# Peach for Android

A free, open source, local-first password manager for Android.

No accounts. No subscription. Your passwords stay on the device, encrypted with AES-256-GCM and protected by Argon2id key derivation. Sync, backup, and autofill happen without trusting any cloud in the middle.

**[peachpasswords.com](https://peachpasswords.com)**

---

## Features

- **Zero-knowledge vault** — AES-256-GCM encryption, Argon2id KDF, keys never leave your device
- **End-to-end encrypted sync** — pairs with your other Peach devices over a Noise channel; the relay only forwards ciphertext it cannot read
- **Inline autofill** — fills directly in apps, no copy-paste detour
- **Passkeys** — WebAuthn credentials alongside your passwords
- **Quick Settings tile** — copy a credential from anywhere with a single tap
- **Biometric unlock** — hardware-backed AndroidKeyStore escrow, invalidated on enrollment change
- **Codex** — prints your encrypted vault as Aztec codes on paper. Physical offline backup

---

## Open Source

Peach is free and open source under the GPL v3 license. Both the browser extension and the Android app.

The source is hosted on [Kepr](https://kepr.uk/peach) — Asha Software's own version control platform.

---

## Security

Peach has undergone two adversarial analysis sessions against this codebase. The most recent findings have been resolved.

**Cryptographic primitives:**
- Key derivation: Argon2id (m=64MiB, t=3, p=4)
- Encryption: AES-256-GCM with fresh random nonces
- Sync handshake: Noise NK / Noise KK (25519, ChaChaPoly, BLAKE2s)
- Backup codec: GF(2⁸) Reed-Solomon with zstd compression
- BLAKE3 checksums throughout

The canonical Noise core lives in a shared Rust crate with the browser extension — Android drives it via JNI. See [`docs/CRYPTOGRAPHIC-TEST-VECTORS.md`](./docs/CRYPTOGRAPHIC-TEST-VECTORS.md) for the byte-level vectors that pin each primitive.

---

## Building

```bash
./gradlew assembleRelease
```

Outputs to `app/build/outputs/apk/release/`. The shared Noise core is built from `../peach-browser/crypto-core`.

---

## License

GPL v3 — see [`LICENSE`](./LICENSE).

---

## Peach Pro

Pro features (end-to-end encrypted sync, Codex, Canary) are available for $39 one-time at [peachpasswords.com](https://peachpasswords.com). Purchasing Pro supports continued development.

---

Built by [Asha Software](https://asha.software) · [hello@peachpasswords.com](mailto:hello@peachpasswords.com)