Free & encrypted messaging · Windows / macOS / Linux
When no one can read,
freedom can be written.
Your messages are encrypted on your own device. Only the person you write to can read them: not us, not your internet provider, not the server that carries them. Crypto is also building Gotham, a network meant to hide who talks to whom. That network is not running yet: today, the server that carries your messages can still see the IP addresses involved.
Free · Network code is public (AGPLv3) · Written in Rust · No usage statistics collected
How Gotham aims to make a message impossible to follow.
The principle: every packet is exactly the same size and travels at a steady rate, so they all look alike. Each relay knows only who handed it a packet and who it passes that packet to. Follow a message through the diagram, then inspect each step: you will see what it learns, and above all what it never learns.
This diagram describes the goal of the network, not today's reality. That protection is not a checkbox: it depends on the number of independent relays in service, and there are not enough yet. The existing relays sit in only two address ranges, while the rule requires three before messages can start hopping from relay to relay. Until then they pass through a mailbox, whose operator can see which IP addresses exchange traffic. What the network protects, and what it does not protect yet, is documented in the threat model.
Who it is for
Built for people who are watched through their contacts, not their words.
Knowing who talks to whom, when and how often is often enough to break a secret, without reading a single message. That is what the Gotham network is built to prevent. That part is still being built, as explained above; content encryption, on the other hand, works today.
Newsrooms & journalists
Source protection does not stop at content. The mere fact that a source talks to you is already information. That content is protected today; erasing the trace of the exchange itself is the goal of the network, and that goal is not reached yet.
Lawyers & defence counsel
Professional secrecy also covers your clients' names. Our servers do not know them: each inbox carries an identifier that says nothing about its owner, and a message does not say who sent it. While the network is not carrying traffic yet, the operator can still see the IP addresses that connect to it.
NGOs & exposed networks
Against an adversary who watches the network, the map of human relationships is the first target. Crypto defends it in layers: content is encrypted today, the network meant to hide the links between people is still being built, and all the code is public so anyone can check it.
Download
Free, no account with us, no telemetry.
The Gotham network that carries your messages is free software: its code is public, and anyone may read it, verify it, host it or change it (AGPLv3 licence). That is the part an outsider needs to be able to check, because that is the part that sees the traffic. The application itself is not published: its source stays proprietary. We would rather say so than let you believe everything is open.
The macOS and Windows builds are not signed yet, so your system will show a warning the first time you open the app. Once it is installed, check your safety number with the other person over a different channel, in person or by voice. If their key ever changes, the app tells you; that change is never silent.
The Gotham network
Protection grows with the number of relays. Host one.
A network like this cannot be declared safe: its protection strengthens with every independent relay that joins. There are still too few for messages to start hopping from relay to relay. By hosting yours, you widen the crowd every message disappears into, for you and for everyone else.
Without opening a single port
At home, a consumer router or a 4G/5G link normally stops a server from being reachable from outside. Crypto works around that: your relay connects to the network itself, with no router settings and no fixed address. This is what makes a volunteer network actually deployable.
Nobody controls the list
To enter the list of usable relays, yours has to be vouched for by several independent checkers, not by us alone. Its registration is signed from end to end, so nobody can rewrite its address along the way. The mechanism is in the code; it will only have real effect once several checkers are genuinely run by separate teams.
Your relay sees nothing useful
A relay carries packets that all look identical: no content, no correspondents, no idea where it sits in the path. It knows only the previous step and the next one. Hosting a relay does not turn you into a listening post. One caveat while the network is not carrying traffic yet: a server acting as a mailbox does see the IP addresses that connect to it.
Verify, don't trust
You don't have to trust us. That is the point.
The code is the reference
The app and the network are written in Rust, and the Gotham network code is published under a free licence. This site is only a summary. What matters is read, compiled and verified in the repository.
An audit that contradicts itself
72 findings examined, 30 dismissed after counter-analysis, 42 confirmed, 30 fixed so far. Every fix replays the attack as a test, on every build, so it cannot come back unnoticed.
The limits are published
What Crypto does not protect is written in black and white: a device that is already compromised, a correspondent who repeats what you tell them, an adversary controlling most of the relays, and, today, a network still too small to hide who talks to whom.