1# Peach for Android23A free, open source, local-first password manager for Android.45No accounts. No subscription. Your passwords stay on the device, encrypted with AES-256-GCM and protected by Argon2id key derivation. Sync, backup, and autofill happen without trusting any cloud in the middle.67**[peachpasswords.com](https://peachpasswords.com)**89---1011## Features1213- **Zero-knowledge vault** — AES-256-GCM encryption, Argon2id KDF, keys never leave your device14- **End-to-end encrypted sync** — pairs with your other Peach devices over a Noise channel; the relay only forwards ciphertext it cannot read15- **Inline autofill** — fills directly in apps, no copy-paste detour16- **Passkeys** — WebAuthn credentials alongside your passwords17- **Quick Settings tile** — copy a credential from anywhere with a single tap18- **Biometric unlock** — hardware-backed AndroidKeyStore escrow, invalidated on enrollment change19- **Codex** — prints your encrypted vault as Aztec codes on paper. Physical offline backup2021---2223## Open Source2425Peach is free and open source under the GPL v3 license. Both the browser extension and the Android app.2627The source is hosted on [Kepr](https://kepr.uk/peach) — Asha Software's own version control platform.2829---3031## Security3233Peach has undergone two adversarial analysis sessions against this codebase. The most recent findings have been resolved.3435**Cryptographic primitives:**36- Key derivation: Argon2id (m=64MiB, t=3, p=4)37- Encryption: AES-256-GCM with fresh random nonces38- Sync handshake: Noise NK / Noise KK (25519, ChaChaPoly, BLAKE2s)39- Backup codec: GF(2⁸) Reed-Solomon with zstd compression40- BLAKE3 checksums throughout4142The canonical Noise core lives in a shared Rust crate with the browser extension — Android drives it via JNI. See [`docs/CRYPTOGRAPHIC-TEST-VECTORS.md`](./docs/CRYPTOGRAPHIC-TEST-VECTORS.md) for the byte-level vectors that pin each primitive.4344---4546## Building4748```bash49./gradlew assembleRelease50```5152Outputs to `app/build/outputs/apk/release/`. The shared Noise core is built from `../peach-browser/crypto-core`.5354---5556## License5758GPL v3 — see [`LICENSE`](./LICENSE).5960---6162## Peach Pro6364Pro features (end-to-end encrypted sync, Codex, Canary) are available for $39 one-time at [peachpasswords.com](https://peachpasswords.com). Purchasing Pro supports continued development.6566---6768Built by [Asha Software](https://asha.software) · [[email protected]](mailto:[email protected])