peach sync
Your vault. On every device.
Chirp pairs devices with an ultrasonic audio handshake — no accounts, no servers, no QR codes. Hold two devices near each other and they exchange keys through sound. Pairing is physical by design: only devices in the same room can hear each other. Add as many devices as you need — each one pairs once via Chirp and joins your vault automatically.
After pairing, vault sync runs over your local network. Every connection uses Noise XX — both devices verify each other's identity on every sync before a single byte of vault data moves. No relay, no cloud hop, no third party in the middle.
the architecture
How Peach is different.
Every major password manager works the same way: you create an account, they store your vault on their servers, and you retrieve it when you log in. That means the company can see your vault data, a server can be breached, and your account can be locked or deleted.
Peach doesn't work that way. Your vault lives on your device — encrypted with a key only you hold. There is no server to retrieve it from, no account to log into, and no central database that can be breached. Peach Sync moves data directly between your devices, encrypted, peer-to-peer. If you want to move to a new device without syncing, export your vault as PeachScript or use Peach Codex to print a scannable physical backup — restore either with the backup password you set.
The backup is an encrypted snapshot of your vault — not your secrets in plain text. Without its password, it is useless data. The encryption (AES-256-GCM) and key derivation (Argon2id at 64MB) are applied before the backup is ever generated, on-device, with no network involved.
Passkeys work where you browse. Peach supports them in Firefox and Chrome so you can sign in with your device instead of another password.
advanced security
Defenses for the cases people avoid.
Two Peach Pro features built for hard edge cases: a vault that may have been extracted, and a moment where unlocking is not optional.