SecureChat365

Your account is a key.

No phone number, no email, no signup. SecureChat365 generates a keypair on your device the first time you open it. The public half is your contact ID — share it however you like. Messages are end-to-end encrypted with the Olm double ratchet, and the server that carries them cannot read a word.

A contact ID

64 · public key
4 · nospam
4 · checksum

The last four characters catch every single-character typo. The four before them can be rotated to stop unwanted contact requests, without changing your key or breaking existing conversations.

Alpha, and not yet audited. This works and you can use it, but the cryptography has not been reviewed by anyone outside the project, and contact verification is incomplete. Treat it as something to try, not something to depend on. See the full list of known gaps.

Why it's different

Three things most messengers won't tell you

Identity

Nothing links to you

A phone number ties every conversation to your legal identity and hands your contact list to a server. There is no number here, and no account to seize.

The server

It only sees ciphertext

Messages are encrypted before they leave your device and decrypted only on the other one. The relay stores and forwards bytes it has no key for.

The code

You can read all of it

Client, server, and threat model are public. Run your own relay if you would rather not trust ours.

How it works

Three steps, in this order

The order matters. You cannot verify someone before you have added them, and adding them is what tells your device which key to expect.

Step 1

Share your ID

Show the QR code or send the 72 characters. Any channel works — the next two steps are what catch tampering.

Step 2

They add you

Their app fetches your public keys and checks them against the ID they scanned. If those disagree, it refuses and says so.

Step 3

Compare safety numbers

Read the digits aloud in person or on a call. Matching numbers mean no one is sitting between you. This is the step that actually proves it.

Version 0.1.4

Download

Same app on every platform. Pick the build that matches your machine.

The desktop builds are not code-signed yet, so macOS and Windows will warn you before opening them. That warning is accurate: nothing has vouched for these files. If that isn't a trade you want to make, build from source instead.

Threat model

What it protects, and what it doesn't

A security tool that overstates itself is worse than one that makes no claims at all. Here is the honest version.

Protected

  • Anyone reading your messages, including whoever runs the server
  • A server substituting its own keys to impersonate a contact
  • Anyone watching the network between you
  • Past and future messages if a key is later compromised
  • Someone who seizes the server after the fact

Not protected

  • Who you talk to and when — the relay sees that, and it is often the more sensitive fact
  • A device someone else has unlocked, or one running malware
  • A compromised operating system
  • Traffic analysis — there is no padding or cover traffic
  • The person you are talking to screenshotting the conversation