peach-android

@june

Mobile companion for the Free Open Source Password Manager

Kotlin

2.14.64 · 552 saves · 65,787 lines · updated 1 week ago · trusted

TIMELINE 552 saves
ATLAS 469 files ⇓ bundle
HISTORY 552 saves
485639b6ecb7docs: Record second blocked v2.14.64 Kepr retrydev1 week ago
ea8337e68db6docs: v2.14.54 release notes ## Highlights - Appearance now offers Compact, Auto, and Large UI sizing controls. - Auto sizing keeps foldables comfortably enlarged while preventing tablet controls from inflating across the screen. ## Fixes - Entry editing no longer offers Notes as a standalone entry type; existing attached notes remain editable. - URL additions now stay with the URL field, and password generation/history stay with the password field. - The entry ghostmark now continues naturally off the screen instead of ending at a hard clipped edge.dev1 week ago
832e5cf806cffeat: Match browser note tools and polish entry editing (v2.14.51)dev1 week ago
1ac4259b4213fix: Isolate identity suggestion list scrolling (v2.14.49)dev1 week ago
details

Peach for Android

A free, open source, local-first password manager for Android.

No accounts. No subscription. Your passwords stay on the device, encrypted with AES-256-GCM and protected by Argon2id key derivation. Sync, backup, and autofill happen without trusting any cloud in the middle.

peachpasswords.com

Features

  • Zero-knowledge vault — AES-256-GCM encryption, Argon2id KDF, keys never leave your device
  • End-to-end encrypted sync — pairs with your other Peach devices over a Noise channel; the relay only forwards ciphertext it cannot read
  • Inline autofill — fills directly in apps, no copy-paste detour
  • Passkeys — WebAuthn credentials alongside your passwords
  • Quick Settings tile — copy a credential from anywhere with a single tap
  • Biometric unlock — hardware-backed AndroidKeyStore escrow, invalidated on enrollment change
  • Codex — prints your encrypted vault as Aztec codes on paper. Physical offline backup

Open Source

Peach is free and open source under the GPL v3 license. Both the browser extension and the Android app.

The source is hosted on Kepr — Asha Software's own version control platform.

Security

Peach has undergone two adversarial analysis sessions against this codebase. The most recent findings have been resolved.

Cryptographic primitives:

  • Key derivation: Argon2id (m=64MiB, t=3, p=4)
  • Encryption: AES-256-GCM with fresh random nonces
  • Sync handshake: Noise NK / Noise KK (25519, ChaChaPoly, BLAKE2s)
  • Backup codec: GF(2⁸) Reed-Solomon with zstd compression
  • BLAKE3 checksums throughout

The canonical Noise core lives in a shared Rust crate with the browser extension — Android drives it via JNI. See docs/CRYPTOGRAPHIC-TEST-VECTORS.md for the byte-level vectors that pin each primitive.

Building

./gradlew assembleRelease

Outputs to app/build/outputs/apk/release/. The shared Noise core is built from ../peach-browser/crypto-core.

License

GPL v3 — see LICENSE.

Peach Pro

Pro features (end-to-end encrypted sync, Codex, Canary) are available for $39 one-time at peachpasswords.com. Purchasing Pro supports continued development.

Built by Asha Software · [email protected]