whispr
how it works get told

How it works.

The front page makes claims. This one is where you check them. Everything below is the design as specified and implemented so far, and the pre-alpha caveat still stands: the desktop client is unfinished and none of this is verifiable from outside until the repositories open.

What a relay carries

It routes what it cannot read.

Every message travels sealed. The envelope a relay handles carries a routing token, a padded length and a timestamp, which is enough to deliver it and no more. Who sent it, what it says, and which conversation it belongs to all sit inside the encryption boundary.

A relay does still see the address you connect from, and when. Nothing in the design hides that from the machine you are connected to.

the envelope a relay handles

delivery_token
b7f2 8e10 44a9 9c41
padded size
4 KiB
timestamp
2026-08-14T09:21Z

ciphertext · sealed to the recipient

  • who sent it
  • what it says
  • which group it belongs to

Two kinds of server

You pick which one you are trading away.

A private server is a real cryptographic group: forward secret, and removing someone genuinely locks them out. A public server gives both of those up to reach the size a community actually wants.

private MLS. Forward secret.
  • Members authorize their own joins, so nobody has to be online.
  • Removal is cryptographic: the key changes, the door closes.
  • A stolen key stops working, and does not open what came before.
  • Bounded at roughly one to two thousand members.
public A key that rides in the link.
  • The key sits in the invite fragment and is never sent to a server.
  • Joins always work, and history opens all the way back.
  • No forward secrecy. Bans are moderation, not cryptography.

Post-quantum without the tax

A full post-quantum commit every fiftieth one.

Post-quantum MLS on its own is heavy: a commit runs to roughly twelve kilobytes where a classical one is under five hundred bytes. APQ-MLS runs a post-quantum session and a fast one side by side, and every fiftieth commit folds post-quantum entropy out of the first and into the second. The group keeps post-quantum security and close to classical traffic sizes.

The cadence and those sizes come from the MLS combiner draft this is built on, not from our own benchmarks. The first builds run plain post-quantum MLS behind the same interface while the combiner lands.

partial commit full commit, post-quantum entropy folded in

one full commit every fiftieth

Nobody's network

There is no company at the center of this.

Relays are clustered, and clusters route to each other over a DHT rather than through anyone's headquarters. Run your own and you are in the mesh on the same terms as everybody else. It also means a compromise stops where it started: break one cluster and you get that cluster, not the network. Self-host, and the blast radius is you.

Identity servers are separate from all of this, and deliberately do not federate. A client can point at whichever one it trusts to answer the question of which username is which key.

each one a cluster, routing to the others over a DHT

And when the default is not enough, there are dials. All of them are off unless you turn them on, because each one costs bandwidth or latency.

Tor Relays and identity servers are reachable as hidden services, or point the client at any SOCKS5 proxy.
Maybenot DAITA-style traffic shaping, so the pattern of your traffic stops being a signature.
Message padding Rounds messages into size buckets before they leave, so length says less.
Cover queries Asks the identity server about people you were not looking for.

The short version

Nothing to verify There is no phone number, no email and no document on file, so there is nothing an age check could attach to.
APQ-MLS ML-KEM-768 and ML-DSA-65 in a post-quantum session, combined into a fast one. Post-quantum security at close to classical message sizes.
Sealed sender The outer envelope names no sender, and in privacy mode padding rounds messages into size buckets.
The host is not a member Server content is encrypted to the people in it. Running the infrastructure does not come with the ability to read it.
Licensed AGPL-3.0 Copyleft, so anyone who runs a modified relay owes its source to the people using it.
Not in the first version No voice or video, no web client, no bot API, no federation between identity servers.

Still nothing to install.

If you want to know when that changes, leave an address on the front page.

Tell me when there's a build