You do not have to take our word for any of it.
Everything below is built so you don't have to trust a promise, ours included. Each part starts with what it does for you and then names the technology, so you can look it up yourself.
Protocol
Hybrid post-quantum key agreement
When a conversation starts, the two phones have to agree on a secret key. Aphotic does that twice, with two unrelated kinds of maths, and combines the results; an attacker would have to break both. The first is the standard the internet runs on today. The second is built to resist quantum computers, so recording your traffic now and waiting twenty years for better hardware gets nobody anywhere.
In case you want to look them up: PQXDH, which combines X25519 with ML-KEM-1024, the top strength of the post-quantum standard NIST settled on.
All of it happens on your phone. The server performs none of these steps for you and never sees a private key.
- The messages themselves are encrypted with AES-256-GCM
- Private keys never leave the phone. Even the app's own interface layer cannot reach them
Protocol
Forward secrecy that heals itself
Every message gets its own key, thrown away immediately after use. The keys keep stepping forward as you talk, so somebody who seizes your phone today still cannot read what you said yesterday. The conversation also repairs itself: a few messages later the attacker is shut out of what comes next as well.
The stepping-forward part is the well-known Double Ratchet. On top of it, Aphotic mixes a quantum-resistant secret in at every step, and that secret keeps the repair holding against a quantum computer too. We call the combination a Triple Ratchet.
- One key per message, used once, then destroyed
- Messages that turn up late or out of order still work, and nothing is weakened to allow it
Identity
Keys you can verify, changes you will notice
The classic attack on any messenger is the server secretly handing you the wrong key so it can read along in the middle. Aphotic makes that swap show: every identity signs its own keys, so a swapped key comes with a signature that doesn't add up. The first time you talk to somebody, the app remembers their identity, and if it ever changes, you get a warning before you carry on.
For the strongest check, read your safety numbers to each other on a phone call or in person. They cover the key exchange from start to finish, so if the numbers match, nobody is sitting in the middle.
On your device
A vault built for coercion as well as theft
Everything the app stores sits in an encrypted vault. The key to it is a long random number and is never made from your PIN. It's locked first by your PIN and then again by a key held in the phone's security chip, which physically cannot be copied out. A stolen copy of the vault file is useless anywhere else, because there is nothing in it to guess at.
Unlocking takes a PIN and nothing else, since someone else can hold your finger or your face to the phone, and a number in your head is far harder to take. Five wrong tries erase the vault. A second PIN wipes everything instantly and looks exactly like a normal unlock.
- An optional master passphrase adds a layer that taking the chip apart doesn't shortcut, because each guess at it is built to be slow and memory-hungry
- The vault locks itself on a timer, and whenever the app goes into the background
On your device
What the app does about the device itself
Screenshots and screen recording are blocked by Android itself, the vault refuses to be swept into any Android backup, and the code is scrambled to make it hard to read. A watchdog inside the app looks for the tools people use to pry a running program open, and for a copy of Aphotic that wasn't signed by us.
What it looks for, and what it does when it finds something, is the one part of this page we keep to ourselves.
Network
Tor is always on
The chat server has no ordinary web address. It exists only inside Tor, and Tor comes built into the app, so there's nothing extra to install. Your traffic bounces through roughly six machines run by different people, which is why the server never learns your IP address and you never learn where the server is. The server also runs the usual defences against being tracked down or flooded at its entrance.
Then we go after what's left over. Messages are padded out to a few fixed sizes, so their length gives nothing away, and direct messages carry no sender. The queue forgets everything after 7 days, and the schema has no column for when you signed up or when you were last online.
Timing we leave to Tor. It is the only layer that can do anything about it, and a delay inside the app would make Aphotic slower without helping. The real attacks on Tor over the years are written up on their own page, linked in the footer.
- Google and Apple push stays off: asking their push service to wake the app would tell them where the server is and when you use it. Notifications still arrive, raised by the app's own background process over Tor
- Replies from the server carry no identifying headers and no version banner to pick the software out by
Location
Where the servers are
The chat server and the payment node that checks Bitcoin and Monero payments run on separate machines of our own, in data centres in the EU.
This website runs on a separate machine in a locked-down German data centre, with checks on the door and German privacy law over it. It is the only part of Aphotic with a normal web address, because a shop has to be findable. Its job is selling licenses and handing out the app; messages never reach it.
Pay with Monero or Bitcoin and none of these machines holds your name, your email address or your IP address. The chat server physically cannot log your IP address: Tor ends the connection before it, so the address never reaches the server or us. This website keeps no visitor log at all. The transparency page lists, item by item, what anyone seizing one of these boxes would walk away with.
Payment
Paying with crypto is anonymous
You buy a license with Monero or Bitcoin. The shop then signs a token for you without being able to see it, a bit like signing across a sealed envelope: the signature is valid, but the shop has no idea which token it just approved. Your app hands that token to the chat server, which checks the signature and lets you in without learning which license it came from. Nothing anywhere links who paid to who chats, because neither database has a field to hold that link.
Why these features do not exist
Each one is a security decision, with its reason written out.
Messages take seconds
The wait comes from the six machines your traffic bounces through, the same hops that hide both ends. Tapping send never holds you up, though, because delivery happens in the background.
One device, one identity
Your private keys never exist in two places, so there is no sync service for anyone to attack or demand access to. Moving to a new phone is a deliberate encrypted handover.
Small groups stay pairwise
Everyday groups stop at 20 people and each message is encrypted separately for every member, so there is no group key on the server that we could be forced to use. Communities go up to 5,000 and switch to a shared key the members work out among themselves, redone every time somebody joins or leaves, and the server never sees that key either.
No calls
A live call is a steady stream of packets at both ends at the same moment, and that pattern lets a watcher match two people up. A voice message carries the same encryption without the giveaway.
Android-first
Aphotic runs on Android alone, so built-in Tor, the hardware-backed vault and background delivery get done properly on one platform.
Don't take our word for the cryptography either
Every building block Aphotic uses is public and has a name. Each one is linked below.