Messages nobody
else can read.
Your messages are encrypted on your device before they are sent. We carry them and cannot read them.
Maya Chen
End to end encrypted
Our servers only hold the encrypted version.
A message is encrypted on your device and decrypted on theirs. In between, we store the encrypted version. We hold no key that opens it.
What you wrote
the flight lands at 6:40, terminal 2
What we store
8f2a41c7d9e0b35a6114fc820d7e93a15c4b6802ff31d95e7a08c264b19d3f7e…
There is no readable copy.
Search
Maya Chen
the flight lands at 6:40, terminal 2
Devon Park
here is the lease pdf
Lia Moreno
shared a link
Searched on this device.
Search across every chat.
Words, links, files and voice notes. The index is built on the device that can already read your messages, so nothing is uploaded to search it. If this device has no key for a message, the app counts those messages in the results.
Encrypted by default
Every message is encrypted on your device before it is sent. It applies to every chat and cannot be turned off.
Search on the device
Search every word, link and file you have been sent. The index is built on your device and your query never leaves it.
Nothing to install
It runs in a browser and adds to your home screen. It uses the Surf account you already have.
Check who you are talking to.
Every chat carries a number derived from both sides' keys. Read it out together, and if it matches, no third party is in the middle. If someone's keys change, the app says which device changed and how.
Read the protocolSafety number
Read it aloud together. If both sides match, nothing is in the middle.
What encryption does not cover.
Three limits on the claim above.
- Groups over 256 people
- The group scheme covers 256 members. A larger group is not end to end encrypted, and the app says so in the group itself.
- Messages sent before we shipped it
- A small number of early messages predate encryption and were stored readable. Everything sent since is encrypted.
- The person you are writing to
- Encryption protects a message in transit and at rest. It cannot stop someone in the conversation from taking a screenshot.
Paid for by donations.
Donations pay for the servers that carry encrypted messages, and for the relay that carries a call when a direct connection will not form. There is no advertising and no tracking.
Donate- What it costs
- Nothing
- Advertising
- None, on any account
- Tracking
- None
- What we store
- Encrypted messages and delivery routing