Sovereign encrypted messaging · Windows / macOS / Linux
Encrypted messengers protect the content.
Crypto is built to protect the fact that the conversation exists, too.
The content of your messages is end-to-end encrypted: no one but your correspondents can read it. Crypto aims further with its own mix network, Gotham: fixed-size packets, random per-hop delays and cover traffic, to hide who talks to whom as well. That second protection grows stronger as independent relays join the network. It is not effective yet today.
Written in Rust · Open-source network (AGPLv3) · Self-hosted · No third-party service
The principle: an observer should see nothing but identical packets, at a constant rate.
Each relay knows only who handed it the packet and who it passes it to. Follow a message, inspect every node, and see what it is incapable of learning.
A mix network’s anonymity is not a checkbox: it grows with the number of independent relays in service. We measure it rather than promise it. Where things actually stand today: the relays in service cover only two distinct address ranges, where the diversity rule requires three. So the network does not route yet. Messages go through a mailbox instead, and the operator of that relay can see which IP addresses are exchanging; the app states this plainly, under the label “Mailbox only”. Content encryption, on the other hand, applies in every case. What the network protects, and what it does not, is documented in the threat model.
Why a mix network
The communication graph is often more sensitive than the content.
A spike in traffic between two engineering offices announces an acquisition or a programme before any press release. Encryption alone changes nothing: the metadata, meaning who writes to whom, when and how much, stays in the clear.
A classic encrypted messenger protects
- The content of messages and files
- The authenticity of correspondents
But its server, like any network observer, still sees who talks to whom, when, and at what volume.
What the Gotham network aims to cover as well
- The existence of the conversation: the very fact that two entities exchange
- The graph, who talks to whom: each relay peels off only one layer of the envelope, and the sender’s identity stays hidden from it
- Timing and rhythm: every hop holds the packet for a randomly drawn delay, and decoy traffic runs continuously
- Volume: every packet is exactly the same size, so message length cannot be read from outside
Proof, not promise
Every claim on this site is verifiable, in the code or in the audit.
Sovereign, down to the last server
Directory authority, relays, mailboxes and call servers (TURN) run on your infrastructure. Under full self-hosting, no data (message, metadata or log) ever transits through the vendor. Worth knowing: voice always goes through a call server, never through the mix network, and the operator of that server sees both IP addresses and the timings. Host it yourself, and that operator is you.
Auditable: the network code is open
Client and network are written in Rust. The Gotham network is published under the AGPLv3 free-software licence, which requires any modified version put into service to be published too. Your teams, or any auditor you choose, read what actually runs, no NDA required.
Built for environments where the exchange graph is classified.
CISOs, CIOs and security officers: defence, aerospace, critical-infrastructure operators. Short form, human reply.