dollarshaveclub/postmate

Health v2 · maintenance only

Adoption not part of the score

1919 stars · 182 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

Postmate is a lightweight, promise-based JavaScript library built on window.postMessage() that enables secure two-way communication between a parent page and a child iframe across origins. It provides a handshake mechanism, message validation, and lets the child expose a model object and emit events to the parent.

Use cases

• communicate between a parent page and a cross-origin iframe
• embed third-party widgets in an iframe and exchange data securely
• build a secure handshake between parent and child frames
• let an iframe emit events that the parent page listens to
• call functions inside a child iframe from the parent page
• retrieve values from a child iframe's model by property name

When to choose

• you need promise-based, secure cross-origin iframe communication with a tiny footprint (~1.6kb)
• you want a simple handshake and message validation without dependencies
• you're embedding third-party content (e.g., payment forms) and need parent-child messaging

When to avoid

• you need communication via popups or windows other than iframes (only iframes are supported)
• you need a maintained library with active development (latest release 2023, project appears in maintenance)
• you need Web Workers or same-origin messaging where postMessage is unnecessary

Facets

library · maturity maintenance

middleware security web-development frontend apis security browser cross-platform postmessage iframe cross-origin handshake promise-based parent-child-communication javascript

Member repositories

For agents

markdown · JSON · MCP: product_card(name="dollarshaveclub/postmate")