Peer-to-peer · post-quantum · nothing kept
Closer to a whisper than to a letter. A letter is stored, copied and filed on its way; a whisper goes straight between two people who are both there — and passes through nobody. onchato has no message store — not encrypted, not anywhere. Your key lives in your hardware module or sealed in your browser, and every handshake has been post-quantum since the first line of code.
Eight claims, and what backs each one
Every session key is derived from X25519 and ML-KEM-768 together, so recording today's traffic to break later does not work — there is no classical-only path to attack. It costs almost nothing.
3.3 ms per full handshake, both sides
A message is sealed on your device and opened on theirs. Nothing is spooled, queued or archived on the way, which is why there is no store to subpoena, breach or quietly mine.
0.42 ms to seal and open a message
There is no queue and no mailbox — a conversation happens while both people are in it, the way a spoken one does. That is not a missing feature: it is what removes the server that would otherwise hold your messages until you log in, and with it every reason such a server could be asked for them.
no store-and-forward, by construction
You are a key, not a row in a table. Nobody operates a lookup of who may talk to whom — you exchange keys directly and compare a fingerprint out loud, the one check an attacker in the middle cannot pass.
Identity in hardware (HEM) or sealed locally
A node introduces two people and carries what they say as ciphertext, on a room name derived from their two keys. By default it carries the whole conversation, so your contact never learns your address; a direct WebRTC channel, which leaves the node out entirely, is one switch away in Settings.
relay by default · direct WebRTC opt-in
A group here is not a room on somebody's machine — it is a key its members hold between them. Adding or removing somebody re-keys the whole group, so a person you removed cannot read what comes next, and there is no operator who could quietly add themselves to the list.
up to 10 members · the roster fits in 128 bytes
Hang one link wherever you like — a page, a profile, a business card. Whoever has it can knock, and you see a fingerprint and a sentence before you decide; nothing joins your contacts until you say so. Every knock is the same size, and your own app publishes decoys among them, so watching the channel does not tell anybody that somebody real got in touch.
348 bytes per knock — real or cover, identical
A file is encrypted on your device before it leaves. By default it crosses our store sealed — the store never has the key — and is swept after about five minutes. With the direct channel on, it goes from one device to the other and touches nothing in between, and the other side is asked before a byte moves.
stored sealed, gone in ~5 min · direct: 500 MB at 41 MB/s on a LAN
Every claim above rests on a mechanism, and the mechanisms are written for a reader rather than for an auditor. The mechanisms underneath, in seven steps → And what a node can still observe — timing, addresses, that two parties met — is written down rather than glossed over: the threat models, the protocol.
Get it
Open onchato in the browser — nothing to install, the same crypto. The packages below keep working if this domain ever disappears, update themselves, and every file ships with a minisign signature beside it.
xattr -cr /Applications/onchato.app
Your own infrastructure
Do not take our word for any of the above — run the network yourself. A node is a single Node.js process with no database, no queue and nothing to administer. The three lines below give a node on plain WebSocket, enough to try it; the apps connect over TLS, so a node for real use gets nginx and a certificate in front — relay/DEPLOY.md walks through it, firewall included.
# any small Linux box, Node 22+ $ git clone https://github.com/encedo/encedo-chat $ cd encedo-chat/relay && npm ci $ node relay.mjs --pass "my-node" --port 9001 --bind 0.0.0.0
Found a security issue?
The whole point of this project is that a stranger cannot read your messages, so a hole in that is the thing we most want to hear about. Write to security@rkv.pl with the version or commit you were on, what you found, and how to reproduce it. We answer within five working days and keep you posted until it is fixed.
The full policy and scope are in SECURITY.md, and the machine-readable contact is at /.well-known/security.txt (RFC 9116). The code is MIT and every release is reproducible from its tag, so you can check a claim against the bytes rather than against our word — where to start.