Everything we encrypt with, named.
“End-to-end encrypted” is a claim about ingredients. Here is the full list: the vetted, published cryptography we did not invent, and the smaller set of glue we wrote ourselves — with the honest gaps called out at the bottom.
A thin layer of ours, on a deep stack of theirs.
Before the names: this is how much of the stack we actually wrote. One band — and it is coordination code, not new cryptography.
- StandardVoiid app — chats, calls, the map. Holds no crypto of its own.
- Ourse2e-core — one Rust crate: key lifecycle, multi-device fan-out, safety numbers, the media envelope, call-key derivation. This band is the entire custom surface.
- Standardvodozemac · OpenMLS — the ratchet and the group protocol. Published specs, outside implementations.
- StandardX-Wing · AES-256-GCM · HKDF · Argon2id — the primitives themselves. Standardised, and none of them ours.
Every band except one is a published standard with an outside implementation. The tinted band is the whole of what we wrote, and even there the job is plumbing — deciding which key seals which envelope for which device, not inventing a cipher.
Vetted primitives we build on.
Cryptography you write yourself is cryptography you got wrong. Every row below is a published, publicly reviewed specification with a maintained implementation — pinned by exact name and version in our source tree, and named here so you can go and read the spec rather than take our word.
| Primitive | Used for | Specification | What it does |
|---|---|---|---|
| vodozemac | One-to-one messages | Matrix.org · Apache-2.0 | The Signal-style Double Ratchet implementation maintained by the Matrix.org foundation. Every direct chat advances through it. We evaluated libsignal and chose this instead, deliberately. |
| OpenMLS | Group messages | RFC 9420 | Message Layer Security exactly as specified by the IETF standard for encrypted groups. Group membership changes re-derive the group key without any server involvement. |
| X-Wing · ML-KEM-768 | Post-quantum groups | FIPS 203 | Group keys are hybrid-wrapped with X25519 and ML-KEM-768 together, so a future quantum computer that records today’s group traffic still cannot open it later. |
| AES-256-GCM | Media and attachments | NIST SP 800-38D | Photos, video and files are sealed per file; the file key travels inside the encrypted message itself. |
| Argon2id + BIP39 | Account recovery | RFC 9106 · BIP-39 | Your recovery phrase is a BIP39 word sequence; your PIN is stretched with Argon2id before it wraps anything. Both are standards, not our own schemes. |
| HKDF | Call keys | RFC 5869 | The keys your calls are encrypted with are derived from the same session material as your messages — never transmitted anywhere. |
Scroll the table sideways to see every column.
What we wrote ourselves — all of it in one place.
The custom part is deliberately small and deliberately centralised: a single Rust core (packages/e2e-core) compiled once and bound into every platform, so there is exactly one implementation to read and to test. No crypto lives in the app code, the API, or the database.
Key lifecycle
Device identity keys, published prekey bundles, and fallback keys that rotate on a schedule and are forgotten once replaced.
Multi-device fan-out
One message, sealed separately for each of your devices and each recipient’s — the coordination layer around the ratchet is ours.
Safety numbers
The fingerprint you can compare out loud to verify a contact, built from an iterated hash of both identity keys.
Media envelope
How an encrypted file, its key envelope and its ciphertext reference fit together without the server learning either.
Call key derivation
Mapping message-session secrets onto the keys a call actually uses, so calls and chats share one root of trust.
Relay enforcement
Our own server refuses to relay anything not shaped like opaque ciphertext — the plumbing physically cannot carry plaintext.
What we have not done yet.
Every page like this one is a sales page unless it also says where the gaps are. These are ours, stated before anyone has to find them.
- No independent audit yet. The core carries 93 tests, fuzz targets and weekly dependency audits — which is not the same thing as a third-party cryptographic review. That review happens before we call this production-grade.
- Post-quantum is groups-only for now. A PQ handshake for one-to-one chats is written and tested, and switched off until it passes external review. Off is a decision, not an accident.
- Metadata is not encrypted. Who talks to whom, and when — the same limits described on the privacy page. No scheme here changes that.
Check us rather than trust us.
The core, its threat model, its known limitations and its test posture are all written down. When the repository opens, every claim on this page will point at code you can read yourself.