Secure Messenger
Messages only the two of you can read.
No phone number, no email, no account. You add someone by scanning their code in person, and every message is sealed on your phone before it’s sent.
Try it: see what our server stores
On your phone readable
What our server stores sealed
Sealed right here in your browser with a throwaway key; nothing leaves this page. The app does the same with ChaCha20-Poly1305 and keys that exist only on the two phones.
How adding a contact works
Every contact starts with a meeting. That’s what makes the keys trustworthy: you know whose phone you scanned.
-
Show your code
Tap Show QR. Your phone makes a new key pair just for this person and shows the public half as a QR code.
-
They scan it
Their phone makes its own key pair for you and sends back the public half. Private halves never leave either phone.
-
Start writing
Both phones can now work out the same secret. Nobody else can, including us. Every message, photo and file is sealed with it.
What our server keeps, and what it never gets
The server passes sealed envelopes between phones. Here is everything in its database.
Kept on the server
- A random ID
- Your phone gets it on first launch. It isn’t tied to your name, number or email.
- Public keys and invites
- The public halves of contact keys, and which two IDs connected through an invite.
- Sealed messages
- Ciphertext, sender and recipient IDs, and the time. Deleted as soon as the recipient’s phone collects it.
- Sealed photos and files
- Encrypted bytes and their size. Names, types and contents stay inside the seal.
Never reaches us
- Your phone number
- Your email address
- Your name or your contacts’ names
- Your address book
- What your messages say
- Your photos and documents, or their file names
- Your private keys
Built to know as little as possible
- No phone number needed
- You’re a random ID, not a number. Nobody can find you by searching, and there’s no contact list to upload.
- One key pair per contact
- Each conversation has its own keys. If one were ever exposed, your other conversations stay sealed.
- Photos and files, sealed too
- Pictures and documents up to 25 MB are encrypted on your phone before they upload.
- Delivered, then deleted
- A message leaves our server the moment your contact’s phone picks it up. History lives only on your phones.
- Proven building blocks
- X25519 key agreement, HKDF-SHA256 and ChaCha20-Poly1305: standard, well-studied cryptography. How the encryption works.
- Made in Aachen
- Built by Aralel GmbH in Aachen, Germany, and run under EU data protection law.
Questions people ask
Do I need a phone number or email address?
No. On first launch the app gets a random ID from our server. That’s your whole identity. There’s nothing to sign up for and no password to forget.
Can Aralel read my messages?
No. Messages are encrypted on your phone with a key that only you and your contact have. Our server stores and forwards the sealed result and can’t open it. Neither can anyone who gets hold of the server.
Why do I have to meet someone to add them?
Scanning a code in person means you know the key belongs to the person in front of you. Nobody in between can quietly swap it for their own.
Each code works once. If you send a picture of it instead, whoever scans it first becomes the contact, so only share it in person.
Will I get notifications for new messages?
Not yet. While the app is open it checks for new messages every few seconds. Push notifications are on our roadmap.
What happens if I lose my phone or get a new one?
Your keys exist only on your phone, so we can’t restore your contacts or messages, and there’s no cloud backup. On a new phone, install the app and add your contacts again by scanning their codes.
What if a message can’t be delivered right away?
It waits on our server, still sealed, until your contact opens the app. Their phone collects it, and the server copy is deleted.
Which phones does it run on?
Android 7.0 or newer, from Google Play. The iPhone version needs iOS 16 or newer and is coming to the App Store.
Does it have forward secrecy?
Not yet. Each contact pair currently uses one long-lived key pair. A future version will use fresh keys for each message, so a key taken from a phone can’t unlock older messages. Until then, a locked phone screen is your best protection.
How do I delete my data?
Uninstalling the app deletes everything on your phone. Delivered messages are already gone from our server. To remove your ID, invites and any undelivered data, write to us with the ID shown under My UUID in the app. Details are in the privacy policy.
Get Secure Messenger
Install it on both phones, meet up, scan once. The guide walks you through it.