security fundamentals
The architecture is the promise.
Peach doesn't ask you to trust a company. The security claims are enforced by the code running on your machine.
Peach is built on TypeScript and SolidJS.
We designed Peach so that even we cannot read your passwords.
No product telemetry.
The only outbound connections are opt-in breach monitoring and an opt-in bug reporting system. Bug reports record only device type — for example, iPhone 15 or MacBook Air M2. No user IDs, no IP addresses, no account required.
No account.
Peach never asks for your email, your name, or any identifying information to use the product. There is no user database. There are no users—only installations.
Payments stay with the processor.
Checkout is handled by Polar. Licenses are generated after payment and sent to your email within seconds. Peach does not receive or retain a customer profile from the purchase.
No hosted vault to breach.
Peach uses a relay for sync, but it has no hosted vault service, account system, or customer database. The relay forwards encrypted traffic and stores no vault or customer data.
Export anytime. To anywhere.
Your vault is yours. Export as a standard CSV to move to any password manager, as PeachScript to restore into Peach on another device, or as a Peach Codex to keep a physical backup in a safe. No lock-in. No export fee.
No kill switch.
Your license works offline forever. If Peach development stopped tomorrow, your installed copy would keep working indefinitely. No phone-home, no expiration.
Where Peach runs.
Chrome
extension | service worker | passkeys
Firefox
extension | service worker | passkeys
Android
Keystore TEE | biometric | autofill service | beta
iOSComing 2027
Secure Enclave | Face ID