Peer-to-peer · post-quantum · nothing kept
onchato has no message store — not encrypted, not anywhere. Your key lives in your hardware module or sealed in your browser, the conversation goes straight between the two of you, and every handshake has been post-quantum since the first line of code.
Four claims, and what backs each one
Every session key is derived from X25519 and ML-KEM-768 together, so recording today's traffic to break later does not work — there is no classical-only path to attack. It costs almost nothing.
3.3 ms per full handshake, both sides
A message is sealed on your device and opened on theirs. Nothing is spooled, queued or archived on the way, which is why there is no store to subpoena, breach or quietly mine.
0.42 ms to seal and open a message
You are a key, not a row in a table. Nobody operates a lookup of who may talk to whom — you exchange keys directly and compare a fingerprint out loud, the one check an attacker in the middle cannot pass.
Identity in hardware (HEM) or sealed locally
Nodes exist to introduce two people and then get out of the way: the conversation upgrades to a direct channel, and what does pass a node is ciphertext on a room name derived from your two keys.
Direct WebRTC, relay only as fallback
And what a node can still observe — timing, addresses, that two parties met — is written down rather than glossed over. Read the threat models →
Get it
Open onchato in the browser — nothing to install, the same crypto. The packages below keep working if this domain ever disappears, update themselves, and every file ships with a minisign signature beside it.
xattr -cr /Applications/onchato.app
Your own infrastructure
Do not take our word for any of the above — run the network yourself. A node is a single Node.js process with no database, no queue and nothing to administer.
# any small Linux box, Node 22+ $ git clone https://github.com/encedo/encedo-chat $ cd encedo-chat/relay && npm ci $ node relay.mjs --pass "my-node" --port 9001