Peach

A free, open source, local-first password manager.

No servers. No subscription. No account required. Your passwords stay on your device, encrypted with AES-256-GCM and protected by Argon2id key derivation. Everything else — syncing, backup, autofill — happens without a cloud in the middle.

peachpasswords.com

Features

• Zero-knowledge vault — AES-256-GCM encryption, Argon2id KDF, keys never leave your device
• Chirp Sync — pairs devices over ultrasonic audio. No QR codes, no servers, no accounts
• Codex — prints your encrypted vault as Aztec codes on paper. Physical offline backup
• Inline autofill — fills directly in the page, no redirects
• TOTP built in — two-factor codes without a separate app
• Canary alerts — get notified if a saved credential is accessed
• One-time purchase — $39 for Pro, yours forever

Browser Extension

Available for Chrome and Firefox.

Chrome Web Store · Firefox Add-ons

Android

Coming to the Play Store. Source available in this repository.

Open Source

Peach is free and open source under the GPL v3 license. Both the browser extension and the Android app.

The source is hosted on Kepr — Asha Software's own version control platform.

Security

Peach has undergone two adversarial analysis sessions. All findings have been resolved. See security/ for the full reports.

Cryptographic primitives:

• Key derivation: Argon2id (m=64MiB, t=3, p=4)
• Encryption: AES-256-GCM with fresh random nonces
• Sync handshake: Noise NK / Noise XX (25519, ChaChaPoly, BLAKE2s)
• Backup codec: GF(2⁸) Reed-Solomon with zstd compression
• BLAKE3 checksums throughout

Building

bun install --frozen-lockfile
bun run build

Outputs to dist-chrome/ and dist-firefox/.

Contributing

See CONTRIBUTING.md.

License

GPL v3 — see LICENSE.

Peach Pro

Pro features (Chirp Sync, Codex, Canary) are available for $39 one-time at peachpasswords.com. Purchasing Pro supports continued development.

Built by Asha Software · [email protected]