Frequently asked questions
Short and honest.
What is AES256CHAT?
An end-to-end encrypted messenger without a server. It encrypts messages on the device and transports them as text envelopes over any channel – Telegram, WhatsApp, e-mail, QR code – or directly from device to device.
Do I need an account or a phone number?
No. On first start the app generates an anonymous identity on your device. Contacts are paired by QR code. There is no server to sign up with.
How secure is the encryption?
Contacts are paired with X25519 and ML-KEM-768 (post-quantum); messages use a Double Ratchet with AES-256-GCM – the same protocol family as Signal. Every message has its own key.
What does “quantum-resistant” mean here, concretely?
The session secret is derived hybridly from X25519 and ML-KEM-768 (standardised by NIST in 2024). Whoever records traffic today cannot open it with a future quantum computer unless both schemes are broken.
Where are my messages stored?
By default nowhere persistent: messages live in memory and vanish when the app locks. If you enable history, it is stored encrypted on the device (Argon2id, AES-256-GCM) with auto-delete.
Can Telegram or WhatsApp read my messages?
No. The channel only carries the encrypted envelope. It sees that you communicate and how much – not the content.
How do I add a contact?
Both open “Add contact” and hold the phones screen to screen; both show a code and scan at once. Alternatively step by step (one shows, the other scans, then the other way round) or as a text code.
How do I receive a message?
Tap the envelope in Telegram → Share → AES256CHAT. Or copy the text and choose “Import message” in the app. If the app is locked, the message opens after unlocking.
Are there push notifications?
No – without a server there is nobody to push. The envelope waits wherever you sent it. When both are online, a direct link can be set up and messages arrive instantly.
Is AES256CHAT free and open source?
Yes. The source code is on GitHub under AGPL-3.0. The app costs nothing and contains no ads, no tracking and no telemetry.
What about the old passphrase mode (🛡️QR-ENC:)?
It stays available as a tool in the settings and is compatible with version 1. For real conversations we recommend contacts with key exchange – the passphrase mode has no forward secrecy.
Is there an iPhone app?
The web app runs in Safari and can be added to the home screen. A native iOS version is prepared but not yet released.