A messenger where the promises are enforced by the cryptography
Encrypted is end-to-end encrypted messaging built on a Rust security core. Its distinguishing claim is not that it encrypts, which everything does, but that the things the interface promises are guaranteed by the maths rather than by the app choosing to behave.
01
Olm destroys a message key as it decrypts it. A message that has been read cannot be read again because the key to read it no longer exists, not because the app declines to show it, and a test that replays a message and expects a refusal keeps it that way.
02
Plaintext is padded into fixed buckets with random filler at the single point where it becomes ciphertext, so a compressing transport cannot squeeze it back out. A two-character message and a fifteen-character message both leave the device as exactly 257 bytes.
03
The sender is deliberately absent from the envelope table, so the server cannot answer the question "are you the sender?". The sender keeps a random secret on the device and the server holds only its hash: possessing the secret is the right to withdraw, and it works only while the mail is still uncollected.
04
Identity, sessions and any unread plaintext live in one encrypted device-only Keychain checkpoint. Sent plaintext is never written down at all. The server carries ciphertext it cannot read and routing it does not need to keep.
05
Group messaging runs on MLS through the same Rust core, so adding and removing a member is one cryptographic operation rather than a session with every other member, and the cost does not climb with the size of the room.
06
Emergency erase does what unsend does, for all of it at once: the envelopes still waiting on the server and the messages already delivered to the people you were talking to. It reaches what sits outside your own device, which is the part you cannot walk over and delete yourself. What it cannot reach, a screenshot somebody already took, it does not claim to. It is an Encrypted+ capability.
07
There is a subscription and it buys reach and conveniences, not protection. Encryption, reveal-once, one-time messages, the numeric view, verification and the privacy preset are free forever, because a safety feature behind a paywall is a safety feature most people do not have. Emergency erase is paid for because it acts on other people's devices, not because it guards yours.
Not a mock-up and not a concept. This is the product as it stands today, carrying real people and real money.
Runs on
iOS · Android
We can build and run one of these for you.
Start a project
