Locked on one phone,
opened on another.

Ciphertext is all our server holds

Posts, replies, photos, videos and link previews are locked before they reach our server.

An envelope for each reader

The key to a post goes into a separate envelope for each reader, and only that reader’s phone can open it.

A new key for every post

Every post and every reply gets its own key. The key to one won’t open another.

Your phone decides who receives it

Your phone seals each post for the Fam list it keeps itself. Only people who accepted a request or connected by QR code or Fam link get on that list. A Fam link you send works once within 24 hours, and the first person who opens it becomes your Fam without you confirming. Sending the link is your consent.

Posts are locked with XChaCha20-Poly1305. Each envelope is sealed with X25519 and carried inside the pair’s secret, which is shared with X25519 and ML-KEM-768 together.

A secret only two phones share

When two people become Fam, their phones share a secret our server never sees. Everything between them finds its way with it.

Mailboxes, not accounts

Posts, chats and cards go into mailboxes that aren’t tied to any account, and mailbox numbers change every 30 days.

The sender is inside the seal

Who sent each item is sealed inside it with a signature, and the receiving phone checks that signature.

Invitations kept off the record

Members receive invitations our server issues without seeing them. When someone joins, our server checks only that the invitation is genuine. Its stored records don’t say who brought whom in, though connection logs and live requests can show it.

Pair secrets are sealed with X25519 and ML-KEM-768 together, mailbox keys are derived with HKDF-SHA256, and senders sign with Ed25519.

Words only on your paper

We show the 18 words once, when you make them, and ask you back for some of them. You can make them when you join or later in Settings. The words aren’t kept on our server, in any cloud or on your phone, and we never show them again.

Both the words and your PIN

Neither the words nor the PIN opens it alone. The PIN locks after a few wrong tries, and our server finds your account by a hash of a one-way value made from the words, never the words themselves.

Time to stop it

Recovery completes after a 48-hour wait. In the meantime, your old phone sees the request and can cancel it.

What our server holds isn’t enough

The secret that opens your backup comes in two halves: one on our server, the other in the words on your paper. Even taking our whole server won’t open it without the words.

The words are 18 BIP39 standard words, 192 bits. Even a quantum computer would need 2⁹⁶ guesses. The two halves are combined with HKDF to open the backup.

Only your Fam can call

A call rings, sealed, through the mailbox only the two of you share. Our server doesn’t record who calls whom.

Only the receiving phone knows who’s calling

The receiving phone unseals who’s calling and shows it on the ring screen. Our server doesn’t know the caller’s name.

A relay that hides your IP address

Calls usually connect through a relay. The relay sees both phones’ IP addresses but can’t open the encrypted audio, and the person you call doesn’t see your IP address. If a phone can’t get the relay details, the two phones connect directly, and then each can see the other’s IP address.

Signed by both phones

Each phone signs the connection details with its own key. If anything is swapped in the middle, the call doesn’t connect.

Connection details are signed with each person’s Ed25519 account key.

App lock

Lock Krypton Ø with your phone’s face or fingerprint unlock, or its passcode. It can lock right away, or after you’ve been away for 1, 15 or 60 minutes. While it’s on, the app switcher shows nothing inside. The setting stays on your phone; our server doesn’t know whether you use it.

Who sees your card

Your card is sealed. Choose Fam only or Everyone. Either way, your full photo goes only to your Fam. Narrow it any time and your phone seals the card again with a new key.

No screenshots

The screens you view in Krypton Ø can’t be captured or recorded.

Posts that disappear

Make a post disappear, and 24 hours after it appears the post, its chat and its photos are gone.

Both have to be broken

The secrets from both are combined into one before sealing. If a weakness turns up in one, the other still holds. It’s the same hybrid approach Signal and iMessage chose.

Every outer layer, sealed with both

Every outer layer that hands over keys is sealed with both: Fam requests and the notes that set up each pair’s shared secret, sealed backups, recovery, invitation bundles and reports. Posts and chats inside pair mailboxes are wrapped with the pair’s 256-bit secret, shared this way.

Public keys that can’t be swapped

The post-quantum public key is bound to your account signature too. If our server or anyone in between swaps in another key, the signature fails and the phone rejects it.

Content locks stay strong

The 256-bit XChaCha20-Poly1305 that locks posts and photos, and SHA-256, keep enough strength against quantum computers that they don’t need to change.

The outer layer is sealed with X25519 and ML-KEM-768 (US NIST standard FIPS 203) together, and the two secrets are combined with SHA3-256.

Keys made on the owner’s phone

The security core writes the bot’s keys straight into a key file. The owner exports it, and the phone’s copy is deleted. Our server holds only the bot’s public keys, and the file doesn’t contain the owner’s own keys.

Our server doesn’t know whose bot it is

A bot is made without signing in, using an anonymous KryptonØ+ ticket, and the key that manages it isn’t linked to the owner’s account key. Our server knows how many bots there are, their public keys, when each was made and how many messages each posts a day. The app picks up the ticket ahead of time so our server can’t match it to the new bot by time, though the very first time it still can.

Only in the owner’s chats, labeled

A bot joins only group chats its owner is in, after the owner confirms once, and phones drop a bot that anyone else adds. A “Bot” label appears wherever its name does, and you can’t call a bot or send it a Fam request. When the owner leaves, the bot leaves too. A bot’s posts carry its own session so the daily limit can be counted. Our server can see which chat tag (a random number) a bot posts to, but not who owns the bot or what it says.

The owner can read those chats

Whoever runs a bot holds the secret of each chat it’s in, just like anyone in that chat. Our bot runner doesn’t fetch messages, but a modified one could read them. That’s why a bot joins only chats its owner is in, and wears a label so everyone knows it’s there.

A bot has the same kinds of keys as a member: Ed25519 and ML-DSA-65 for its identity, X25519 and ML-KEM-768 for sealing. Each bot carries a certificate its owner signs with their Ed25519 account key, and on our server its posts look like any other.

Developer guide: run a bot and connect your code