# dollarshaveclub/postmate

📭 A powerful, simple, promise-based postMessage library.

Repository: https://github.com/dollarshaveclub/postmate
Canonical: https://ross.abutalabs.com/products/postmate
Language: JavaScript
License: MIT
License Family: permissive
Topics: handshake, promise, postmessage, secure, iframe, communicate, simple
Last push: 2023-06-02T12:27:05+00:00

## Health v2 (maintenance only)
Score: 23/100 (v2, computed 2026-09-02T17:46:02.011165+00:00)
- activity 0, release rhythm 8, longevity 100
- inputs: {"age_days": 3684, "days_push": 1188, "days_rel": null, "gap_med": null, "n_releases_24m": 0}
- flags: none
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 1919, forks 182 (observed 2026-08-28T04:05:55.032546+00:00)

## What it is
Postmate is a lightweight, promise-based JavaScript library built on window.postMessage() that enables secure two-way communication between a parent page and a child iframe across origins. It provides a handshake mechanism, message validation, and lets the child expose a model object and emit events to the parent.

## Use cases
- communicate between a parent page and a cross-origin iframe
- embed third-party widgets in an iframe and exchange data securely
- build a secure handshake between parent and child frames
- let an iframe emit events that the parent page listens to
- call functions inside a child iframe from the parent page
- retrieve values from a child iframe's model by property name

## When to choose
- you need promise-based, secure cross-origin iframe communication with a tiny footprint (~1.6kb)
- you want a simple handshake and message validation without dependencies
- you're embedding third-party content (e.g., payment forms) and need parent-child messaging

## When to avoid
- you need communication via popups or windows other than iframes (only iframes are supported)
- you need a maintained library with active development (latest release 2023, project appears in maintenance)
- you need Web Workers or same-origin messaging where postMessage is unnecessary

## Facets
- artifact type: library
- maturity: maintenance
- function: middleware, security
- domain: web-development, frontend, apis, security
- platform: browser, cross-platform
- tags: postmessage, iframe, cross-origin, handshake, promise-based, parent-child-communication, javascript

## Member repositories
- dollarshaveclub/postmate (main) score 23

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:05:55.032546+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-30T03:09:58.039530+00:00, confidence not recorded.
  - readme: https://github.com/dollarshaveclub/postmate (fetched 2026-08-28T04:05:55.032546+00:00, sha 36ee443b9ca0)
  - registry_npm: https://registry.npmjs.org/postmate (fetched 2026-08-29T10:49:32.772087+00:00, sha 561ce4f55e51)
- Data as of 2026-08-30T08:39:29.467469+00:00.