Messages, files, calls
Text, attachments, voice and video share one end-to-end encrypted session. There is no "secret chat" mode, because every chat is one.
Next-generation private messenger
Private today. Private after the quantum computer.
Balsso is an end-to-end encrypted messenger built on hybrid post-quantum cryptography. Messages, files and calls are sealed on your device, and every key exchange combines a classical and a post-quantum algorithm, so traffic recorded today cannot be opened later by breaking only one of them.
ML-KEM-768 · FIPS 203X25519 hybridPost-quantum key updatesVerified contactsNo ads, no analytics
Why now
Harvest now. Decrypt later.
Encrypted traffic is being recorded today to be broken tomorrow. Classical key exchange based on elliptic curves falls to a sufficiently large quantum computer. Anything sealed with it alone has an expiry date you don't control.
Protocol
Hybrid by design. Two locks, one key.
Every key exchange in Balsso, from the first handshake to every later key update, combines a classical and a post-quantum algorithm so that a conversation stays secret as long as either one holds. Encryption is always on: there is no unencrypted mode and no downgrade path.
- 01
Hybrid key exchange, every time
ML-KEM-768 (FIPS 203) and X25519 are combined in every key exchange, not only the first one. The result is bound to the participants, their devices and the conversation, so a swapped component produces a different key and the exchange fails instead of silently degrading.
- 02
Authenticated contacts
Your identity key is created on your device and never leaves it. Every device carries credentials signed by that key, so the server cannot add a device to your account. Verify a contact with a QR code or safety number; key changes and new devices are announced, and a strict mode refuses to send to anyone you have not verified.
- 03
Keys that keep moving
Conversation keys rotate with every change: a new device, a member joining or leaving, a periodic refresh. Each rotation is a fresh hybrid exchange. Message keys are derived per message and deleted after use, so one leaked key exposes nothing else, and a leaked device state loses access after the next rotation it did not take part in.
- 04
Sealed envelopes
Messages are encrypted with ChaCha20-Poly1305. Photos, files and voice messages use XChaCha20-Poly1305 in authenticated segments, each file under its own random key that travels only inside the encrypted message. Servers route opaque ciphertext, hold no keys, and delete envelopes once delivered.
What Balsso is
Everything encrypted. Minimum collected.
Your number stays yours
Contacts discover each other through hashed identifiers. Your phone number is never shown to the server-side profile or to people you message.
Minimal metadata
The server knows which accounts share a conversation and when envelopes pass through. It never sees content, names, group titles, or who is calling whom. Envelopes are deleted after delivery; logs are short-lived and never leave our own machines.
Every device, its own keys
Each phone holds its own keys and credentials signed by your identity key. A new device is linked phone-to-phone with a matching code; the server cannot add a device to your account.
Calls that stay sealed
Voice and video are encrypted end to end with keys that come from the conversation itself, and even the ringing and hang-up signals travel inside the encrypted conversation. Our relay forwards packets it cannot read.
Independent infrastructure
Our own servers, no hyperscalers, no ads, no analytics, no data brokers. Push notifications carry no content. This page loads nothing from anyone else.
Status
In development, built in the right order.
Security work cannot be rushed. The cryptographic core came first; the apps are built on top of it and reviewed before any public release.
- Threat model and architecture
Who we defend against, which standards we rely on, how identities, devices and delivery fit together.
- Infrastructure
Dedicated servers, encrypted storage, monitoring and backups are running.
- Server
Account, device and delivery services are live.
- Post-quantum encryption core
Identities, verification and strict mode, hybrid key rotation, encrypted files and calls, device linking.
- Android
Chats, groups, calls, walkie-talkie, photos, video, files and voice messages, reactions, disappearing messages. Release builds in testing on real devices.
- iOS
The same core features on the same cryptographic core, with system calls on the Lock Screen. In testing on real devices.
- Sign-in and anti-abuse
Code delivery that works in every country we serve, with limits that keep the service out of spam and fraud.
- Localisation
21 languages in both apps; service messages next.
- Store compliance
Report and block, account deletion in the app and on the web are done; export declarations next.
- Security review
Protocol and implementation reviewed before any public release. First pass done, its findings fixed.
- Desktop: macOS and Windows
Linked as one more device of your account, same encryption, nothing passes through the server in the clear.
- Encrypted backups and recovery
A recovery key you hold; the archive is encrypted on your device and the server stores only an opaque blob.
- Load and reliability testing
Large groups on low-end phones, bad networks, reconnects, device limits.
- Early access
Invitation-only wave, direct support channel, fixes before anyone else joins.
- Public launch
Open registration.