Three Stops. Two Are Encrypted.
Your device encrypts before sending. Our servers carry ciphertext. The recipient decrypts on theirs. Plaintext lives nowhere in between.
Your Device
Message written. Encrypted on-device with recipient's public key.
SSS Servers
We store and route opaque blobs. No plaintext. No keys. Nothing to read.
Their Device
Recipient decrypts with their private key — never shared, never uploaded.
Messaging That Just Feels Normal
Group chats, voice notes, file sharing, reactions. All the things you expect — with end-to-end encryption underneath every byte.
What We Will Not Do, Ever
Privacy is what we refuse to compromise on — not a feature we charge extra for.
We Will Not Read Your Messages
Mathematically cannot. The server stores only ciphertext, and the keys are on your device.
We Will Not Require Your Phone
Sign up with a key pair generated on-device. No SMS verification. No identity to harvest.
We Will Not Sell Anything About You
No advertising. No profiling. No data brokerage. The business model does not depend on it.
We Will Not Build Backdoors
Backdoors are vulnerabilities. We do not weaken our own encryption for anyone — agencies included.
Signal pioneered sealed sender for text messages. SSS extends it across the whole stack: messages, attachment uploads, voice-call signalling, emoji reactions, every copy of a group message, and even the first-contact key exchange all flow through an identity-blind delivery endpoint. The server sees an opaque envelope addressed to a recipient and nothing else — no sender username, no caller, no group record, no phone number.
There is no account to create beyond a username. Login is an Ed25519 challenge-response, so there is no password to phish. Messages ride the Signal Double Ratchet (Olm) and are wrapped in a hybrid X-Wing KEM — X25519 combined with ML-KEM-768 — so ciphertext captured today survives a future quantum computer. Groups are a client-side construct: a message to thirty people is thirty ordinary sealed messages on pairwise ratchets, which means there is no group table, no group id, and no shared key to go stale when someone is removed.
On the device, a Fortress PIN wraps your keys, sessions and plaintext in a three-layer vault — Argon2id, then a non-extractable device key, then Argon2id again — at roughly half a second per guess, with a server-held key fragment that rate-limits online attempts. Auto-lock, biometric quick-unlock, screenshot masking and a one-tap panic wipe sit on top of it.
Phishing is handled as a chain rather than an event: there is no linked-device feature to abuse, no phone number to SIM-swap, a canonical hostname lock that refuses to boot on a typo-squat, origin-bound passkeys, and TOFU key pinning that pauses sending when a verified contact's key changes. The build is reproducible and publishes per-asset hashes so you can check the code you are running is the code in the repository — and the project documents what it does not protect against just as plainly.
Key Features
Sealed Sender, Everywhere
Every write from the sender's side — text, attachments, call signalling, reactions, even the first key exchange — goes through an identity-blind endpoint. The server never sees or logs a sender.
Groups the Server Cannot See
No group table, no group endpoint, no group id. A message to N members is N sealed messages on N pairwise ratchets, indistinguishable from N direct messages, capped at 32 members.
No Phone Number, No Email
Pick a username and start. No phone number to SIM-swap, no email, no payment details — and login is an Ed25519 challenge-response, so there is no password to phish.
Fortress Lock
A PIN wraps your keys and plaintext in three layers — Argon2id, a non-extractable device key, Argon2id again — at ~0.5s per guess, with auto-lock, biometric unlock and a one-tap panic wipe.
Post-Quantum Encryption
Every sealed message is wrapped in a hybrid X-Wing KEM, X25519 combined with ML-KEM-768, so traffic harvested today is not readable by a future quantum computer.
Sealed Voice Calls
Offers, answers and every ICE candidate ride the sealed channel, so there is no caller column to query. Audio flows peer-to-peer over DTLS-SRTP and never touches the backend.
Anti-Phishing by Design
No linked-device feature to abuse, a canonical hostname lock that refuses to boot on a look-alike domain, origin-bound passkeys, and TOFU pinning that pauses sending on a verified contact's key change.
Verifiable Builds
Every release publishes per-asset SHA-256 and SHA-384 hashes. Rebuild the same commit and they match byte for byte, so you can check the running code without taking anyone's word for it.
No Ads, No Tracking, Self-Hostable
No analytics SDK, no ad SDK, no CDN-hosted scripts — one self-hosted bundle. Run your own instance: a static PWA front end and a Node backend on Postgres and Redis.