peach-android

@june

Mobile companion for the Free Open Source Password Manager

Kotlin

2.15.6 · 894 saves · 70,328 lines · updated 2 hours ago · trusted

TIMELINE 894 saves
ATLAS 512 files ⇓ bundle
HISTORY 894 saves
8b542cf26a41remove separate update metadata signing gate and bump updater compatibility (v2.15.6)dev2 hours ago
fcd5f141ea02restore signed v2.15.5 update metadata publicationdev2 hours ago
79fac6c63d76publish unsigned v2.15.5 Credential Manager handoff releasedev2 hours ago
97fe1c42be52fix locked Credential Manager auth handoff and return password entries (v2.15.5)dev3 hours ago
details

Peach for Android

A free, open source, local-first password manager for Android.

No accounts. No subscription. Your passwords stay on the device, encrypted with AES-256-GCM and protected by Argon2id key derivation. Sync, backup, and autofill happen without trusting any cloud in the middle.

peachpasswords.com

Features

  • Zero-knowledge vault — AES-256-GCM encryption, Argon2id KDF, keys never leave your device
  • End-to-end encrypted sync — pairs with your other Peach devices over a Noise channel; the relay only forwards ciphertext it cannot read
  • Inline autofill — fills directly in apps, no copy-paste detour
  • Passkeys — WebAuthn credentials alongside your passwords
  • Quick Settings tile — copy a credential from anywhere with a single tap
  • Biometric unlock — hardware-backed AndroidKeyStore escrow, invalidated on enrollment change
  • Codex — prints your encrypted vault as Aztec codes on paper. Physical offline backup

Open Source

Peach is free and open source under the GPL v3 license. Both the browser extension and the Android app.

The source is hosted on Kepr — Asha Software's own version control platform.

Security

Peach has undergone two adversarial analysis sessions against this codebase. The most recent findings have been resolved.

Cryptographic primitives:

  • Key derivation: Argon2id (m=64MiB, t=3, p=4)
  • Encryption: AES-256-GCM with fresh random nonces
  • Sync handshake: Noise NK / Noise KK (25519, ChaChaPoly, BLAKE2s)
  • Backup codec: GF(2⁸) Reed-Solomon with zstd compression
  • BLAKE3 checksums throughout

The canonical Noise core lives in a shared Rust crate with the browser extension — Android drives it via JNI. See docs/CRYPTOGRAPHIC-TEST-VECTORS.md for the byte-level vectors that pin each primitive.

Building

./gradlew assembleRelease

Outputs to app/build/outputs/apk/release/. The shared Noise core is built from ../peach-browser/crypto-core.

License

GPL v3 — see LICENSE.

Peach Pro

Pro features (end-to-end encrypted sync, Codex, Canary) are available for $39 one-time at peachpasswords.com. Purchasing Pro supports continued development.

Built by Asha Software · [email protected]