README.md
Peach
A free, open source, local-first password manager.
No servers. No subscription. No account required. Your passwords stay on your device, encrypted with AES-256-GCM and protected by Argon2id key derivation. Everything else — syncing, backup, autofill — happens without a cloud in the middle.
Features
- Zero-knowledge vault — AES-256-GCM encryption, Argon2id KDF, keys never leave your device
- Chirp Sync — pairs devices over ultrasonic audio. No QR codes, no servers, no accounts
- Codex — prints your encrypted vault as Aztec codes on paper. Physical offline backup
- Inline autofill — fills directly in the page, no redirects
- TOTP built in — two-factor codes without a separate app
- Canary alerts — get notified if a saved credential is accessed
- One-time purchase — $39 for Pro, yours forever
Browser Extension
Available for Chrome and Firefox.
Chrome Web Store · Firefox Add-ons
Android
Coming to the Play Store. Source available in this repository.
Open Source
Peach is free and open source under the GPL v3 license. Both the browser extension and the Android app.
The source is hosted on Kepr — Asha Software's own version control platform.
Security
Peach has undergone two adversarial analysis sessions. All findings have been resolved. See security/ for the full reports.
Cryptographic primitives:
- Key derivation: Argon2id (m=64MiB, t=3, p=4)
- Encryption: AES-256-GCM with fresh random nonces
- Sync handshake: Noise NK / Noise XX (25519, ChaChaPoly, BLAKE2s)
- Backup codec: GF(2⁸) Reed-Solomon with zstd compression
- BLAKE3 checksums throughout
Building
bun install --frozen-lockfile
bun run build
Outputs to dist-chrome/ and dist-firefox/.
Contributing
See CONTRIBUTING.md.
License
GPL v3 — see LICENSE.
Peach Pro
Pro features (Chirp Sync, Codex, Canary) are available for $39 one-time at peachpasswords.com. Purchasing Pro supports continued development.
Built by Asha Software · [email protected]