Security
Encrypted because of how it is built.
Not a setting you turn on. Here is exactly how it works.
One message, end to end
Follow a single message from your phone to theirs.
The handshake
What happens before your first message is even sent.
X3DH to start a conversation
An extended triple Diffie-Hellman against the recipient's published keys, so the first message is already encrypted with nobody waiting online.
A Double Ratchet per thread
Every message advances a ratchet and is sealed under its own key. One key does not open the thread, and the chain heals after a compromise.
Sender keys in groups
A group encrypts once per sender, not once per member, up to 256 people. Removing someone rotates the key.
Safety numbers you can check
A 60 digit number, half from each side. If someone's devices change, it changes and the app says so.
Check it yourself
Every chat has a number that both of you can see. If they match, nobody is listening in.
Safety number
Read it aloud together. If both sides match, nothing is in the middle.
What we actually use
No proprietary cryptography. Every piece is something you can look up.
- Key agreement
- X25519 Diffie-Hellman
- Signatures
- Ed25519, on identity and signed prekeys
- Key derivation
- HKDF-SHA256, with HMAC-SHA256 chain keys
- Message encryption
- AES-256-GCM
- Safety number
- Iterated SHA-512, 5200 rounds, 30 digits per account
- Local key storage
- IndexedDB, sealed under a non-extractable AES-256-GCM key
What reaches our servers
The same message as you wrote it, and as we store it.
What you wrote
the flight lands at 6:40, terminal 2
What we store
8f2a41c7d9e0b35a6114fc820d7e93a15c4b6802ff31d95e7a08c264b19d3f7e…
There is no readable copy.
What the server holds
Ciphertext, and the routing needed to deliver it: which conversation, which sender, when.
What it never holds
The keys to an encrypted message. There is nothing on our side that opens one.
Metadata is sealed too
Voice notes, locations and contacts are sealed with the message. Only what delivery needs stays readable.
Backups stay yours
Encrypted on your device first, under a key that never leaves it.
Your devices
Each one earns its own access, and loses it when unused.
Each device has its own identity
A new device generates its own keys. Messages are encrypted to each of yours separately.
Linking is deliberate
A new device shows a code an existing one approves. Nothing moves until you approve it.
History does not follow automatically
A device reads what it was there for, or what you restore from backup. That is the cost of keys we never hold.
Old devices fall away
Five most recent devices, and an unused one is dropped.
Where it stops
The limits, stated here rather than discovered later.
Groups above 256 people
Sender keys cover a group up to 256 members. A larger one is not end to end encrypted, and the app does not pretend otherwise.
Messages sent before we shipped this
A small number of early messages predate end to end encryption and were stored readable. Everything sent since is encrypted.
The people you write to
Encryption protects a message in transit and at rest. It cannot stop someone in the conversation from screenshotting it.
What a device has seen
Your history lives on the devices that received it. Losing all of them without a backup means losing it.