PrivChat is a peer-to-peer encrypted messenger for Android. There is no account to create, no phone number to give, and no company holding your conversations — including us. Two phones talk to each other directly, through the Tor network.
Most messengers are encrypted and centralised: your words are protected, but a company still sees who you talk to, when, and how often. That record is often more revealing than the words. PrivChat removes the company instead of asking you to trust it.
When you write a message, your phone encrypts it and hands it to the Tor network, which passes it through a chain of relays run by independent volunteers around the world. Each relay knows only the previous hop and the next one. The first relay knows you are sending something but not to whom; the last relay knows where it is going but not who sent it. Nobody along the way can read it, because the key exists only on the two phones.
Your internet provider is in the same position. It can see that you connect to the Tor network — that much is unavoidable for any tool built on Tor — but it cannot read a word of what you write, and that is not a matter of goodwill: the message is already encrypted when it leaves your phone, so nothing readable ever crosses their network. The same goes for the wifi you are connected to, and for anyone watching the line.
There is no inbox, no queue and no cloud. If the other person is offline the message stays on your phone and tries again later. Nothing is ever parked on a machine belonging to someone else.
The message passes through several layers, each solving a different problem.
Keys are not reused. Each message is encrypted with its own key, derived fresh and thrown away immediately, and the chain moves forward with every message in both directions. If one key were ever compromised, it would open one message — not the conversation. And once the two phones exchange messages again, the chain heals itself: even an attacker who had somehow got hold of the current state is locked back out.
Encrypting the words is the easy part. What usually leaks is everything around them: who, when, how often, how long. PrivChat wraps each message in a sealed envelope whose only readable part is a random single-use key, and even the internal routing header of the encryption is itself encrypted — so two packets from the same person cannot be recognised as belonging together.
A one-letter reply and a long paragraph produce packets of identical size, so length reveals nothing. On top of that the app sends decoy packets at random intervals, indistinguishable from real ones. The consequence is the important part: an observer watching your connection cannot tell whether you are having a conversation at all.
There is one attack you cannot defend against after the fact. An adversary can record your encrypted traffic today and simply store it. Nothing prevents that. If, years from now, quantum computers can break the key exchange used in 2026, everything they stored becomes readable — retroactively, and there is nothing you can do about it then, because the recording already happened.
PrivChat's key agreement combines the classical algorithm (X25519) with ML-KEM-768, the post-quantum algorithm standardised by NIST in 2024. The two secrets are mixed together, so an attacker has to break both — and that shared secret seeds the entire conversation, in both directions, for as long as it lasts.
This matters most for exactly the people who need this kind of app: what you say today is still worth protecting in fifteen years.
Messages, contacts, attachments and the keys themselves are all encrypted at rest, with a key held in the Android keystore and tied to the device hardware. You can add a PIN, and then the key needs both halves — your PIN and a device secret — so not even the phone can open its own storage without you.
The app excludes itself from Android's automatic backups, so your conversations are never uploaded to any cloud, not even your own. Ephemeral messages delete themselves after 24 hours, and "erase identity and start over" destroys the keys rather than just deleting files: after it, the old data is unrecoverable even with the phone in hand.
The architecture is peer-to-peer, and that is the part that decides whether everything else on this page is true. Each phone runs its own Tor onion service and speaks straight to the other one. There is no relay of ours, no message queue, no account database — so there is no place where a record of who talks to whom could pile up, even for someone who came asking for it. Removing the server is not a feature bolted onto the encryption. It is what makes the encryption worth having.
On top of that runs the same set of standards that governments and industry have settled on. Nothing here is home-made, and every piece is publicly specified — the links go to the specifications themselves, not to us.
| Purpose | What is used |
|---|---|
| Architecture | Peer-to-peer: each phone is its own Tor v3 onion service, with no server in between |
| Key agreement | PQXDH — X25519 combined with ML-KEM-768 (FIPS 203) |
| Key renewal | Double Ratchet, with encrypted headers |
| Message encryption | ChaCha20-Poly1305 |
| Signatures | Ed25519 |
| Key derivation | HKDF-SHA256 |
| PIN derivation | Argon2id |
| Local database | SQLCipher (AES-256) |
| Transport | Tor, via the arti implementation |
Contacts are identified by a fingerprint you can compare out loud, so you can confirm you are talking to the person you think you are, and not to somebody who intercepted the introduction.
PrivChat is free, has no ads and collects nothing to sell. If you want to support it, these are the only two addresses. Check the fingerprint before you send anything.
Why the fingerprint matters. The donation address is written inside the app, in the clear. Rebuilding the app with a different address is the classic fraud against apps that accept donations: you copy an address that is not ours and there is no way for you to notice.
The app shows a short fingerprint next to the address. If it matches the one on this page, the address in your copy of the app is the real one. It is the same gesture the app already asks of you to verify a contact.
45hRduLUQD5Ek4qGgHTuWAZnncwroMET1WsLUDC9AF6DNSt5qMP1Fk7WUsN4EwzJdA1ypfL7TtJQQ8uqutAJWwJy5jzp8Pa
Fingerprint: 1D63 68D5 7653 1887
sp1qqf2jvtz0k7rsy7f0cka9ejz6e4lmakz6v9zgae02ks0qpck3a6dxzqn73fp9gj6y632q8th2nfv2lv7rua49s5unzjpau3ahp29ssw689vwu9ksy
Fingerprint: 63BB FA03 F806 BC55
Because on a public chain every donor would pay to the same place, and that stays visible forever. Anyone could pull the list of people who donated to an encrypted messaging app. That list is exactly the kind of thing this application exists to prevent — so we are not going to create it ourselves in order to collect donations.
A Silent Payments address works differently: your wallet derives a fresh destination that only we can spend from, so nothing on the chain links the donations to each other. It needs a wallet that supports BIP-352.
The two fingerprints above are also published as a signed statement, so that changing them would take more than compromising this site — it would take our signing key as well.
Signed statement: donations.txt
Public key: privchat-pgp.asc
Key fingerprint:
BC8D E53F D8D1 6F63 AD8A 33EA 10EC 8069 37D6 8502
To check it: import the key, then run
gpg --verify donations.txt. The key fingerprint it reports has to
match the one above.
That same key fingerprint is published on our Google Play listing. They are two separate places, held by different companies: a forged fingerprint would have to appear in both at once and stay consistent. If the two ever disagree, send nothing and write to us.
New to it? How to use PrivChat walks through adding your first contact, checking a fingerprint and what the message states mean.