1# Peach for Android23A free, open source, local-first password manager. Your vault stays on the device, encrypted with AES-256-GCM and protected by Argon2id. Sync between your devices happens over an end-to-end authenticated Noise channel; the cloud relay only forwards ciphertext it cannot read. There are no accounts, no servers holding your data, and no subscription required.45Peach pairs with the Peach browser extension, prints encrypted backups as Aztec codes on paper, autofills inline in apps and browsers, and stores passkeys alongside passwords.67**Current version:** v2.9.208**License:** GPL v39**Source:** [kepr.uk/peach-android](https://kepr.uk/peach-android)1011---1213## Security1415### Cryptographic primitives1617- **Key derivation** — Argon2id (`m=64 MiB`, `t=3`, `p=4`, 32-byte output, 16-byte CSPRNG salt)18- **Vault encryption** — AES-256-GCM with a fresh 96-bit random nonce per encrypt and 128-bit authentication tag19- **Sync handshake** — Noise NK (pairing) and Noise KK (adoption), `25519_ChaChaPoly_BLAKE2s` cipher suite20- **Per-entry sync envelope** — distinct HKDF-derived AES-256-GCM key per entry, AAD bound to the entry id so a ciphertext cannot be replayed between slots21- **Keyed storage** — paired-device and license stores use `EncryptedSharedPreferences`; vault slots are AES-GCM-sealed blobs in plain prefs (only the salt is cleartext, matching the browser model)22- **Biometric escrow** — hardware-backed AndroidKeyStore AES-256-GCM key with `setUserAuthenticationRequired(true)` and `setInvalidatedByBiometricEnrollment(true)`23- **Codex (paper backup)** — GF(2⁸) Reed-Solomon with zstd compression and Aztec codes at 25% ECC24- **Checksums** — BLAKE3 throughout2526### Key handling2728- Master key and derived key are zeroed on lock and in `finally` blocks along all transient paths29- No secret material is ever logged. There is no online breach check — no password hash or plaintext is ever transmitted anywhere30- `allowBackup="false"` + `fullBackupContent="false"` — vault does not participate in Android Auto Backup3132### Tested against published vectors3334All primitive implementations are pinned to published test vectors in `docs/CRYPTOGRAPHIC-TEST-VECTORS.md`:3536- RFC 9106 §5.3 Argon2id37- NIST CAVP `gcmDecrypt256.rsp` (group `PTlen=128`, `AADlen=0`, `Taglen=128`)38- BLAKE3 official `input_len=1024` reference input39- Cacophony Noise NK / KK transcript catalog (shared with `peach-browser/crypto-core`)4041The canonical Noise core (X25519, ChaCha20-Poly1305, BLAKE2s, nonce state, rekey) lives in the Rust crate at `../peach-browser/crypto-core` and is driven from this app via JNI — see `docs/NOISE-CORE-PROVENANCE.md`. Every cryptographic decision in this codebase is byte-equivalent to the browser implementation; the parity contract is documented in `docs/browser-parity-map.md`.