Sign up with
nothing.
No phone number. No email. No name. Cipher is a messenger that never asks who you are — because it was built so it doesn't need to know.
What we can — and can't — see
Every "private" app says "we can't read your messages." Almost none tell you what they can see. Here's the whole truth, both columns.
🔒 Never leaves your device
- ✓Your messages, calls & filesEnd-to-end encrypted. The server only ever holds ciphertext it has no key for.
- ✓Who you talk toYour contact list is built and stored on your phone, not on our servers.
- ✓Your identityNo phone, email, or name is ever collected — there's no account to leak.
⚠️ What any server unavoidably sees
- •That a device connectedTo deliver a message, the relay sees a connection — like any messenger. We're working to minimise even this.
- •Encrypted blobs it can't openYour messages pass through as sealed bytes. We store them only until your device picks them up.
- •A random routing addressA random-looking address derived on your device — it routes messages to you, but isn't your name, number, IP, or device fingerprint.
If a privacy app won't show you the right-hand column, ask why.
Privacy by construction, not by promise
You hold the keys
Your identity is a 24-word recovery phrase, generated on your device — the only key to your account (like a crypto wallet). No password on our servers to steal, because there's no account.
End-to-end by default
Every message, file, and Cipher-to-Cipher call is end-to-end encrypted on your device. Cipher implements the Signal Protocol design (X3DH + Double Ratchet) — our own independent implementation over libsodium. Pre-audit. On by default, no setting to forget.
A relay that can't read
Our server is a dumb mailbox: it forwards sealed ciphertext and forgets it. A breach of our servers reveals undecryptable bytes — nothing more.
We're in alpha, and we won't pretend otherwise
We haven't completed a third-party audit of our implementation yet — and we'll publish the full results publicly when we do. The protocol design we follow (X3DH + Double Ratchet) is independently audited and proven in production for over a decade; our implementation of it is not audited yet. So we don't use the word "audited," and you shouldn't trust anyone who does before the report exists. Trust should be earned with receipts, not slogans — install the alpha and hold us to it.
Get Cipher. Right now.
The alpha is open on both platforms — no account, no invite, no phone number.