Secure Messaging Division

Communications that answer to you

End-to-end encrypted messaging for operations that cannot depend on somebody else's servers, somebody else's directory, or somebody else's word.

Launch web client Download No account · No phone number
Built on
  • RFC 9420 Messaging Layer Security
  • FIPS 203 ML-KEM-768
  • RFC 9474 Blind signatures
  • RFC 9106 Argon2id

How it works

The relay carries what it cannot read

Conventional messaging protects the words and leaks everything around them — who spoke to whom, when, and how often. This is what our relay holds instead.

YOUR DEVICE keys — never leave group membership plaintext sealed here deposit RELAY assume it is hostile rotating recipient tag unlinkable token padded ciphertext no sender · no account no conversation graph collect THEIR DEVICE keys — never leave group membership plaintext opened here A subpoena served on the relay returns the account creation date, and nothing else.
Message path. Compare a conventional messenger, where the middle panel would also carry sender identity, recipient identity, a timestamp and a message size — the four fields that reconstruct who knows whom.

Capabilities

Designed so the server is worth nothing to an attacker

Protecting message content is the easy part; every product does it. The difference is what remains after that.

End-to-end encrypted

Sealed on your device, opened on theirs. The relay holds no key material at any point, so there is nothing to hand over and nothing to compel.

No sender to record

Deposits carry no sender field — not stripped, never present. Sending spends a token the relay signed blind: it verifies a real account without learning which.

Post-quantum today

Key exchange combines X25519 with ML-KEM-768. Traffic recorded now stays private against an adversary who builds a quantum computer later — it fails only if both halves fail.

No identity to surrender

No phone number, no email, no name. You choose an identifier and share it directly — there is no directory to be found in and no contact list uploaded anywhere.

Self-hosted by design

Runs on your hardware, on your network, under your control. A single static binary with no interpreter and no plugin loader to audit.

Forward secret

Keys advance with every message and every membership change. A device compromised today does not expose last month's traffic, and removing someone is permanent.

Comparison

What a seized server would yield

The row that matters is not encryption — everyone encrypts. It is everything underneath it.

On the serverConventional messagingCoreNet Messaging
Message contentEncryptedEncrypted
Who sent itRecordedCryptographically unavailable
Who received itRecordedRotating tag only
Contact listUploadedNever leaves the device
Group membershipServer-visibleServer-blind
Message sizeExactThree fixed buckets
Delivered messagesRetainedDeleted on collection
Account identifierPhone numberSelf-chosen, unlinked

Specifications

Standard cryptography, no house blend

Every primitive is a published standard with existing formal analysis. There is no CoreNet-original cryptography anywhere in the system, by policy — invented ciphers are how messaging products fail.

The relay performs no message processing and stores no history. Delivered messages are removed on collection, so there is no archive to seize afterwards.

Cryptographic specification
Group protocolMLS 1.0 — RFC 9420
CiphersuiteMLS_256_XWING_CHACHA20POLY1305_SHA256_Ed25519
Key encapsulationX-Wing — X25519 + ML-KEM-768
Authenticated encryptionChaCha20-Poly1305 — RFC 8439
SignaturesEd25519 — RFC 8032
Hash and KDFSHA-256 · HKDF-SHA-256
Sender unlinkabilityBlind RSA — RFC 9474
Local storageXChaCha20-Poly1305 · Argon2id
Message padding4 KiB / 64 KiB / 1 MiB
RetentionDeleted on collection; 30-day ceiling

Platforms

Run it where you work

The web client runs the same cryptographic core as the native builds, compiled to WebAssembly. Nothing to install, and it works on a phone.

WebAvailable

Any modern browser, desktop or mobile. Same core, compiled to WebAssembly.

Launch
LinuxAvailable

x86-64 client. Single static binary, no runtime required.

Download
macOSAvailable

Apple silicon client.

Download
iPhone & AndroidInstallable

Open the web client, then Share → Add to Home Screen on iOS, or Install app on Android. It runs full-screen with its own icon, on the same cryptographic core as the desktop builds.

Open on your phone

Limitations

What this does not do

A product that overstates its protection is more dangerous than one clear about its edges, so these are here rather than buried in documentation.

This is a development build and has not been independently audited. Voice and video are not implemented, and the transport is plain HTTP on a local network rather than QUIC with post-quantum TLS. Evaluate it; do not yet depend on it.

A compromised device defeats everything. Anything that can read your screen can read your messages, and no protocol prevents that. Anyone you message can repeat it — screenshot detection and disappearing timers are conveniences, not controls. The network still sees that you connect, and roughly how much you send. And because the design deliberately cannot identify senders, abuse reports cannot be cryptographically substantiated — that is the direct price of unlinkability, not an oversight.