Post-quantum Signal protocol
Messages use libsignal: PQXDH with Kyber1024 for the first contact, then the post-quantum ratchet (SPQR).
README · THREAT_MODEL
Post-quantum · No account · Tor only
Your messages.
Your messages.
Your keys.
Your control.
Kilit is a messenger and encrypted vault with no account, no phone number and no server of its own. Messages are encrypted on your device and leave it only through Tor.
sealed on your device
YOUR PRIVACY. YOUR CONTROL.
04 / what it is
Four things Kilit does, and nothing it can't back up
No account, no tracking
No sign-up, phone number or email. No analytics, no crash reports, no ads. Your ID is four words.
PRIVACY.mdTor only, no server
An embedded Tor carries every message to public Nostr relays. Kilit runs no server of its own.
README · RELAYS.mdOpen source
GPL-3.0-or-later, built inside pinned Docker images. Read it, build it, report what you find.
LICENSE · repro/
04.1 / features
Built for chats you'd rather keep
Everything below is in the current alpha for Android and Windows.
- 01
A Kilit ID instead of a number
Four words, like
@abandon-ability-able-about. Share it as a QR code or akilit://addlink. You can renew it; your contacts stay. - 02
Requests for strangers
People who write first land in Requests and must pay a small proof of work. They get no read receipt until you accept.
- 03
Files, photos and stickers
Files up to 5 MB, each with its own key. Photos lose their metadata before sending; camera photos never touch the disk.
- 04
Groups of up to 20
Each message is encrypted separately for every member, so on the relays a group message looks like any other.
- 05
Disappearing messages
Set per chat. Delivery ticks show when a relay holds a message and when their phone opened it.
- 06
Phone and computer
Kilit runs on Windows with its own Tor. Link up to 5 devices to one ID; each has its own keys.
- 07
Encrypted vault and carrier mode
Notes and files in the
.kltformat (age with post-quantum X-Wing keys). Seal a message asKLT1:text and send it through any other app. - 08
Hardware-bound PIN and panic code
The PIN is bound to the phone's hardware key. A separate 4-digit panic code wipes everything.
- 09
Works where Tor is blocked
Built-in obfs4 and Snowflake bridges, or your own bridge lines. 15 languages.
05 / how it works
From your keyboard to their screen
The message is sealed before it leaves your device and opened only on theirs. In between it is ciphertext on a relay.
01 / add
Share your code
Scan their QR code or open their kilit:// link. The first message sets up keys with PQXDH and Kyber1024.
02 / seal
Encrypt on device
Signal's post-quantum ratchet encrypts the message, then NIP-44/59 wraps it again for the relay.
03 / carry
Over Tor to a relay
The embedded Tor delivers it to public Nostr relays, under a mailbox tag that changes every day.
04 / open
Fetched and opened
Their Kilit picks it up over Tor and decrypts it. Two ticks: their phone opened it.
what the relay sees mailbox 9f3c…e21a changes every 24 h time 2026-11-09T21:04Z size class M content ciphertext (Signal SPQR → NIP-44/59) ip a Tor exit, never yours
06 / security
What Kilit protects, and what it doesn't
From the project's threat model. It is a draft and will be updated as Kilit grows.
Alpha. Not audited. Kilit has had no independent security review. Do not rely on it where your life or freedom depends on it.
Protects against
- Network observers
- Traffic goes through Tor. Your internet provider does not see who you talk to.
- The relays
- Messages are encrypted twice, with Signal (PQXDH and Triple Ratchet) and NIP-44/59. Relays cannot read them.
- Future quantum computers
- Key exchanges are hybrid: X25519 and ML-KEM.
- Malicious files
- Files are opened in a single-use compartment that is destroyed after each job.
- Copied vault files
- The PIN is MAC'd with the device's hardware key (StrongBox or TEE, TPM 2.0 on Windows), then Argon2id. A copy cannot be tried on another device.
Does not protect against
- Metadata on public relays
- Someone who knows a mailbox address can see when and how many messages arrive. Addresses change every 24 hours.
- PIN guessing on a rooted phone
- Argon2id slows each try (about 0.3 s), but a 6-digit PIN can still be found in days. Use a longer PIN.
- Losing the hardware key
- If app data is wiped or the device reset, the vault cannot be opened again. Encrypted backup is planned.
- A compromised device or the other person
- An unlocked phone or kernel malware is out of scope. The person you talk to can still screenshot or forward.
- Global traffic analysis
- There is no cover traffic, so a watcher of much of the network may try to correlate timing.
| First contact | PQXDH · Kyber1024 |
|---|---|
| Ongoing messages | Signal post-quantum ratchet (SPQR) |
| Relay wrapping | Nostr NIP-44 / NIP-59 |
| Vault and carrier | .klt · age + X-Wing (KLT1) |
| PIN | HW key MAC → Argon2id |
| Network | Embedded Tor · obfs4 · Snowflake |
independent auditnone yet
analytics / crash reportsnone
own servernone
buildspinned Docker images
windows installernot code-signed yet
vulnerability reportsprivate, 90 days
07 / app preview
The real screens
The people and messages are made up. Kilit blocks screenshots by default, so these are drawn from the real screens by app/tool/screenshots.
08 / download
Get Kilit, then check it
Every build is on GitHub Releases. Before installing, compare the SHA-256 and, on Android, the signing certificate.
android 7.0+
Android
Two permissions: the network, used only by the embedded Tor, and the camera, for photos you take in a chat.
Download APK Kilit-0.1.5-alpha.apk · 150 MB
windows 10+ · 64-bit
windows-x64.zip · 51 MB (portable)
Windows
Installs for your user only, no administrator rights. Not code-signed yet, so SmartScreen warns: check the SHA-256, then More info, Run anyway.
Installer (.exe) windows-setup.exe · 36 MBwindows-x64.zip · 51 MB (portable)
release notes
0.1.5-alpha
Tor errors are visible, automatic mode recovers faster, and screenshot blocking has its own switch.
All releasesverify · v0.1.5-alpha
# 1. checksum must match the release notes $ sha256sum Kilit-0.1.5-alpha.apk 025c04b4bfa3eccac985e5bdf2b20ca9d815d0e1b18a3ea2be950e2a11a634ed # 2. the signing certificate must be Kilit's $ apksigner verify --print-certs Kilit-0.1.5-alpha.apk SHA-256: DE:B8:42:2C:53:F6:FB:C3:34:7C:5C:0B:84:31:61:17: D2:C9:4A:53:CD:70:FA:6A:B4:E9:50:16:DA:9D:B1:E1 # windows (PowerShell) > Get-FileHash Kilit-0.1.5-alpha-windows-setup.exe 351c10562298d118efae338fea64ea880968c6756baa22c1c51bb6f180aa9b02
08.1 / documentation
Read how it works
KILIT-NETnetwork protocol (Turkish)
MULTI-DEVICElinked devices (Turkish)
KLT1vault and carrier format
THREAT_MODELwhat it protects, what it doesn't
PRIVACYwhat relays can see
BUILDINGbuild it yourself (Turkish)
Does Kilit need a phone number or an account?
No. You get a Kilit ID of four words and share it as a QR code or link. No phone number, email or contact upload.
What can the relays see?
Mailbox addresses, message times and a size class. Not the content, and not your IP address, because Kilit connects through Tor.
Tor is blocked where I live. Will it work?
Kilit can use bridges: built-in obfs4 or Snowflake, or bridge lines you add yourself. Automatic mode tries direct, then obfs4, then Snowflake.
What happens if I lose my phone?
The vault is bound to that phone's hardware key and cannot be opened elsewhere. Encrypted backup is planned for a later stage.
Why does Windows warn about the installer?
The installer is not code-signed yet. Check its SHA-256 against the release notes, then choose More info and Run anyway. The portable zip is the same app.
Has Kilit been audited?
No. Kilit is alpha and has had no independent security review. Do not rely on it where your life or freedom depends on it.
Read the code.
Then trust it.
GPL-3.0-or-later. Derived in part from Kryfo (GPL-3.0-or-later) and linked with libsignal (AGPL-3.0), so the combined program carries the AGPL-3.0 network-interaction terms. Kilit is not Kryfo and is not endorsed by its authors.