrowser-safe wrapper around the Reed-Solomon WASM exports.restore.test.tsrestore.test.ts — coverage for ChunkBuffer, parseRawScan, reconstructAndVerify.restore.tsrestore.ts — Peach Codex restoration library (popup-side).rs-loader.tsrs-loader.ts — load the Reed-Solomon erasure WASM module.scan-limits.test.tsscan-limits.test.ts — PB-26-207 resource bounds on the Codex scan path.scanner.tsscanner.ts — camera-based Aztec scanning for Codex restoration.
components/
GeneratorDrawer.test.tsGeneratorDrawer.tsxNoteRow.test.tsx@vitest-environment jsdomNoteRow.tsxNoteToolbar.tsxPairingBirds.tsxPairing birds — the two illustrated characters used on the pairing screens.PairingProRequired.tsxPairingQrCode.tsxPeachMark.tsxRecoveryRuneBackground.tsxRuneBackground.tsxRuneCanvas.tsxSyncModeSelector.test.tsx@vitest-environment jsdomSyncModeSelector.tsxSyncModeSelector — the one place the relay choice is made.
views/
Add.tsxAdoptVaultView.test.tsx@vitest-environment jsdomAdoptVaultView.tsxCodexGenerateView.test.tsx@vitest-environment jsdomCodexGenerateView.tsxPeach Codex — generation view.CodexRestoreView.test.tsx@vitest-environment jsdomCodexRestoreView.tsxPeach Codex — restoration view.contracts.test.tsx@vitest-environment jsdomEntry.totp-params.test.tsx@vitest-environment jsdomEntry.tsxExport.csv.test.ts@vitest-environment jsdomExport.tsxSignal-conditioned views in this file must use <Show>, never a signal-conditioned early return (
if (signal()) return <X/>).Health.test.tsx@vitest-environment jsdomHealth.tsxImport.test.tsx@vitest-environment jsdomImport.tsxSignal-conditioned views in this file must use <Show>, never a signal-conditioned early return — see Projects.md §4.1.InitialSyncView.test.tsx@vitest-environment jsdomInitialSyncView.tsxLock.test.tsx@vitest-environment jsdomLock.tsxNoteEditor.toHtml.test.ts@vitest-environment jsdomNoteEditor.tsxNotesEditor.tsxNotesMode.tsxNotesTOC.tsxOnboarding.tsxPairDevice.test.tsx@vitest-environment jsdomPairDevice.tsxPairDevice — the pairing surface, opened from the Settings → Sync card.Panic.tsxPasskeyApproval.tsxProCelebration.tsxProNudge.test.tsx@vitest-environment jsdomProNudge.tsxRecoveryWordDisplay.tsxRecoveryWordEntry.tsxSettings.tsxTrashView.tsxvault-search.test.tsvault-search.tsVault.tsxview-test-utils.tsxWhatsNew.tsxzxcvbn-strength.test.tsLV-8: the @zxcvbn-ts replacement must score the master-password strength meter on the same 0-4 scale as the old zxcvbn, with dictionaries loaded (language-common is what keeps weak passwords from scoring optimistically).shared/
noise-core-wasm/
any is intentional throughout this module (L17/I3/QUA-010): import files are user-supplied external JSON whose schemas vary by source app and version (1Password CPG, Bitwarden, CXF, generic CSV).initial-sync.test.tsinitial-sync.tslegacy-identity-derivation.test-support.tsRoot→device key derivation, retained for tests only — campaign task 2.4.mesh-peer-role.tsml.tsnoise-blake2s-kat.test.tsnoise-core.tsnoise-js.test.tsNoise NK auth proof regression test.noise-js.tsNoise NK initiator for browser-to-browser sync.noise-kk.test.tsnoise-small-order-dh.test.tsPB-26-014 follow-up — the JS-side DH boundaries in noise-js.ts mirror the Rust core's small-order X25519 blocklist (libhydrogen's contributory-behaviour list).noise.reject-zero-dh.test.tsPCH-02-009 regression tests — every Noise NK DH must reject an all-zero shared secret (low-order / identity peer point) instead of feeding it into the key schedule.pairing-dial.test.tspairing-dial.tsThe WebSocket seam every relay-facing Peach flow shares.pairing-handshake.tsShared pairing primitives used by the live relay-adoption path.pairing-invitation.test.tspairing-invitation.tspasskey-flags.tspasskey-flags.ts — single switch for the Firefox passkey content-script proxy.passkey-utils.test.tspasskey-utils.tspasskey-utils.ts — WebAuthn relying-party-id validation.pro-nudge.test.tspro-nudge.tsrecovery-word-list.tsrecovery-word-list.ts — 2048-word recovery word list for Peach vault recovery.recovery-words.checksum.test.tsT-002: BIP39 checksum rejectionrecovery-words.cross-platform.test.tsrecovery-words.integrity.test.tsT-001: BIP39 word-list integrityrecovery-words.kek.test.tsT-003: 128-bit prefix-KEK invariant (PCH-01-005 sibling)recovery-words.tsrecovery-words.ts — BIP39-compatible recovery word encoding for Peach vault recovery.release-notes.test.tsrelease-notes.tsCurated release history and post-update notice selection.rendezvous.test.tsrendezvous.tsshortcuts.test.ts@vitest-environment jsdomshortcuts.tsshortcuts.ts — keybinding schema, defaults, matcher, formatter.storage.tssync-entry-envelope.kat.test.tssync-identity.test.tssync-identity.tsSync identity — vault-scoped primitives.sync-kk-transport.test.tssync-limits.tsSync trust + resource bounds — audit fixes HV-1 (timestamp clamp) and MV-3 (receive-path size bounds).sync-outcome.test.tssync-outcome.tsWhy a sync run ended, in a form both the service worker and the popup can name.sync-padding.test.tssync-padding.tsE7: frame padding at the relay boundary.sync-transport.tsWebSocket reconnect transport — Noise KK with both paired static keys.sync-types.tsVault sync — type definitions.sync.disconnect.test.tsT-020: WebSocket sync-disconnect handling (PCH-01-026 #9)types.tstypes.ts — cross-boundary types and the MessageType union.vault-adopt-snapshot.test.tsvault-adopt.test.tsvault-adopt.tstest/
tests/
fixtures/
history
94fda772d1b5fix: Show full used-email picker in entry editor (v4.9.9)2 months agod550f48a729dfix: Restore Advanced control for passkey entries (v4.9.8)2 months ago03887ea0c034docs: define cross-platform contract sync policy2 months ago72efe45f61c2record 2fa-icon-spam fix and v4.9.7 gates in CONTINUITY.md2 months agoda74e3f68636collapse OTP-signaling split-digit boxes (no maxlength) to a single icon on box[0] instead of one per box2 months ago2c20a75301a0record six-fix bugfix session and v4.9.6 gates in CONTINUITY.md2 months agoa945b931a1c5bump version 4.9.5 to 4.9.6 across package.json and both manifests2 months agoc54ae32c7d48treat markup-only or zero-width contenteditable bodies as blank so a new note with nothing typed is never saved2 months ago2adb75e4873erun the main content script in all frames so Peach can fill login forms inside overlay/nested iframes2 months ago4488f3459d17detect single-digit OTP boxes by maxlength attribute so type=number 2FA boxes no longer each get a peach icon2 months ago8b8b37f3866fbrighten the Settings version corner to a gentle readable off-white instead of 10% alpha2 months ago5de797f88705suppress keyboard shortcuts on lock screen so typing a password cannot trigger new-entry and escape2 months ago3b0605503593render passkey entries with favicon or coloured initials instead of search-like key icon2 months ago0a86c74f2b4cfix lock action icon to render accent at rest instead of only on hover2 months agoe3cda06167abfeat: Rename paired devices locally (v4.9.4)2 months ago7c75b22961a9fix: Bound cumulative locked sync inbox (v4.9.3)2 months agof5eeec05e167feat: Add opaque locked background sync spool (v4.9.2)2 months agoe40a67cca1a3clear MV3 session key in lock() so a manual lock is not silently undone by the next SW restart2 months ago0e9a9f1e1ac5strip accentGlow machinery from RuneBackground, runes drift subtly on their own at base opacity2 months agoc2d065090bf8bump version to 4.9.1 and rebuild dist-chrome and dist-firefox2 months ago6d22b523c75frestore PeachMark above lock-screen eyebrow, add peach-lock-mark sizing, tighten eyebrow tracking/weight2 months ago501417f17d18slow down accent glow pulse (0.08-0.20 speed, 5-9s lifetime) and tighten rune row spacing (LINE_H 3.8→2.8)2 months agod72d7694ef20bump version to 4.9.0 in package.json and manifests2 months ago96373f8a028dfix indentation in Lock.tsx unlock view after layout changes2 months agob80860877bb4add canvas null check, mock RuneBackground in tests, all tests pass2 months ago9c22e753d364fix unused variables in glow update loop, lint and typecheck pass clean2 months agofe0416317f36center hero content on unlock view, remove hero art CSS, add text-align center to headline2 months ago6a73c5c3a0bbremove LockRuneCanvas and PeachMark hero art from lock screen, add RuneBackground with accentGlow2 months agofa601515c1a3add accentGlow prop to RuneBackground with sine-wave pulse glow slots2 months ago14c3e3aa08fadocs: record v4.8.9 Chrome and Firefox release2 months ago0da75a28a141docs: record combined credential browser verification2 months ago507ed37227b1fix: preserve TOTP during passkey consolidation (v4.8.9)2 months ago752c6edfb19fdocs: continuity — peach-android v2.14.12 mirrors the 64-char device-name cap2 months ago2a311f0d3062docs: continuity — record device-name cap hardening (v4.8.8)2 months ago847806bd2188feat: cap peer device names at 64 chars on every inbound seam (v4.8.8)2 months agoc387e8a41f26docs: continuity — record sync-alert overflow fix outcome (v4.8.7)2 months ago44a2d34bbdddfix: contain device-trust alert banners inside the 320px shell (v4.8.7)2 months ago65feee9c1752docs: Refresh README for Peach Sync and Android beta2 months agoddbf04f40670docs: continuity — record deletion + biome-repair outcomes and save bundling note (v4.8.6)2 months agoac28263c9b98test: revive two orphaned mesh-propagation receiver tests (v4.8.6)2 months ago41b6448ed641refactor: delete dead GET_ADOPTION_MATERIAL/COMPLETE_PAIRING handlers (v4.8.5)2 months agoae66726c3c86docs: continuity — record Codex Security F1/F2/F3 resolution and verification (v4.8.4)2 months agoe3f31d626cb8style: drop lint violations introduced by security fixes (v4.8.4)2 months ago7cf0e6d4b0c4fix: canary webhook filter rejects IPv4-mapped IPv6 private literals (v4.8.4)2 months ago2945bb7a571afix: bind Firefox passkey completion to the pending ceremony (v4.8.3)2 months agoc3c0d13e0280fix: gate key-material and pairing handlers to extension-page senders (v4.8.2)2 months ago1fc1bb91666btest: fix flaky tampered-ciphertext crypto test (v4.8.1)2 months ago351f84bfff6efeat: collapse sync alert toasts by type with counter + flip + dismiss-all; strip mesh diag (v4.8.0)2 months agode56d93b26cefix: treat wsPort/relayUrl null same as undefined in manifest validation + normalise (v4.7.9)2 months agoceeb0d1edf66fix: accept wsPort:0 as valid no-port sentinel in manifest validation (v4.7.8)2 months ago
details
Peach
A free, open source, local-first password manager for Chrome, Firefox, and Android.
Peach encrypts your vault on your device. No hosted vault, subscription, or account is required to use it.
Features
- Passwords, cards, and secure notes — keep your private data together in one encrypted vault
- Inline autofill — fill and save credentials without leaving the page
- TOTP built in — generate two-factor codes without a separate authenticator
- Password health — find weak, reused, and exposed passwords
- Portable backups — export and restore with PeachScript or a
.peachfile
Peach Pro adds:
- Peach Sync — end-to-end encrypted sync across paired devices
- Passkeys — save and use passkeys in Chrome and Firefox
- Peach Codex — print an encrypted, scannable backup of your vault
- Advanced vault health, Canary Entries, and duress tools
See the Peach website for current availability and Pro details.
Install
Open Source
Peach is released under the GPL v3. This repository contains Peach's Chrome and Firefox browser extensions. Android is maintained separately.
The source is hosted on Kepr, Asha Software's version control platform.
Security
Vault data is encrypted with AES-256-GCM and protected by Argon2id key derivation. Peach Sync authenticates paired devices and encrypts data in transit.
Implementation details live alongside the code:
Building
bun install --frozen-lockfile
bun run build
Builds are written to dist-chrome/ and dist-firefox/.
Built by Asha Software · [email protected]