No phone number. No email. No accounts. Your key is any file, password or link — and it never leaves your device. The server never sees your messages — only sealed blocks, where they are addressed and when.
Who reads what is decided entirely by who holds the key — never by an account, a role, or a list on our side. We couldn't hand over your conversations if we tried.
A password, any file (PDF, photo, MP3), a URL — or a Shamir split across several files. It's hashed locally and never transmitted.
No phone number, no email, no username. Your identity is a keypair that lives only on your device — never on our servers — and you share it with a contact only when you choose, by scanning in person.
Keep separate personas under a single app-lock — one for work, one for everything else — and decide which one a contact ever sees. No second number, no second phone, nothing to correlate across them.
Every message can use a different key. The same room looks different to each person — some lines are text, others are just .
It keeps sealed blocks, the address each was sent to and when — for 24 hours. No senders, no names, no key hints. Seized, it gives up ciphertext and timing, never words or names.
Lock a message so it only opens when K of N people combine their keys. One infiltrator with one share is useless.
By default, keys are exchanged offline — in person, by file, or by QR scan — never negotiated over the network. That eliminates an entire class of man-in-the-middle attacks.
Lock a message to open only after a date, only for a set lifetime, or only when K-of-N people combine their keys — and let it burn after reading. The conditions ride inside the ciphertext; the relay never sees them.
Add someone remotely and you compare a short number over another channel. It covers both people's identity and encryption keys, so a key swapped in transit changes it — and a contact code that reuses a known identity with a different key is refused outright.
No Firebase, no push broker that learns who pings whom. A local service delivers while the app is unlocked, and the alert carries no content and no sender. Before you switch it on, the app tells you what it costs and when it stops.
Tap the flask and the app re-runs its cryptography on your own phone against known-answer test vectors: key derivation and the message cipher, the handshake and safety number, and a wrong key yielding a locked block with no error and no hint. Not a certificate from someone you've never met — a test you watch pass. We measure the same code's timing on the same class of phone, and publish what leaks next to what doesn't.
Leave a one-time note behind a link or QR code. It opens once — in the app, or in any browser at ygoow.com/d — and the relay deletes it. The key rides in the part of the link that never reaches a server, so a chat app's link preview can't open it or burn it.
Messages are sealed with AES-256-GCM on the processor's crypto instructions through a native library — about 290× faster. We moved there after measuring the old library leak timing on the phone, published the leak first, then re-ran the same test on the fix: 24 of 24 readings at noise level.
A backup file can be attacked offline forever, so sealing it is stricter than anything else in the app. “Word + digits + symbol” passwords used to sail through; measured against the new gate, all but 0.3–0.6 % now get flagged as weak before anything is sealed. You can still insist — just not by accident — and the dialog names what it can't catch.
Talk to many the way you talk to one: end-to-end, with no member list on our side. Each sender carries their own key chain, and removing someone moves the room to a key they never receive, so they can't read what comes next — a deliberate step the app explains before you take it.
Your identity and keys are created on-device and stored encrypted behind your app-lock — a password, a file, a quorum, biometrics, or a YubiKey (NFC). Nothing leaves without a deliberate decision.
Scan each other's QR face to face — the conversation key then comes from your two identities, with nothing to agree and nothing sent through the server. Want more? Seal the words under a separate secret: a file you both have, a password, a quorum.
Anyone without the key sees a locked block — or, in stealth rooms, nothing at all. No error, no hint, no oracle.
Choose how a conversation is protected — three levels, no insecure default →
Security that survives a bad day is layered — and honest about where each layer ends. Here's ours, and what each one does (and doesn't) do for you.
Reach the network over Tor v3 (the server never learns your IP or where you are), over Tor bridges where Tor itself is blocked, or over a standard connection when hiding your location isn't the point. The app states plainly what each mode reveals — the choice, and the trade-off, are always yours.
A key you swap face-to-face can't be tampered with — you watched it happen. Set one up remotely when you can't meet, and the app marks it as such, with a fingerprint to verify later. Trust is shown, never assumed.
Messages wait, encrypted, for up to 24 hours until you reconnect — even across a dropping Tor circuit. Neither of you has to be online at the same moment for a message to land.
Beyond Tor, every block is padded to a size bucket and the conversation address rotates per-conversation — and a high-risk mode adds cover traffic the relay can't tell from yours. And what it can still read — from timing, and from one header field we haven't encrypted yet — we measured and published rather than rounded off.
Set a second password that opens a decoy profile to show under pressure — your real one stays hidden in the same store. Measured over months of simulated use, not just on setup day: without the decoy password, copies of your storage and the time the unlock takes give nothing away. A panic lock disarms biometrics so a forced finger opens nothing.
Screenshots, screen recording, and the "recent apps" thumbnail are blocked — the chat can't be captured from outside the app, even on a seized phone.
Read the full trust model — what we protect, and where it ends →
When they couldn't break the cipher: how EncroChat and Ricochet actually fell →
The measurements here come from cards whose criteria were written down before the run — timing on an ARM64 phone in a release build, storage in simulation and passwords on a synthetic corpus. Where a measurement overturned a claim, the whitepaper says so.
faster message encryption after moving AES-GCM onto the phone's crypto instructions — and the timing leak we had published, measured gone.
the unlock-time gap that gave a hidden decoy profile away. Found by timing our own app; closed to tens of milliseconds on the reference phone.
hidden-profile data losses across 600 simulated lifetimes — after the measurement that caught the decoy overwriting it.
of “word + digits + symbol” passwords getting past the backup gate without a weak-password warning — before and after we measured our own strength meter.
timing leak in our post-quantum (ML-KEM) implementation that only showed on ARM64 — invisible on a desktop CPU. Fixed, and verified on the phone. Post-quantum is built, not yet in the app.
measurement cards since July 2026, each with its criteria written down before the run — and since 6 September committed before it (24 of them). Including the ones that overturned our own claims.
research projects behind YGOOW confirmed as research and development by Germany’s Bescheinigungsstelle Forschungszulage (BSFZ), under the Research Allowance Act (FZulG). The seal vouches for the research, not the security — for that, see the numbers above. What it means →
Read the measurements, misses included → · What's done, and what's still ahead → · Run the Dead Drop test vectors in your browser →
YGOOW began two decades ago with one idea: sharing data freely, anonymously, without surveillance. The world finally caught up.
Ygoow speaks up at the moments that matter — cheeky, but honest. These are the in-app cards, verbatim. Swipe through.
A chat with a contact starts end-to-end encrypted, over Tor — and the app never lowers that floor without asking you. Everything above it is your call: a key for a single message, messages that disappear, a group under a second secret. A new group won't even start until you choose its protection.
A password, a file, a link, a quorum of people. Just remember: a public file or a guessable link is not a secret. The app shows you the real strength of what you pick.
A key you swap face-to-face can't be tampered with — you watched it happen. Add one over a channel and the app marks it unverified until you compare fingerprints on a channel you trust. Trust here is shown, never assumed.
By default the relay never sees your IP. Turn Tor off only on purpose — clearnet hands your address to the server. Your IP literally is an address.
Every message is padded to one of a few sizes, and your conversation address changes every 15 minutes — the relay does not know how long your messages are. It still sees WHEN you send something. We are working on that and will tell you once we have measured it.
Keys are agreed between people, offline. Our relay never has them: it holds ciphertext for at most 24 hours. A court order could get that ciphertext and delivery metadata — mailbox addresses and when frames were stored — never your words.
Turn on YubiKey 2FA and unlocking needs your secret AND a tap of your hardware key over NFC. Knowing — or extracting — your password is no longer enough. Opt-in, off by default; the choice is yours.
No messenger survives a phone taken while unlocked, or carrying spyware — it reads your screen directly. We tell you this, because the ones who don't are the ones to distrust.
Set a second password that opens a separate profile — your real one stays hidden in the same store. To someone without the decoy password, even two copies of your storage days apart look like a store without a hidden profile. Once they have the decoy password, an unused decoy and a second copy can give it away — so use the decoy like a real profile. A panic lock disarms your fingerprint, so a compelled finger opens nothing.
Run several personas under one app-lock and pick which one a contact ever sees. No second number, no second phone. Your contacts see separate identities — but our relay can tell they run on one phone (measured: 85–100 %). Personas separate you from people, not from the network.
Group rooms are end-to-end with no member list on our side — each sender has their own key, and removing someone moves the room to a key they never receive, so they can't read what comes next. But a room trades the deniability of a 1:1 for who-said-what among members; the app tells you so before you start one.
The safety number covers your identity key and your encryption key — both people's. Swap either in transit and the digits change. A code that reuses a known identity with a different encryption key isn't "an update": it's refused as forged, because that is exactly what an interception looks like.
A one-time note behind a link or QR: it opens once, then it's gone. The key lives in the part of the link browsers never send, so a chat app's preview can't read or burn it. Text only. In a browser the page code comes from our server each time — for high stakes, open it in the app.
Undelivered messages wait on the relay, encrypted, for up to 24 hours — then they're deleted. A phone that stays off longer than that won't get them; the other side has to send again. That's the price of a server that keeps nothing, and we'd rather you know it now than find out later.
YGOOW for Android is on its way — other systems may follow, and we are choosing distribution channels that keep you safe. Your key, your rules — everything else is redacted.
Get it on Android — soonClosed source while the research is ongoing · no independent audit yet · what runs today and what is still built: progress.