termchat.app

not audited · experimental

termchat.app

Private messages, in your terminal and on your phone.

End-to-end encrypted text and documents, no accounts. You are a key pair and a nickname you choose; the server only ever sees ciphertext.

InstallDownloadGitHub

What it is

Text and documents, in a terminal and on Android

A chat where you already work, and an app for your phone on the same engine. Files are opaque bytes, never opened or previewed; no inline images, no link previews, no formatting: less to leak, less to exploit.

No one to sign up with

No phone number, email or name. Your identity is a key pair made on your device, plus a nickname only your contacts see.

A server that knows nothing

The relay passes along envelopes it cannot open. Seizing it gives ciphertext and public keys, nothing more.

What it can do

End-to-end encryption

Olm from vodozemac: an X3DH-style handshake and the Double Ratchet, the design behind Signal and Matrix.

Tor built in

One switch hides your IP address from the relay and your provider. Where Tor is blocked, obfs4, webtunnel or snowflake bridges get through. No separate Tor install.

Offline delivery

Messages wait on the relay, encrypted, for up to 14 days until your contact comes online.

Documents

Send a PDF, a config or a key of up to 1 MiB, encrypted end to end like any message. Saved only when you choose, never opened by the app.

Disappearing messages

From 5 minutes to a week, per chat. Or keep a chat in memory only, never on disk.

Duress password

A second password that silently erases everything and shows a fresh install.

Auto-lock

Keys leave memory after 5 idle minutes, or at once with Ctrl+K.

Backups and moving

Back up your identity and restore it on a new device; the old one is wiped without telling anyone.

Safety numbers

Compare 60 digits with a friend once and rule out anyone in the middle.

Requests, not inboxes

Strangers wait until you accept. Block, reject or report to the relay operator.

One-time invites

Each invite works for one person. Revoke the unused ones, or renew a public invite to stop the old link.

Incognito contacts

Talk to someone from a separate identity of your own: other keys, another name. Contacts cannot link you, and over Tor neither can the relay.

Search, on your device

Find anything in a chat. Nothing is indexed or sent anywhere.

Android app

The same engine and protection on your phone: Tor, the duress password, no Google services. Wake-ups through UnifiedPush if you want them.

Mouse and themes

Click, scroll, right-click for actions. The same light and dark colour themes in both apps.

Your own relay

One small binary with SQLite. Run it on any server, with an onion address if you like.

What it protects, and what it does not

The goal is not “impossible to break” but “breaking the server is pointless”.

Protected

  • Message contents, from your provider, Wi-Fi, the relay operator and anyone who seizes the relay.
  • Old messages if a key leaks later, and new ones once the attacker loses access.
  • Tampering, replays and reordering; dropped messages are shown.
  • Impersonation, once you compare the safety number.
  • Your IP address, from the relay and your provider, with Tor on.
  • Your data at rest: encrypted with your password (Argon2id).

Partly

  • Metadata: the relay sees which key writes to which and when, and the size rounded up to 512 / 4096 / 16384 bytes; a document goes as a run of 16 KB messages, so its size can be estimated. Incognito contacts over Tor give it pairs of keys it cannot link to you.
  • Someone at your unlocked computer: auto-lock, disappearing messages, chats without history.
  • Being forced to give a password: the duress password does not help if the disk was copied first.
  • A lost device: only with a backup of your identity.

Not protected

  • Malware, a keylogger, a compromised terminal or OS.
  • A global observer correlating traffic timing.
  • Keys in swap or a hibernation file: use disk encryption.

Full threat model →

How it works

  1. 01

    Exchange invites

    Send your invite, a line starting with termchat:, by any channel. It holds public keys and a code that works once.

  2. 02

    Verify once

    Compare the safety number in person or by phone. Same digits: nobody is in the middle.

  3. 03

    Talk

    Messages travel encrypted through the relay, with a new key for every message.

Install

With Homebrew

brew install prophecy1345/tap/termchat

Or with one command

curl -fsSL https://raw.githubusercontent.com/prophecy1345/termchat/main/scripts/install.sh | sh

In PowerShell

irm https://raw.githubusercontent.com/prophecy1345/termchat/main/scripts/install.ps1 | iex

Or download the .zip, open it and double-click termchat.exe.

Download termchat-…-android-arm64.apk from the releases page and open it; Android asks once to allow installs from your browser. No Google services needed. For messages while the app is closed, install ntfy and turn on wake-ups in the app's settings.

Releases

Download the archive for your system from the releases page, check it against SHA256SUMS and run termchat.

Releases

Then type termchat. The setup screen is already filled in with the public relay.

Verify a release →

Run your own relay

The relay is one binary next to termchat.app in every release: SQLite, rate limits, an optional onion address. Your friends use your server; nobody else needs to know.

Self-hosting guide →