How YGOOW compares

We will not tell you YGOOW is the only secure messenger — that claim is how you spot marketing. Several excellent projects solve overlapping problems, and some are more mature than we are today. Here is an honest map of where YGOOW sits, and where it does not.

At a glance

✓ yes · ✗ no · ~ partial or qualified. Where we wrote planned, we mean exactly that — and we say so again in the whitepaper and our security policy. The side-channel row means timing measurements of the shipped code on its target hardware, with the unfixed findings published alongside the fixed ones. The others rely on cryptographic libraries built to be constant-time and on external audits — a stronger guarantee than a measurement, and we say so; ~ only because raw measurements of the shipped build are not published as such.

What is genuinely different about YGOOW

No single row is the point — the combination is:

• No identity, anywhere. Not a phone number, not even a public-key “address” that lives on a server. Your keypair is generated on-device and shared only when you choose, in person.
• Your key is anything. A password, a file you both have, a link, a random key in a QR, or a Shamir split — hashed locally, never transmitted. No other messenger here lets the shared secret itself be an arbitrary artifact.
• A different key per message. The same room is text to one person and a lock to another, with no error and no hint — the property we pulled apart in “no oracle”.
• A deaf relay. The server stores only ciphertext and timestamps; seized, it is noise — and with no central store there is no single place to harvest everyone at once, which is the lesson EncroChat taught. (Briar drops the server entirely with peer-to-peer — a different answer to the same fear.)
• Post-quantum without a server to ask. An adversary who records your traffic today and waits for a quantum computer is the reason serious messengers are going post-quantum. Signal got there first and at scale — but its post-quantum handshake, like every other, needs a prekey server holding one-time keys on your behalf. Our relay is not allowed to hold anything. So your identity simply carries its own long-term post-quantum key, handed over the same way as the rest of your identity — in person, by QR or NFC — and nothing is ever deposited anywhere. It is a hybrid — X25519 and ML-KEM-768 — which stays secure as long as either one holds.
• Quorum unlock. A message that only opens when K of N people combine their keys. One infiltrator with one share learns nothing.
• Many selves, one app. Work, family, a pseudonym — separate keys and contacts behind a single lock, each riding its own Tor circuit, with no key, contact, or record on our side that ties them together. None of the others lets you carry several identities on one phone. What can still link them is timing at the relay — measured, named in the whitepaper, and under a design decision to close.
• A decoy for coercion. A second password opens a decoy profile while your real one stays hidden in the same store. We measured it over months of simulated use rather than on setup day: without the decoy password, one or two copies of storage and a stopwatch on the unlock don’t tell the two apart. With the decoy password, two copies still show that the real profile was used in between — we publish that edge too. None of the others here ships plausible deniability against a forced unlock — though deniability buys a credible denial, not invulnerability.
• A note for someone who doesn’t have the app. A Dead Drop is a one-time text note behind a link: sealed on your device or in the browser, opened once, then deleted by the relay. The key lives only in the part of the link that never reaches a server, so a chat app’s link preview can’t open or burn it — and the recipient needs nothing installed.
• A hardware key as a second factor. Optionally require a YubiKey (over NFC) on top of your secret to unlock — the challenge-response is computed on the key, never leaves it, and gates local access. It is deliberately not a per-message signature, so your deniability stays intact. None of the others here offers a hardware second factor for the lock.
• Metadata shaped, not just hidden — and measured. Beyond Tor, every block is padded to a size bucket (0.04 bit of length per frame, the same size whatever the mode), the conversation address rotates per-conversation, and a high-risk mode adds cover traffic the relay cannot tell from your frames. We also publish what our own relay can still infer from timing — because we measured it against the strongest adversary we could build, and it found more than our earlier text admitted. The whitepaper has the numbers on both sides.

Where the others are ahead — today

We would rather say this than have you discover it:

• Signal is the audited, reproducible-build, decade-hardened standard, on every platform. It also got to post-quantum first and at a scale we have not earned: PQXDH in 2023, then the post-quantum Triple Ratchet in 2025, reviewed by outside cryptographers and shipped to billions of devices. Ours is newer, unaudited, and carried by far fewer people. For most people, most of the time, Signal is the right answer.
• Briar works with no internet at all — over Bluetooth and local WiFi — which is exactly what you want in a blackout or a protest, and it has been independently audited (Cure53).
• Session runs on a decentralized network with no central operator to seize, and ships on every platform today.

YGOOW is younger than all three. We have no independent audit yet, and we are Android-only. And where we do claim post-compromise security and a post-quantum hybrid, we claim them with their edges showing: because there is no prekey server, the very first chain of a conversation is derived from the secret you already share, so it is not yet post-compromise-fresh — it becomes so after one full round-trip, once both sides have contributed a key the other has never seen. Signal’s prekey server buys that freshness from the first message; we trade it for a relay that holds nothing. That is a real trade-off, not a free win. None of this is buried — it is in the whitepaper and on our security page.

How to choose

• Want a battle-tested everyday messenger your less-technical contacts will also use? Signal.
• Need to communicate with no infrastructure at all, offline, in a crisis? Briar.
• Want no central operator and cross-platform reach today? Session.
• Want no identity on the server, a key that can be any secret you already share, per-message deniability, quorum unlock, and Tor by choice — on Android? That is the gap YGOOW was built for.

Your key, your rules — everything else is redacted.