Android · Windows · Linux · No account · No servers
PrivChat is a peer-to-peer messenger. There is no account to create, no phone number to give, and no company holding the conversation — including the people who made it. Two phones talk through Tor. That is the entire architecture.
Are you on a server I can subpoena, or not?
There is no server. It is still on my phone until yours answers.
queued · on this deviceThen there is nothing to ask for.
delivered · 1h then gone
The record is the product
Your words are protected, but a company still sees who you talk to, when, and how often. That record is often more revealing than the words. PrivChat removes the company instead of asking you to trust it.
| Criterion | PrivChat | Telegram | Signal | SimpleX | Tox | Briar | |
|---|---|---|---|---|---|---|---|
| Works without a phone number | Yes | No | No ¹ | No | Yes | Yes | Yes |
| Servers everything passes through | None | Meta’s | Telegram’s | Signal’s | Relays with no identity | None | None |
| Who can know who you talk to | Nobody | Meta | Telegram ² | Signal, the minimum | Nobody | Your IP can leak | Nobody |
| Post-quantum key agreement | Yes | No | No | Yes | Yes | No | No |
| Post-quantum signatures and envelope | Yes | No | No | No | No | No | No |
| Open source | No | No | Clients only | Yes | Yes | Yes | Yes |
¹ Telegram allows signing up with an anonymous +888 number, which is paid for.
² Since 2024 Telegram hands IP addresses and phone numbers to authorities on a valid court order.
Checked in September 2026 against each app’s public documentation. These things change: if you see something wrong or out of date, write to us and we will correct it.
No serious messenger comes off badly here for weak encryption: they all encrypt well. The difference is what gets recorded outside your phone, and who has to keep behaving for that to stay true.
How a message travels
The message is encrypted before it leaves. Nothing readable crosses the wifi, the tower, or your provider.
A chain of relays, each knowing only the hop before and the hop after. Volunteers, not a company. The first does not know whom. The last does not know who.
The key exists only on the two devices. If they are offline, the message stays on yours and tries again. Nothing is parked on a machine belonging to someone else.
Are you on a server I can subpoena, or not?
There is no server. It is still on my phone until yours answers.
queued · on this deviceThen there is nothing to ask for.
delivered · 1h then goneEach hop knows one neighbour. Nobody in the chain holds the key.
Without internet
A blackout, a network shut down, a place with no signal. PrivChat does not just wait: it talks to the person in front of you without going through the internet, or puts your messages in a package that goes as far as someone carries it, or keeps them at home until you are back, or sends them over the radio to your contact's node. The same encryption, the same keys, and the messages land in the same conversation.
Local Wi-Fi · Bluetooth · tens of metres
The same Wi-Fi, even with no way out to the internet, or Bluetooth. With no router, one phone creates the network and the other joins. You both turn it on on purpose, for one contact and for a limited time: the app never announces itself to anyone on its own.
USB · email · any channel · no distance limit
Your messages, sealed in a file only the recipient can open. Save it on a USB stick or send it through any channel: whoever carries it cannot read it, and if it is tampered with, it will not open. From the outside it is shapeless bytes: it does not even say which app it comes from.
Home Wi-Fi · Tor, optional · always on
PrivChat with no screen on a Raspberry Pi or a computer at home. When you are out, whoever comes by your Wi-Fi leaves your messages there and picks up the ones you left them; with internet, people can write to you with your phone off. It only keeps what is yours, sealed: it cannot read it.
LoRa radio · Meshtastic or MeshCore · kilometres
A small radio next to the phone, linked by Bluetooth. With no internet and no coverage, your texts go out over the radio in pieces and other nodes repeat them for kilometres; your Mailbox with a node delivers them over Tor. Text only, and a few messages an hour. Whoever listens sees that a node transmits, not what or to whom.
It does not relay through strangers' phones or look for anyone: the same rule as over Tor. On the phone and on the desktop.
What an observer sees
A one-letter reply and a long paragraph leave the phone as identical envelopes. Decoy packets go out at random, indistinguishable from real ones. Toggle the conversation off: the line does not change its story.
An observer watching the connection cannot tell whether you are having a conversation at all.
Without decoys, bursts of packets track your typing. The words stay hidden. The fact of speech does not.
The line is quiet. That itself is a signal — which is why cover traffic is on by default.
Readable field: a random single-use key. The routing header is encrypted. The sender’s identity is not on the envelope.
What protects it
Keys are not reused. Each message is encrypted with its own, derived fresh and thrown away. If one key were ever compromised it would open one message — not the conversation. Once the two phones speak again, the chain heals itself.
Encrypting the words is the easy part; what leaks is everything around them. Each message is wrapped in a sealed envelope whose only readable part is a random single-use key. Since 2.2 that envelope is born from the conversation, not from your identity.
A one-letter reply and a long paragraph produce packets of identical size. The app also sends decoys at random intervals, indistinguishable from real ones. An observer cannot tell whether a conversation is happening.
Why it will still be safe in twenty years
An adversary can record your encrypted traffic today and simply store it. If, years from now, a quantum computer breaks the key exchange used in 2026, everything they stored becomes readable — retroactively, and there is nothing you can do about it then, because the recording already happened. PrivChat’s key agreement combines X25519 with ML-KEM-768, the post-quantum algorithm standardised by NIST in 2024. The two secrets are mixed, so an attacker has to break both.
What you say today is still worth protecting in fifteen years.
On your phone
Messages, contacts, attachments and the keys themselves are encrypted with a key held in the Android keystore, tied to the device hardware.
A PIN means the key needs two halves: yours and the phone’s. A panic PIN wipes the identity and is indistinguishable from a normal unlock.
Messages can delete themselves after an hour, a day, or a week. Erase identity destroys the keys, not just the files: old data is unrecoverable even with the phone in hand.
The app excludes itself from Android backups. Conversations are never uploaded anywhere, and photos are recompressed so GPS, model and date do not travel with them.
Groups
A message to the group leaves your phone once per member, over the same encrypted one-to-one sessions. The member list is signed by the admin, so nobody can be slipped in unnoticed. There is no server keeping the roster. Up to two hundred people; the app states the data cost before you join.
Channels
A channel has its own Tor address and signing key, unlinked from the publisher’s messaging identity. Readers fetch posts over anonymous circuits, so the publisher cannot tell who reads. Posts are signed and chained, so history cannot be rewritten in silence.
Start talking
The first launch generates an encrypted identity on the device. Nothing is sent anywhere. No name, no number, no email.
Each invitation is a QR code that works for one person and expires. Share it only with them; their app fetches keys through Tor.
Read the digits out loud. If they match, you are talking to the person you think you are — not to someone who intercepted the introduction.
Walkthrough, message states and first contact: How to use PrivChat.
Said plainly
Android, Windows, Linux and Mac. Not on iPhone yet: it is in testing and coming soon.
Both of you need the app. It does not federate with other messengers or SMS.
If they are not online, the message waits on your phone, unless you are nearby ("In person"), carry it by hand in a package, or you both have a LoRa node.
No calls, no video calls: Tor’s latency does not allow it. There are voice notes and video messages.
Cover traffic uses data — about a gigabyte a month if you leave it on.
Tor is slower than a company’s datacenter. That is the price, and it is the point.
Under the hood
Nothing here is home-made. Every piece is a public standard, and the links go to the specifications themselves, not to us. Current release: 2.15.0 on Android and 1.7.1 on desktop.
Peer-to-peer: each phone is its own Tor v3 onion service, with no server in between.
specificationPQXDH — X25519 combined with ML-KEM-768 (FIPS 203).
specificationDouble Ratchet with encrypted headers and ML-KEM-768 in every epoch. Prekeys renewed weekly.
specificationChaCha20-Poly1305 (RFC 8439).
specificationEd25519 and ML-DSA-65 (FIPS 204). Both required.
specificationHKDF-SHA256 (RFC 5869).
specificationArgon2id (RFC 9106).
specificationSQLCipher, AES-256 (FIPS 197).
specificationTor, via the arti implementation.
specificationQuestions
No. The first time you open the app it generates an identity and stores it encrypted on the device. Nothing is sent anywhere. There is no account to create.
The message stays on your phone and retries later. A queued state is not a failure — it means they are not reachable. There is no cloud inbox holding it in the meantime. With a LoRa node, texts go out over the radio: they take minutes, not seconds.
Each phone runs its own Tor onion service and speaks to the other one. PrivChat does not run a relay, a queue, or an account database. Tor relays pass sealed packets; they do not hold your conversations.
They can see that you connect to Tor. They cannot read the words. With cover traffic on — the default — packets of identical size go out whether you are writing or not, so they also cannot tell whether a conversation is happening.
Recorded ciphertext can be stored for years. If a future machine breaks today’s key exchange, those recordings open retroactively. Mixing X25519 with ML-KEM-768 means both have to fall. Signatures, envelopes and contact keys were brought along in 2.0–2.2, so the whole conversation stays closed.
Free, no ads, nothing collected to sell. Optional donations are Monero and Bitcoin Silent Payments, so a public chain does not become a list of people who support an encrypted messenger.
Mac, yes: PrivChat is on Android, Windows, Linux and Apple-silicon Macs. iPhone, not yet: it is in testing and coming soon. Both people need the app; it does not talk to WhatsApp, Signal, or SMS.
Get it
Free on Android, Windows and Linux. No account, no ads, no company to trust with the graph of your life.
Support it
These are the only two addresses. Check the fingerprint in the app against this page before you send anything: rebuilding a binary with a swapped address is the classic fraud. The same fingerprints are published as a signed statement.
45hRduLUQD5Ek4qGgHTuWAZnncwroMET1WsLUDC9AF6DNSt5qMP1Fk7WUsN4EwzJdA1ypfL7TtJQQ8uqutAJWwJy5jzp8Pa
fingerprint 1D63 68D5 7653 1887
sp1qqf2jvtz0k7rsy7f0cka9ejz6e4lmakz6v9zgae02ks0qpck3a6dxzqn73fp9gj6y632q8th2nfv2lv7rua49s5unzjpau3ahp29ssw689vwu9ksy
fingerprint 63BB FA03 F806 BC55
There is no ordinary Bitcoin address. On a public chain every donor would pay to the same place, visible forever: a list of people who support an encrypted messenger. Silent Payments derive a fresh destination per payment, so the chain does not assemble that list.
PGP BC8D E53F D8D1 6F63 AD8A 33EA 10EC 8069 37D6 8502 · donations.txt · public key