End-to-end encryption, explained without the hand-waving.

In plain English

Your computer makes its own keys. When you install the app it creates a private key that can't be exported from your device. We only ever receive the matching public key — the padlock, not the key.

Each message is locked for the recipient's devices. Before a message leaves your computer it's locked so that only the devices your contact has linked can open it. If they use a laptop and a browser, each gets its own locked copy.

Every message is signed. Your device signs what it sends, so the other side can tell it really came from you and wasn't altered on the way.

We just pass it along. Our relay sees a sealed envelope and who it's for. It can't open it, doesn't log it, and doesn't keep it after delivery.

You can check for yourselves. Every chat has a security code. Read it to each other on a call; if it matches, nobody is listening in. You're warned if it changes.

The technical detail

• Device identity: ECDH P-256 key agreement and ECDSA P-256 signing keys, generated with the platform's WebCrypto; private keys are non-extractable.
• Per message: a fresh random 256-bit key encrypts the content with AES-256-GCM. That key is wrapped separately for each recipient device using an ephemeral ECDH key and HKDF-SHA-256.
• Authentication: the sealed message is signed by the sending device; recipients verify the signature against the sender's registered device keys and reject anything that doesn't match.
• At rest: history on your device is encrypted with a local key, optionally protected by your passcode (PBKDF2, 310,000 iterations).
• Transport: TLS to our relay; the relay holds undelivered ciphertext in memory only, for at most 24 hours.
• The desktop app ships its own copy of this code — it isn't downloaded from our website each time you open it.