Skip to content
peach by asha.software

Features

Everything you need.
Nothing you don't.

Passwords, cards, notes, and 2FA codes in one encrypted vault. Peach fills, generates, and watches for breaches — without a hosted vault or an account.

No browser switch required.

Firefox Passkeys

Peach can save and use passkeys in Firefox and Chrome, so sign-ins feel native wherever you browse. Your device proves it is you; there is no password to steal.

Last resort, deliberately hard to press.

Panic Option

If you choose to leave no local vault behind, Panic can irreversibly destroy the vault on that device. Peach asks twice, names the consequence plainly, and warns you to export a PeachScript backup first so the option stays intentional.

Knows what the site wants.

Smart Password Generation

Peach detects password requirements on the page—minimum length, required special characters, maximum length, no symbols—and automatically generates the strongest password the site supports. No manual settings. No guessing. You click generate and it is right.

Your identities, one click.

Username & Email Helper

On sign-up forms, Peach offers your pre-saved usernames and email addresses in a clean dropdown. Pick an existing one or create a new one on the spot. No more typing your email for the thousandth time.

You do not even think about it.

Instant Autofill

Peach recognizes login forms and fills them instantly. Multiple accounts on the same site? Clean picker. TOTP codes? Auto-copied to clipboard when you need them.

Knows before you do.

Breach Monitoring

Peach checks your passwords against known data breaches using Have I Been Pwned’s k-anonymity API. Your passwords never leave your device. Compromised entries are flagged with one-tap regeneration.

end-to-end sync

Your vault. On every device.

Pair once. Scan a code, confirm the same eight digits, and your devices stay in step. Afterwards every sync is Noise KK — the relay never sees your vault and stores not a single byte of your data. It never decrypts, parses, or buffers a frame.

Just a pipe between two sockets at an unguessable address — a third is rejected. It logs nothing per session. Use ours, host your own, or turn it off. No account.

01

Scan to pair

One shows a code with a relay address and single-use token. The other scans it — ephemeral X25519 keys over Noise NK.

02

Confirm digits

Both show the same eight digits from the handshake. Confirm they match to complete pairing.

03

Sync, every time

Noise KK mutual auth. ChaCha20-Poly1305, padded frames, delta sync by last-write time.

04

Add more

Each device pairs once. Revoke one and it stops receiving changes.

the difference

No hosted vault to take.

Most managers store your vault on their servers. Peach doesn’t. It lives on your devices, encrypted with a key only you hold. PeachScript or Peach Codex lets you move it — a portable snapshot that restores with your backup password, no vendor needed.

No hosted vault

No vault service to breach. The relay stores nothing — it just passes encrypted frames.

No account

No email, no reset link. Recovery is a 12-word phrase you control — not an inbox.

Portable

Standard CSV, PeachScript, or printed Codex. Move to a new device, restore, done.

for hard cases

When the worst case isn’t theoretical.

Canary EntriesPro

A fake credential that Peach never fills. If it ever appears in a breach, someone is testing an extracted vault. You get the signal.

Duress VaultPro

A second master password opens a decoy vault. At a border or under pressure, it looks normal — your real vault stays encrypted and invisible.

ready to switch?

Import from any password manager. Free forever.

Go Pro — $39 Get Peach Free →