peach-android
A free, open source, local-first password manager for Android.
Kotlin
timeline
atlas350 files
app/
drafts/
MF1MF2/
BROWSER-SPEC.mdExtracted from
peach-browser source (read-only; never modified).ExportRoundTripTest.ktgen_peach_fixture.mjsImportParsersTest.ktImportScreen.kt───────────────────────────────────────────────────────────────────────────── ViewModel ─────────────────────────────────────────────────────────────────────────────mf1_kat_gen.mjsGenerates an MF-1 known-answer vector using the BROWSER's exact recovery algorithm (recovery-words.ts) against the REAL browser word list.parse_android_export.mjsPeachPayloadCodec.ktPeachScript binary payload (PCHS) — a byte-for-byte port of the browser's peachPayload.ts (MF-2).PeachScript.ktPeachScript outer codec — maps each payload byte to one Private-Use-Area code point in U+E000..U+E0FF, and back.PeachScriptExport.ktPeachScript export (MF-2) — writes the browser's PCHS binary payload (Argon2id + AES-256-GCM, zstd sections, BLAKE3 checksum, size-bucket padding, string-table entry packing) re-encoded into Private-Use-Area text.PeachScriptImport.ktPeachScript import (MF-2) — parses the browser's PCHS binary payload back into full vault entries.PeachScriptTest.ktRecoveryEscrowTest.ktRecoveryWords.ktVaultCrypto.ktVaultRepository.ktVaultStore.ktOne encrypted slot at rest.src/
androidTest/
java/
debug/
res/
values/
main/
java/
com/
peachpasswords/
autofill/
AssistStructureParser.ktThe autofillable fields discovered in one [AssistStructure], plus the origin (web domain for browsers, package name otherwise) used to rank vault entries.AutofillEnablement.ktWhether Peach is actually the system's autofill service, and the one-time offer to make it so.AutofillEntryPickerActivity.ktBranded bottom sheet shown when the user taps "Search Peach…"/"Unlock Peach" in the system autofill drop-down.AutofillIntents.ktPendingIntents the autofill surfaces hand to the framework: a no-op attribution target the inline chip requires, the authentication IntentSender that opens the branded [AutofillEntryPickerActivity], and the "open new entry" launcher that the picker fires when the user taps the "+ Create new entry" affordance.AutofillNavRepository.ktCarries a one-shot "open the new-entry editor" request from the autofill picker to the nav host.AutofillNavViewModel.ktThin Compose-friendly wrapper around [AutofillNavRepository] so the NavHost can grab the singleton via
hiltViewModel() without reaching for an EntryPoint accessor.AutofillResponseBuilder.ktTurns parsed form fields + vault entries into autofill [Dataset]s — the menu RemoteViews row, the inline keyboard chip, and the actual field values.AutofillSave.ktPeachAutofillService.ktSystem autofill provider.TrustedBrowsers.ktConservative allowlist of apps permitted to request autofill for a web origin (MF-7).codex/
CodexAztec.ktAztec encode/decode for one Codex chunk, via ZXing.CodexAztecFrame.ktLive-camera Aztec decode for the Codex restore camera path (D10).CodexCodec.ktPure (Android-free) Codex byte pipeline: compress → stripe → Reed-Solomon → envelopes, and the inverse for restore.CodexGenerator.ktGeneration milestones surfaced to the UI.CodexPageLayout.ktA4 Codex page geometry — the exact port of the browser's
popup/codex/pdf-layout.ts, which is the canonical Codex page format.CodexPdf.ktRenders the Aztec codes onto an A4 PDF in a 6×6 grid — the printed Codex.CodexRestore.ktRestore side: render a Codex PDF back to bitmaps, crop the 6×6 grid using the same geometry [CodexPdf] laid down, decode each Aztec, then Reed-Solomon reconstruct the payload — surviving missing or unreadable codes up to the parity budget.CodexTypes.ktCodex on-paper format constants and shapes — port of the browser shared/codex-types.ts.ReedSolomon.ktSystematic Reed-Solomon erasure codec over GF(2⁸), Backblaze/JavaReedSolomon construction (Vandermonde matrix made systematic).di/
feedback/
haptics/
passkeys/
shared/
sync/
BatteryExemption.ktAsks once to be left out of Doze / App Standby.ChirpAdopt.ktVault adoption frame protocol — exact port of the browser
shared/chirp-adopt.ts.ChirpIdentity.ktChirpSyncCoordinator.ktChirp Sync — Phase 2 manifest-diff coordinator.ChirpSyncSession.ktTransport-neutral session consumed by the sync coordinator.ChirpTypes.ktCloudRelayReconnectListener.ktCodePairingServer.ktCode-based pairing, phone side.CryptoCompare.ktFixed-format protocol comparisons.DeviceManifestSupport.kt0x02 added the revoked array to the signed body.ForegroundSyncCoordinator.ktMdnsPairingServer.ktC7 TCP + mDNS reconnect SERVER (responder side).NoiseKK.ktNoiseNK.ktPairedDevice.ktPairedDeviceStore.ktPersistent registry of paired devices, encrypted at rest with EncryptedSharedPreferences (same construction as DuressConfigStore / LicenseRepository, v2.1.36).PairingAuth.ktPairingCode.ktThe compact join code this phone displays and the user types into the browser.PairingDiscoveryClient.ktC7 TCP + mDNS reconnect CLIENT (initiator side).PairingFrames.ktLength-delimited frame IO for a pairing/sync connection.PairingInvitation.ktPairingProgress.ktPeachSyncService.ktKeeps the pairing/sync listener reachable.PeachWebSocket.ktA minimal RFC 6455 server endpoint — just enough of the protocol to talk to a browser extension's new WebSocket(...).PendingVouchedDeviceStore.ktRelayAdoptionHost.ktRelayAdoptionReceiver.ktReceiver half of relay-first vault adoption.RelayFrames.ktBrowser-to-browser relay frames — the wire addition from PEACH_SYNC_RELAY_DESIGN.md §3, made concrete.RelayHub.ktWhether this device will relay for others.RelaySettingsStore.ktWhether this device relays sync traffic for other paired devices.Rendezvous.ktRustNoiseNative.ktThin JNI boundary over the canonical Rust snow state machine.SASDerivation.ktSyncAlert.ktSyncAlertStore.ktSyncIdentity.ktSyncLimits.ktCloudflare Workers caps one WebSocket message at 32 MiB.SyncMessage.ktChirp Sync wire protocol — exact port of the browser ChirpSyncMessage union (shared/sync-types.ts).SyncPadding.ktE7: frame padding at the relay boundary.SyncReconnectListener.ktThe everyday sync path: already-paired devices reconnecting without a code.SyncStatus.ktVaultSyncAdapter.ktProduction [ChirpSyncVaultAdapter] backing the coordinator with the live [VaultRepository].ui/
codex/
components/
BirdAnimation.ktThe three acts of the pairing animation, bound to the audio protocol.CharEnterText.ktPer-character entrance: each glyph fades in and rises into place with a staggered delay.CopyButton.ktCopy button with the two-effect copy feedback (spec §4.4): a diagonal sheen sweeps once over ~600ms and an accent drain bar fills 0→100% over 1.4s.CopyFeedbackOverlay.ktFaviconInitials.ktInitials chip used in place of a network favicon (offline-first).LockRuneString.ktPairingBirds.ktThe two pairing birds, ported path-for-path from the browser extension's
ChirpPairingFlow.tsx (a finch and a swallow) rather than redrawn by eye.PeachEmptyOrEndState.ktPeachExpandableCard.ktPeachField.ktPeachMark.ktThe Peach brand mark — a peach fruit with a single leaf.PeachSegmentedControl.ktPeachTopBar.ktQaFlags.ktDebug-only, opt-in escape hatch so automated visual QA (screenshot-based Gate 2 comparisons) can capture screens that are normally FLAG_SECURE-protected.RuneGridBackground.ktSecureFlagEffect.ktSets WindowManager.FLAG_SECURE while this composable is in the composition and clears it on dispose — blocking screenshots, screen recording, and the recents thumbnail of screens that display secrets (MN-3: recovery words, export blob, codex generation).TOTPRing.ktA small ring that sweeps once per TOTP period and turns breach-red in the final 5 seconds.lock/
BiometricKeyStore.ktStores the vault's AES key wrapped under a hardware-backed, biometric-gated Android KeyStore key, so the lock screen can unlock without the master password.Biometrics.ktThin wrapper over androidx BiometricPrompt for the re-auth gate.BiometricUnlockActivity.ktLockScreen.ktLockViewModel.kt
onboarding/
pairing/
recovery/
security/
settings/
CardIcon.ktThe seven settings-card glyphs — exact ports of the browser CardIcon.tsx SVGs (viewBox 0 0 16 16, stroke 1.25, round caps/joins).PanicScreen.ktProCelebration.ktCSS cubic-bezier(0.16, 1, 0.3, 1) — the browser's bloom/wordmark-in easing (a pronounced ease-out-expo feel).SettingsCardBodies.ktSettingsScreen.ktDeck geometry — ported verbatim from StackDeck.tsx constants.SettingsStack.ktThe seven settings categories, in deck order (Pro on top).SettingsViewModel.kt
theme/
AccentColors.ktPeachColors.ktPeachColorsLight.ktPeachMotion.ktPeachPalette.ktA resolved set of Peach colour tokens for one theme (dark or light).PeachRadius.ktPeachSpacing.ktShared 4dp-based spacing scale extracted from the lock-screen layout.PeachStackColors.ktPeachTheme.ktCurrent accent color, available to any composable under [PeachTheme].PeachType.ktShellBackground.ktThe two-bloom shell background that sits behind every screen.
vault/
AdditionalUrlsDetail.ktE3 — additional-URL rows for EntryDetailScreen.AdditionalUrlsEditor.ktE3 — hard cap on additional URLs, matching the spec.CardDetailFields.ktD2 — EntryDetail CARD display block.CardEditFields.ktD2 — EntryEdit CARD field block.CardFieldUtils.ktShared card formatting/detection helpers for D2 (card type fields).ContextMenuSheet.ktD12 long-press context menu (spec §9).CsvExport.ktPure-Kotlin CSV serialisation for the C2 Export screen (CSV sub-view).CsvImport.ktPure-Kotlin CSV / JSON import parsing for the Import screen (spec B2).DetailTagRow.ktInline tag row for EntryDetailScreen, mirroring the browser EntryView: chips display in place, and the "+" affordance expands a same-surface tag editor.EditableFieldRow.ktD6 — Inline per-field editing for EntryDetailScreen.EntryDetailGenerator.ktD4 drafts — generator access from EntryDetailScreen.EntryDetailScreen.ktEntryDetailViewModel.ktEntryEditScreen.ktEntryEditViewModel.ktExportScreen.kt───────────────────────────────────────────────────────────────────────────── Password strength scorer (local, dependency-free) ─────────────────────────────────────────────────────────────────────────────IdentitySuggestDropdown.ktAnchored suggestion dropdown for identity-style fields (username/email).ImportScreen.kt───────────────────────────────────────────────────────────────────────────── ViewModel ─────────────────────────────────────────────────────────────────────────────MultiSelectUi.ktD12 multi-select per-row checkbox (spec §9).NotesModeScreen.ktE2 — full-screen editor for NOTE-type entries.NotesModeViewModel.ktBacks [NotesModeScreen].PasswordHistorySection.ktShared past-password history UI, extracted from EntryEditScreen so both the editor and EntryDetailScreen render the same rows.PeachField.ktThe Peach text field used across the entry-edit screens: a bare underline (no border box), drawn in t3 and lit to the accent while focused — matching the lock screen's credential inputs.PeachScriptExport.ktPeachScript export (MF-2) — writes the browser's PCHS binary payload (Argon2id + AES-256-GCM, zstd sections, BLAKE3 checksum, size-bucket padding, string-table entry packing) re-encoded into Private-Use-Area text.PeachScriptImport.ktPeachScript import (MF-2) — parses the browser's PCHS binary payload back into full vault entries.RecoveryWordsScreen.ktRuneResolve.ktWhich leg of the restore animation is running (browser: RestoreSymbols'
animating).TagChipEditor.ktMax tags per entry.TagListWidgets.ktHorizontally scrollable tag filter strip for VaultListScreen, placed between the search bar and the sort bar.TotpInlineEdit.ktE6 — TOTP double-tap to edit the 2FA secret, inline in EntryDetailScreen.TrashScreen.ktVaultHealthScreen.ktWarm amber used for the "reused" and "weak" advisory buckets.VaultListScreen.ktVaultListViewModel.ktupdates/
UpdateCheckWorker.ktLaunch extra set by the update notification so the app opens on the update flow.UpdateManifest.ktKepr's generic release manifest, as returned by
GET https://kepr.uk/api/<repo>/releases/latest, flattened to the single platform this app can install.UpdateRepository.ktThe Kepr side of in-app updates: what the newest release is, fetching its APK, and proving that APK is the one Kepr published before it is ever handed to the package installer.vault/
BrowserSlot.ktReads the browser extension's slot A so Android can restore a vault that was created there — a Codex printed from the extension, most importantly.Canary.ktDuressConfig.ktThe action Peach takes when the duress passphrase is entered at the lock screen.JwkString.ktReads a passkey's
privateKeyJwk whether it arrives as a JSON object or a string, and writes it back as an object.LastViewedEntryStore.ktRemembers the id of the entry the user last opened so a fresh unlock can land straight back on it (matching the extension, which opens the last entry rather than the list).PasskeyData.ktPasswordGenerator.ktCryptographically random password generator.PasswordHistoryItem.ktOne past password kept in [VaultEntry.passwordHistory].PeachPayloadCodec.ktPeachScript binary payload (PCHS) — a byte-for-byte port of the browser's peachPayload.ts (MF-2).PeachScript.ktPeachScript outer codec — maps each payload byte to one Private-Use-Area code point in U+E000..U+E0FF, and back.RecoveryWordList.ktRecoveryWords.ktSavedIdentity.ktTOTPGenerator.ktRFC 6238 TOTP / RFC 4226 HOTP.VaultCrypto.ktVaultEntry.ktVaultHealth.ktVaultLockTimer.ktIdle auto-lock timer.VaultRepository.ktLenient parser for the Codex vault-blob wrapper only.VaultSettings.ktVaultSnapshot.ktVaultStore.ktOne encrypted slot at rest.jniLibs/
arm64-v8a/
armeabi-v7a/
x86_64/
res/
drawable/
font/
layout/
mipmap-anydpi-v26/
values/
values-night/
test/
java/
com/
peachpasswords/
codex/
license/
security/
shared/
sync/
C7ChirpTransportTest.ktC7 transport tests.ChirpAdoptTest.ktAdoption frame protocol parity with the browser
chirp-adopt.test.ts.ChirpSyncCoordinatorTest.ktTwo in-memory [ChirpSyncSession]s wired back to back.ChirpSyncSuiteTest.ktChirpSync suite (brief Suite 13): length-prefixed pairing frames, SAS derivation KAT, and cross-device entry sync through the [VaultSyncAdapter] (two repositories made to share a sync root key via the Codex blob).CloudRelayReconnectListenerTest.ktCodePairingServerTest.ktCovers the two behaviours that are easy to get quietly wrong: a bad token must be refused with no reply at all, and an abandoned code must stop working.ForegroundSyncCoordinatorTest.ktNoiseKKTest.ktPairingAuthTest.ktPairingCodeTest.ktThe phone is the only side that generates pairing codes and the browser is the only side that reads them, so a drift here is invisible until a real pairing fails with nothing to look at.PairingInvitationTest.ktPeachWebSocketTest.ktExercises the server against OkHttp's RFC 6455 client rather than a hand-rolled one.RelayAdoptionHostTest.ktRelayFramesTest.ktThe relay frames share a channel with ordinary sync frames, so the one thing that must never break is telling them apart: a sync frame misread as a relay frame would be forwarded to another device, and a relay frame misread as sync would be handed to the vault.RelayHubTest.ktThe relay's whole job is to move bytes it must not understand between two peers that cannot reach each other.RelaySettingsPropagationTest.ktRendezvousTest.ktSyncAlertTest.ktSyncPaddingTest.ktSyncReconnectListenerRelayTest.ktThe dispatch itself, over a real socket and a real Noise session: two paired "laptops" connect, one asks to be relayed to the other, and a frame crosses.VaultSyncAdapterTest.ktui/
lock/
onboarding/
vault/
EntryDetailParityTest.ktEntryDetailScreenTest.ktEntryDetail suite (brief Suite 4): the screen's pure rendering logic — full-title ghost watermark, NOTE routing, breach-banner predicate, TOTP timing/hot-state, and masked card display.EntryEditExtraTest.ktEntryEdit suite expansion (brief Suite 5): the new-card field logic (network detection, PAN/CVC limits, expiry validation) and the password generator the editor drawer drives.EntryEditScreenTest.ktExportRoundTripTest.ktGhostWatermarkTest.ktImportParsersTest.ktNotesModeTest.ktRealBackupDecodeTest.ktDecode-path check against a real, full-size PeachScript backup rather than a toy fixture.VaultListSyncDotTest.ktVaultSearchParityTest.kt
updates/
vault/
BrowserPasskeyJwkTest.ktA passkey's
privateKeyJwk is a JSON OBJECT in the browser (JsonWebKey in shared/types.ts); Android holds it as a compact string.BrowserSlotTest.ktPins the browser→Android slot-A translation that Codex restore depends on.CardSerializationTest.ktIn-memory [VaultStorage] for exercising last4 derivation on save (MF-3).DuressSlotBTest.ktIn-memory [VaultStorage] including a decoy (slot B) slot, for the MF-6 duress model.OfficialCryptoVectorsTest.ktPasskeyEntryTest.ktPasswordGeneratorTest.ktPeachScriptRoundTripTest.ktPeachScript + CSV round-trip suite (brief Suite 7): large-vault fidelity, ciphertext tamper detection, size-bucket padding, and CSV column/injection behavior.PeachScriptTest.ktRecoveryEscrowIntegrationTest.ktIntegration coverage for the full create → confirm → seal → unlock recovery chain (brief Fix 1).RecoveryEscrowSuiteTest.ktRecoveryEscrow suite (brief Suite 3): word validation/autocomplete, partial and wrong-word failures, missing-escrow handling, recovery-driven password reset, and the duress-mode guard that recovery escrows are never sealed for the decoy.RecoveryEscrowTest.ktSlotAUnlockTest.ktIn-memory [VaultStorage] for the non-committing dual-derivation path (MF-5).SlotPaddingTest.ktExposes the raw stored slots so the padding lengths (MN-1) can be inspected.TOTPGeneratorTest.ktVaultCryptoKdfTest.ktMF-4: the Argon2id KDF must hash the password's explicit UTF-8 bytes (matching the browser's TextEncoder().encode), not its UTF-16 code units.VaultCryptoTest.ktVaultCrypto suite (brief Suite 2): Argon2id key derivation, AES-256-GCM round-trips, AAD enforcement, and KDF parameters.VaultHealthTest.ktVaultHealth suite (brief Suite 8): the pure [VaultHealth.buildReport] scoring — breach / reused / weak / aged / sensitivity detection, section counts, and the sensitivity-weighted vault score.VaultLockTimerTest.ktIn-memory [VaultStorage] so the timer can drive a real repository off-device.VaultRepositoryExtraTest.ktSecond VaultRepository suite (brief Suite 1 expansion).VaultRepositoryTest.ktIn-memory [VaultStorage] so the repository can be exercised without Android.widget/
gradle/
app/build.gradle actually declares versionName "2.2.0" / versionCode 202000.settings.gradleVERSIONhistory
363a93112668feat: Add EdDSA passkey crypto (v2.3.45)4 months ago142232e24288feat: Add ES256 passkey creation (v2.3.44)4 months ago44316f00e2edfeat: Sign ES256 passkey assertions (v2.3.43)4 months agoc3d88387bfd8feat: Surface passkeys in Credential Provider (v2.3.42)4 months ago93c2fbea8f2cfix: Preserve passkey private keys in PeachScript (v2.3.41)4 months agoad458e292ac6fix: Preserve Autofill picker origin type (v2.3.40)4 months agod651e3c935cdfix: Match additional URLs in Autofill origin checks (v2.3.39)4 months agoba9c7c76f6c9feat: Add Autofill save prompt handling (v2.3.38)4 months ago954dad0e1f77feat: Add Codex PDF sharing (v2.3.37)4 months agodfcad5a107c1feat: Add Codex restore shortfall parity (v2.3.36)4 months ago43dfb18543c3fix: Match browser Codex PDF filename (v2.3.35)4 months agof7363adae266feat: Gate Codex generation behind Pro (v2.3.34)4 months agobca92a34882afeat: Complete import/export parity (v2.3.33)4 months ago5460e6c45135fix: Align import restore error copy (v2.3.32)4 months ago424682531f2ffeat: Carry PeachScript metadata sections (v2.3.31)4 months agocb5e4242bca1fix: Match browser export filenames (v2.3.30)4 months agof6b8ff169519fix: Route peach backup files into restore flow (v2.3.29)4 months agoeee8f3be34b5feat: Complete feedback parity (v2.3.28)4 months ago31256f603665feat: Show active Pro license details (v2.3.27)4 months agobecd92652892feat: Match appearance theme toggle (v2.3.26)4 months ago4cf6c7a7417dfeat: Queue vouched sync devices (v2.3.25)4 months ago6453b0dda43ffeat: Add sync identity rotation (v2.3.24)4 months ago5c05adf0b225feat: Add protection breach check (v2.3.23)4 months agoc915805f8c62feat: Add passkey provider protection toggle (v2.3.22)4 months ago827354a8a29dfeat: Add vault history restore (v2.3.21)4 months ago94361110a63afeat: Add vault duplicate cleanup (v2.3.20)4 months agoa175832dabe6feat: Complete Notes parity flow (v2.3.19)4 months agoeb3db0cf92c2fix: Match browser note save and delete behavior (v2.3.18)4 months agodf73b22b6f1bfix: Add browser-style canary controls (v2.3.17)4 months agof9ec7f8479b4fix: Match browser card expiry entry (v2.3.16)4 months ago53183c79f084fix: Match browser add-entry tag behavior (v2.3.15)4 months agofb79f4f138acfix: Match browser card add-entry fields (v2.3.14)4 months ago610b588ac078fix: Match browser add-entry generator feel (v2.3.13)4 months ago15ca7bed330efix: Match browser add-entry identity suggestions (v2.3.12)4 months agod548c5f17d11fix: Match add-entry primary action state (v2.3.11)4 months ago33e27acd130dfix: Match browser optional add-entry fields (v2.3.10)4 months ago83e1953cc74ffix: Give vault list browser sheet transitions (v2.3.9)4 months ago2ea2f7890d69fix: Match browser vault search ranking (v2.3.8)4 months ago1d2329079f28docs: Add browser parity task map4 months ago55dfa7a7d79afix: Expose vault multi-select from sort bar (v2.3.7)4 months ago12a236a42d04fix: Match browser create-vault gating (v2.3.6)4 months agodd36496a3560fix: Unify existing entry editing with detail view (v2.3.5)4 months agoed96f6235dd3feat: Complete entry detail browser parity pass (v2.3.4)4 months ago1541d408acb4fix: Close browser gap quick wins (v2.3.3)4 months agoc94b00fae8aadocs: record pairing Pro license transfer session in CONTINUITY (v2.3.2)4 months agoc98070593695feat: Pro license transfer during chirp pairing — PAIR_IDENTITY gains optional 'license'; a Pro device advertises its signed blob and the peer activates it (LicenseRepository signature-verify) after SAS confirm, either direction; browser-parity wire field; bump 2.3.1→2.3.24 months ago7e04b97b04e0docs: record android sync UX parity session in CONTINUITY — sync-hub card, initial-sync copy, deck stride/tap fix, pull-to-refresh (v2.3.1)4 months agob6a502bb7352feat: pull-to-refresh on the vault list — custom nestedScroll spinner triggers SyncViewModel.syncNow(); dependency-free, accent-styled (v2.3.1)4 months agoaf8b5b404e22fix: Android settings/sync browser parity — tappable Sync hub row (drop open button + DEVICE FLOW label, add pair-device description), initial-sync local-network copy, deck tabs use fixed browser stride + active-card tap no-op (v2.3.1)4 months ago55d03cd77bf2docs: record PCH-02-002 Noise fix in CONTINUITY (v2.3.0)4 months ago
details
Peach for Android
A free, open source, local-first password manager for Android.
No accounts. No subscription. Your passwords stay on the device, encrypted with AES-256-GCM and protected by Argon2id key derivation. Sync, backup, and autofill happen without trusting any cloud in the middle.
Features
- Zero-knowledge vault — AES-256-GCM encryption, Argon2id KDF, keys never leave your device
- End-to-end encrypted sync — pairs with your other Peach devices over a Noise channel; the relay only forwards ciphertext it cannot read
- Inline autofill — fills directly in apps, no copy-paste detour
- Passkeys — WebAuthn credentials alongside your passwords
- Quick Settings tile — copy a credential from anywhere with a single tap
- Biometric unlock — hardware-backed AndroidKeyStore escrow, invalidated on enrollment change
- Codex — prints your encrypted vault as Aztec codes on paper. Physical offline backup
Open Source
Peach is free and open source under the GPL v3 license. Both the browser extension and the Android app.
The source is hosted on Kepr — Asha Software's own version control platform.
Security
Peach has undergone two adversarial analysis sessions against this codebase. The most recent findings have been resolved.
Cryptographic primitives:
- Key derivation: Argon2id (m=64MiB, t=3, p=4)
- Encryption: AES-256-GCM with fresh random nonces
- Sync handshake: Noise NK / Noise KK (25519, ChaChaPoly, BLAKE2s)
- Backup codec: GF(2⁸) Reed-Solomon with zstd compression
- BLAKE3 checksums throughout
The canonical Noise core lives in a shared Rust crate with the browser extension — Android drives it via JNI. See docs/CRYPTOGRAPHIC-TEST-VECTORS.md for the byte-level vectors that pin each primitive.
Building
./gradlew assembleRelease
Outputs to app/build/outputs/apk/release/. The shared Noise core is built from ../peach-browser/crypto-core.
License
GPL v3 — see LICENSE.
Peach Pro
Pro features (end-to-end encrypted sync, Codex, Canary) are available for $39 one-time at peachpasswords.com. Purchasing Pro supports continued development.
Built by Asha Software · [email protected]