Only the two of you can read it
Your message is locked before it leaves your phone, and only your friend's phone has what it takes to open it. We just pass the sealed envelope along.
Private messaging
Simple, private messaging.
Messages are locked on your phone and can only be opened by the person you sent them to. No phone number, no ads, and nobody reading over your shoulder. We're also upfront about where the limits are.
No phone number
No ads, no trackers
Free and open source
Free to use, open to read, and yours to run on your own server
Free forever
No ads
No phone number
Open source
Yours to host
Features
What the app does for you.
In everyday terms, without the jargon. A little further down, the parts that deserve a longer explanation.
No phone number
You sign up with a username and an email, and people find you by the name they already call you. Your phone number stays out of it.
No ads, and nothing to sell
There are no ads, no trackers, and nothing watching which chats you open. With no advertiser in the picture, there's no reason to build a profile of you in the first place.
Messages that clean up after themselves
You can set a chat to delete itself after an hour, a day, or anything up to a month — handy if you'd rather old conversations didn't sit on a phone indefinitely.
Strangers ask first
A first message from someone you've never spoken to arrives as a request you can accept or ignore. And if you block someone, the server itself stops accepting their messages, rather than the app quietly hiding them.
If you lose a phone
Every device you sign in on has its own set of keys. Sign one out from another device and its messages and keys are removed along with it.
Keys you can check up on
Every key we hand out is written into a public list that can't be edited afterwards, and your app checks that list before it trusts a key. Apps also compare notes with one another, so if anyone were ever shown a different answer, it would come to light.
You can host it yourself
The whole server is a single command to start on a machine you control, and the apps can point at yours instead of ours.
Good to know
A few things worth knowing.
Every messenger has limits. These are ours, in plain terms, so that nothing about how this works comes as a surprise later on.
Encryption covers the message, not the fact you sent one
Our server has to know who to hand a message to, so it can see that you wrote to someone and roughly when. It cannot read a word of what you said. That is true of any messenger that delivers to people who are offline.
See exactly what's keptPlain mode is a trade-off worth knowing about
A chat can be set to store on the server instead, which is what makes search and previews work. Those messages can be read by whoever runs the server. The app always shows which mode a chat is in, so the choice stays with you.
How that's handledAn outside audit hasn't happened yet
The code is open and heavily tested, and the design is published so anyone can review it. A paid review by a security firm is a different kind of assurance, and it is one we would like to fund.
What an audit would cover
How it works
How your messages stay private.
You don't need any of this to use the app. But if you have ever wondered what "end-to-end encrypted" actually means, it comes down to three ideas.
-
1
Your phone makes a lock and a key
It hands out copies of the lock to anyone who wants to write to you. The key that opens them stays on your phone, and isn't shared with us or anyone else.
-
2
Your friend locks the message before sending
By the time it reaches our server it's already shut, and we don't have the key. Neither of you has to be online at the same time for this to work.
-
3
Every message gets a fresh lock
The locks change as the conversation goes along, so even if one were ever opened, it wouldn't help with the messages that came before it.
All three ideas have proper technical names, and if you would like the full version with the details filled in, it is all in the specification.
Get it
Get Flamenet Messenger
The apps are still being built. Here is where each one stands today.
There is no version that runs in a web browser, and that is a deliberate choice rather than something still on the list. A web page is delivered afresh by the server every time you open it, so how private it is depends on trusting whoever served it that day. An app you have installed doesn't work that way, which is why we went in that direction.
Run it on your own machine.
The server is two containers and a config file. There is nothing to sign up for and nothing that phones home, and it serves this very page — so a fresh install explains itself rather than greeting you with an error.
The server is where your account and any undelivered messages live. Running it yourself keeps all of that on hardware you control.
cp .env.example .env
# fill in the three secrets it asks for
docker compose up -d
Developers
Everything is written down.
This part is for anyone who would like the details. Everything the apps do is written down, and the two engines are tested against each other.
One document, start to finish
How the encryption works and how the server behaves are described in one document, so anyone who wants to write their own version has what they need.
Read the specificationTwo versions, checked against each other
The JavaScript and Swift engines are tested against each other and against published examples, so compatibility is something we measure rather than assume.
How they are testedOpen source, free to reuse
The encryption engine is public and freely licensed. Read it, reuse it, or let us know if you spot a mistake.
Source codeNothing here is home-made. The encryption is built from published, standard building blocks that other secure messengers use too, and the specification names every one of them and explains why it was chosen.
Running protocol version 3 · this server answers for messenger.flamenet.io
Community
Ways to look closer
Some of the most useful help we get isn't code — it's someone reading the design closely and telling us what they find.
FAQ
Common questions.
Can you read my messages?
For a normal encrypted chat, no — the server holds a sealed envelope and nothing that opens it. If you switch a chat to plain mode, which is what makes search and previews work, then whoever runs the server can read those messages. The app shows you which mode you are in, and if you run the server yourself, that is you.
So what does the server know about me?
That you have an account, who you write to, when, roughly how big the message was, and the internet address you connected from. It has to know where to send things. It doesn't know what any of it said. There's a page listing every last field rather than a paragraph summarising it.
How do I know I'm really talking to my friend?
There are two ways to check, and neither one depends on trusting us. Every key is published to a list that can't be rewritten afterwards, and your app won't accept a key that isn't in it, so any substitution would leave a permanent record. You can also compare a short safety number with your friend in person or over the phone — if the numbers match, there is nobody in between.
Do I need a phone number?
No. A username and an email address. People reach you by the name your friends already know you by, and your number never enters the picture.
What does it cost?
Nothing, and there is no paid tier waiting in the wings. There are no ads and nothing to sell either, so donations are what keep it going.
Can I really run it myself?
Yes, and we test it that way. It's a Docker Compose file with the server and its database; the apps can be pointed at your address instead of ours. The instructions fit on one page.
Has it been audited?
Not by an outside firm yet — that costs money we are still raising. The engine has a large test suite, the two implementations are checked against each other, and the design is published so anyone can review it. Those are all worth something, and they are a different thing from a professional review, so we keep the two clearly apart.
What if I lose my phone?
Sign that device out from another one you still have. Its keys and anything still waiting for it are removed together, so a phone that is no longer in your hands can't receive anything new.