// secure.im · v1.0.0

Encrypted chat for security researchers & geeks

A decentralized, end-to-end encrypted messenger built on a custom onion-routed protocol.

potato@secure ~ %
$ potato --connect anon-node-eu-3 [ok] handshake x25519 | kyber-768 [ok] onion route: eu-3 → us-7 → jp-2 $ send --to 0xA1f... --encrypt double-ratchet [!] ephemeral keys rotated [ok] delivered in 184ms
// 01 — protocol

Encryption protocol

Post-quantum ready by design. Every message, call and file is double-encrypted and routed through ephemeral onion circuits.

X25519 + Kyber-768

Hybrid key exchange combining elliptic-curve and post-quantum KEM for forward secrecy.

Double Ratchet

Per-message keys derived from a continuously evolving ratchet — modeled after Signal.

Onion Routing

Three-hop circuits across volunteer relays. No single node knows sender, receiver or payload.

AEAD-ChaCha20

Authenticated encryption with associated data on every transport layer packet.

Ephemeral IDs

Short-lived identity keys. Long-term keys never leave the device unencrypted.

Sealed Sender

Even metadata is shielded — relays only know the next hop, never both ends.

// 02 — architecture

Technical architecture

A peer-to-peer mesh of relay nodes, reproducible builds and zero-trust defaults.

Transport
Custom binary protocol over QUIC with optional TCP fallback.
Topology
Fractal mesh — relays form a self-healing distributed hash table.
Storage
Client-side encrypted vault with optional stateless sync.
Identity
Decentralized; keys generated on-device, no phone number required.
Build
Reproducible. Signed binaries published for every release.
Audit
Third-party cryptographic audits every release cycle.
// 03 — security

Security capabilities

Hardened defaults. No telemetry. Open source from day one.

Zero telemetry

No analytics, no crash reports, no IP logging — by design and by code.

Disappearing messages

Per-conversation timers with hardware-bound secure deletion.

Screen security

Block screenshots in chat list and blur previews in the app switcher.

Pinned verification

Compare safety numbers via QR or spoken hash, in person or over a side channel.

Local-only backups

Optional encrypted exports to your own storage. Cloud sync is opt-in and end-to-end encrypted.

Open audit log

Every released binary is reproducible and diffable against the public source.

// 04 — clients

Download the client

Cross-platform builds, signed and reproducible. Pick yours.

Windows

x64 .msi

v1.0.0 · signed · reproducible

Download
macOS

universal .dmg

v1.0.0 · signed · reproducible

Download
Linux

.deb / .rpm / AppImage

v1.0.0 · signed · reproducible

Download
Mobile

Android & iOS

v1.0.0 · signed · reproducible

Download
// 05 — community

Developer community

Fork it, read it, ship your own node. We build in public.