Pre-release
Post-quantum encrypted messaging, built for Apple platforms.
Coming to the App Store
Highlights
What sets it apart.
Beyond any competitor
Most messengers offer a few of these and none offers many of them together: post-quantum cryptography on every message and call, a post-quantum key exchange as frequent as the conversation chooses, per-device deniability with a duress wipe, indistinguishable payloads, key transparency without a trusted directory, several handles under one account, sender-owned messages, residency by choice, enterprise controls without key escrow and the CNSA 2.0 suite throughout. Rarest of all is formal verification of the whole system, which few take beyond the core of their protocol.
Post-quantum throughout, on CNSA 2.0
Messages, calls, groups, media, voice notes, memories and backups rest on one suite: ML-KEM-1024 for key exchange, ML-DSA-87 for signatures, AES-256-GCM for sealing, SHA-512 with HKDF and HMAC for derivation and authentication, and Argon2id ahead of PBKDF2-HMAC-SHA512 wherever a passphrase or code becomes a key. Nothing outside the suite protects a message, a key or a record.
A fresh key for every message
Each message is sealed under a key derived for it alone from a chain that advances with every message, and a new post-quantum key exchange renews that chain as often as the conversation chooses, from every message at the strictest setting to every fiftieth.
Two device tiers, and duress
Secure and Discrete devices hold different views of the same account, so a device surrendered under pressure reveals only what its tier was given, and a duress code wipes exactly the handles chosen in advance.
Indistinguishable payloads
Every message carries two sealed payloads of the same shape, so no observer can tell which one a device will open.
Key transparency without a trusted directory
Every identity publishes its own append-only chain of keys, and every peer checks it.
Several handles, one account
Each handle carries its own keys, contacts and conversations; a handle can stand in front of another and pass on what it receives, and the servers in between cannot see who writes to whom.
Forward secrecy and post-compromise security
Keys rotate on a negotiated schedule, retired keys are destroyed on every device, and every rotation establishes fresh secrets that owe nothing to the ones before.
Placed and withdrawn on the handle's terms
Encrypted records live in the region each handle chooses, and deleting a sent message destroys its keys on every device that holds it.
Enterprise without key escrow
Organizations get seats, roles, legal hold, retention, discovery export and single sign-on, and an administrator never holds a member's private key.
Hardened by design
Apple's Enhanced Security protections are on across the app, the cryptographic core is built to run in a process of its own, and the code is compiled under the strictest settings its languages allow, with every warning an error. Secrets are wiped the moment they are no longer in use, and a check that cannot complete refuses rather than assumes.
Formally verified
Machine-checked proofs cover the design, from the key agreement to the server's access rules, and the implementation is checked against them.