Šepot

Šepot is an end-to-end encrypted messenger for messages and calls that works without a phone number or e-mail address. Your account is a cryptographic key created on your phone; contacts are exchanged in person with a QR code or a link, so nobody can find you by your number and the app never uploads your address book.

Encryption is built on the open-source libsignal library: a post-quantum PQXDH handshake (Kyber-1024) followed by the Double Ratchet, with sealed sender so the server does not learn who sent a message. Local history is encrypted with SQLCipher and protected by a PIN (Argon2id).

Features: 1:1 and group chats (up to 128 members), photos, documents and voice messages, polls, disappearing messages, encrypted voice and video calls, PIN lock, identity recovery from a 24-word phrase, encrypted history backup, content-free push notifications (UnifiedPush on Android without Google services), optional Tor routing via Orbot.

The app (Flutter) and the relay server (Rust) are open source under AGPL-3.0 and the relay can be self-hosted. No ads, no tracking, free. Made in the Czech Republic; the relay runs in the EU. Šepot is an independent project and is not affiliated with Signal.