Skip to content

peach sync

Your vault. On every device.

Chirp pairs devices with an ultrasonic audio handshake — no accounts, no servers, no QR codes. Hold two devices near each other and they exchange keys through sound. Pairing is physical by design: only devices in the same room can hear each other. Add as many devices as you need — each one pairs once via Chirp and joins your vault automatically.

After pairing, vault sync runs over your local network. Every connection uses Noise XX — both devices verify each other's identity on every sync before a single byte of vault data moves. No relay, no cloud hop, no third party in the middle.

01

Audio pairing

Hold two devices near each other. They exchange ephemeral X25519 keys over ultrasonic audio — room-bounded and inaudible to people.

02

Local network sync

After pairing, devices find each other on your LAN. Your phone acts as the sync hub — browser extensions sync through it. No port forwarding, no manual IPs, no relay server.

03

Mutual auth, every time

Noise XX handshake with long-term keys. ChaCha20-Poly1305 transport. Delta sync by last-write timestamp.

04

Add more devices

Each new device pairs once via Chirp and joins the mesh. Your vault converges across all devices whenever they share a network — no reconfiguration needed.

the architecture

How Peach is different.

Every major password manager works the same way: you create an account, they store your vault on their servers, and you retrieve it when you log in. That means the company can see your vault data, a server can be breached, and your account can be locked or deleted.

Peach doesn't work that way. Your vault lives on your device — encrypted with a key only you hold. There is no server to retrieve it from, no account to log into, and no central database that can be breached. Peach Sync moves data directly between your devices, encrypted, peer-to-peer. If you want to move to a new device without syncing, export your vault as PeachScript or use Peach Codex to print a scannable physical backup — restore either with the backup password you set.

The backup is an encrypted snapshot of your vault — not your secrets in plain text. Without its password, it is useless data. The encryption (AES-256-GCM) and key derivation (Argon2id at 64MB) are applied before the backup is ever generated, on-device, with no network involved.

Passkeys work where you browse. Peach supports them in Firefox and Chrome so you can sign in with your device instead of another password.

No hosted vault

Bitwarden, 1Password, and Proton Pass all store your encrypted vault on their infrastructure. Peach has no infrastructure to store user data — there is no hosted vault, no account database, no vault service to breach.

No account required

Every major manager ties your vault to an email address and password. Peach ties your vault to your device and your passphrase. No email, no company holding a reset link. Your recovery is a 12-word phrase you control — not a link sent to an inbox.

No sync server

The common sync model: your vault goes through the company's servers every time it changes. Peach Sync is peer-to-peer on your local network — your data never touches a relay, and the connection is encrypted end-to-end.

Portable without lock-in

Other managers export to proprietary formats or encrypted blobs tied to their own decode logic. PeachScript backups decode on any device running Peach. Move to a new machine, restore your vault, no vendor lock-in.

advanced security

Defenses for the cases people avoid.

Two Peach Pro features built for hard edge cases: a vault that may have been extracted, and a moment where unlocking is not optional.

Canary EntriesPro

Plant a fake credential in your vault. Peach never autofills it and never suggests it — it just watches. If that password ever appears in a data breach, it means someone extracted your vault and is testing the credentials. Peach alerts you immediately.

A fake entry gives you a signal when the worst-case story stops being theoretical.

Duress VaultPro

Set a second master password that opens a separate, convincing decoy vault. At a border crossing, under coercion, or anywhere you need it — enter the duress password and Peach opens normally, showing only what you put there. Your real vault stays encrypted and invisible.

A decoy vault gives you an answer when privacy and personal safety collide.

ready to switch?

Import from any password manager. Free forever.

Go Pro — $39 Get Peach Free →