Discrio
8192 B
It reaches only the person you write to.
An encrypted messenger with no account, no phone number and no directory. Two people connect by scanning a code. What passes through the server are blocks with no meaning, deleted once they arrive.
Don't take our word for it. Look at the bytes.
Tap the number under any message and the app shows you exactly what left the phone: the real block, in hexadecimal, as the server received it. It is there so you can check, not so you take our word for it.
Your text is padded to 4096 bytes and then encrypted, so the length of the ciphertext says nothing about how much you wrote. The final block is always 8192 bytes, whatever the message. A one-word answer and a long confession are the same size on the wire.
Most of the security is what isn't there.
Every field a messenger keeps about you is a field that can be demanded, leaked or sold. These are missing on purpose, and each absence is a decision we will defend.
- Account
-
None
No phone number, no email, no username. The keys are made on the phone the first time it opens, and never leave it.
- Directory
-
None
Nobody can find you by searching, because there is nowhere to search. A stranger cannot reach you at all — they would need a code you handed them.
- Server
-
Blind
It holds fixed-size encrypted blocks at random queue addresses, deletes them on delivery, and expires the rest. There is no user table, so there is nothing in it to steal. You can point the app at your own server instead.
- Metadata
-
Not collected
No read receipts, no typing indicators, no link previews, no profile, no avatar. Each one is a signal about you, and none of them is worth it. A message you sent does say when it reached their phone — said by their phone, about a block it decrypted. Arrived, and never read: when somebody looked at their screen is theirs to know.
- Searching
-
On the phone only
Finding something in a conversation touches no network and asks nobody anything. It also refuses to filter a covered conversation, because a list that shortens as you type shows as much as the text itself — including to whoever is standing behind you.
- Notes to self
-
Sync to nowhere
A conversation with nobody but you, in the same encrypted vault. Somewhere to put a thing you need later that is not a notes app on somebody else's servers.
- Backups
-
None
Lose the phone and you lose the history. There is no "forgot my passphrase" either, because we keep nothing it could be rebuilt from. That is the cost of holding nothing anywhere else, and we would rather charge it than pretend.
- Notifications
-
Content-free
The push carries nothing to read; your phone fetches and decrypts the message itself. Apple learns that you received something and when — not from whom, and not what it says. On iPhone there is no other way, and anyone who tells you otherwise is selling something.
- Encryption
-
PQXDH + Double Ratchet
X25519 combined with Kyber-1024, so a session recorded today still holds up against a quantum computer later. The cryptography is libsignal — the same audited library Signal ships. We did not invent any of it, which is the point.
And when you want no server at all.
If the other person is in the room, the message goes straight from phone to phone. Nothing leaves the room: no server sees the time, the size, or that you spoke at all.
With internet, the message also goes through the relay so it still arrives if they walk out of range. The room is always tried first; the relay is the safety net.
A screenshot comes out blank. A camera is a harder problem.
Screen capture, recording and mirroring are blocked, and they are blocked for both of you or neither — your messages are on the other person's phone too, so a choice only one of you makes protects nothing. A lens pointed at the screen is a different matter, and no app can stop it. This is what we do instead.
You read from above. A lens across the table looks in from below, where the window sits in the shadow of your own finger. Use your little finger — it covers less of the screen, so you see more of it.
This is deterrence, and we are not going to call it anything else. It turns a photograph of a conversation into a photograph of one word.
- Against camera
-
One word at a time
You read from above; a lens across the table looks in from below, where the window sits in the shadow of your own finger. Use your little finger — it covers less of the screen, so you see more. A photograph catches one word, not the conversation.
- Ghost
-
Opens once
It burns if they take a screenshot, if they start recording, and if they leave the app while it is open. A photo sent this way can never be captured, whatever either of you has allowed.
- Watermark
-
Optional
The phone's name sits faintly behind the conversation. If a screenshot of it ever surfaces, it shows which phone it left from.
- Wording
-
Not quite my words
Optional rephrasing on the way out. Whoever reads it understands perfectly — what goes is the ability to hold up a screen and say "look what they wrote". Numbers, times and addresses are left untouched.
Every other app protects the network. This one also protects the moment.
Encryption answers the question "who is listening?". It has nothing at all to say about somebody standing in front of you, holding your phone, telling you to open it. That moment is the one people are actually afraid of.
You choose two passphrases. One opens your conversations. The second opens an app that looks exactly the same, with different conversations in it — ordinary, dull ones. You can write in the second one and add contacts to it; what you put there stays there, and that is what makes it believable.
Nothing gives away which one you used. No alarm, no notification, not one second of delay — otherwise it would put you in danger at exactly the moment you needed it.
Verification you perform, not a badge we award.
Every conversation has a number derived from both people's keys. Read it aloud to each other, or scan it. If the numbers match, nobody got in between — and an attacker who had intercepted your invitation would have different numbers, which you would see.
If the other person's key ever changes, sending stops until you say it is alright. The app shows a seal rather than a padlock, because a padlock asserts security and a seal reports whether this particular contact has actually been verified.
What you can still do after you press send.
- Disappearing
-
On by default
Seven days unless you change it, anywhere from thirty seconds to four weeks, set per conversation.
- Scheduled
-
Cancel before it leaves
The message waits in the encrypted vault on your phone and is not sealed until its hour comes. The server learns nothing about it — not that it exists, not what it is for. Until it leaves, cancelling means nothing happened.
- Withdraw
-
From both phones
Hold a message and take it back: the text, the photo and the stored ciphertext go from both phones, and a line saying a message was withdrawn takes their place. Like everywhere else that offers this, it works because the other copy of the app obeys — a screenshot already taken cannot be recalled.
- Delete
-
From this phone
Removes it here and leaves theirs alone, for when the problem is your phone rather than the message.
- Correct
-
And it says so
Change the words of something you already sent — an address, a time, a name. The old wording is replaced rather than kept beside the new one, because a messenger that shows both has decided that what you first wrote is a matter of record. Both phones do show that the message was changed, so nobody can quietly rewrite what they agreed to.
- Answer one
-
Drag it aside
Reply to one message in particular and it is quoted above yours, the way you would expect. Or answer without writing at all: four short marks — got it, yes, no, I don't understand — each shown with its word in your own language rather than left as a symbol to work out.
- Languages
-
17
Including the permission dialogs, which is where most apps quietly give up and show you English.
Questions people ask first.
Does Discrio need a phone number?
No. There is no account of any kind — no phone number, no email, no username. The keys are made on your phone the first time it opens, and they never leave it.
How do two people connect?
One of you shows a code and the other scans it, or one sends a single-use invitation link that expires after 24 hours. Nobody can find you by searching, because there is no directory to search.
What can the server see?
Fixed-size encrypted blocks at random queue addresses, deleted once they arrive. No accounts, no contact lists, no message content, and no record of who spoke to whom. You can run your own server instead.
What encryption does Discrio use?
libsignal, the library Signal ships: PQXDH — X25519 combined with Kyber-1024 — for the handshake, and the Double Ratchet for the session, so a session recorded today stays closed to a future quantum computer. Tap the byte count under any message and the app shows you the actual block that left the phone.
Can someone screenshot my messages?
Screen capture, recording and mirroring are blocked, and the setting applies to both phones or neither. A camera pointed at the screen cannot be prevented by any app; against-the-camera mode covers the conversation and opens about one word at a time under your finger, so a photograph catches a word instead of a conversation.
Does Discrio tell the other person when I have read a message?
No, and it is not a feature waiting to be added. Your phone tells the sender when a message arrived on it, which is a fact about delivery. When you actually looked at your screen is yours to know, and a messenger that reports it has decided otherwise on your behalf.
What if someone forces me to unlock it?
You choose a second passphrase that opens an app which looks exactly the same, with different, ordinary conversations in it. Nothing gives away which one you used — no alarm, no notification, no delay.
Is Discrio free?
Yes. There is nothing to buy and nothing to subscribe to.
What happens if I lose my phone, or forget my passphrase?
The history is gone. There are no backups and no password reset, because nothing is kept anywhere that could rebuild them. That is the cost of the server holding nothing.
Is there a messenger that does not need a phone number?
Discrio is one. There is no phone number, no email, no username and no account at all. You connect by showing someone a code in person or sending a link that works once and expires in 24 hours. Nobody can look you up, because there is no directory to look in.
How is Discrio different from Signal?
Signal needs a phone number and holds an account for you. Discrio holds neither, which removes the thing that can be demanded — and costs what accounts buy: no second device, no desktop app, no history carried to a new phone, and no recovery. Both use libsignal for the cryptography, so the difference is the architecture rather than the mathematics.
What happens if someone takes my phone and makes me open it?
You give them the second passphrase. It opens an app that looks identical, holding ordinary conversations, and nothing on the screen says which passphrase was typed — no alarm, no notification, no delay. An optional third passphrase destroys everything first, then opens that same quiet app.
Does it work without an internet connection?
Yes. Two phones in the same room hand each other the same encrypted blocks directly, over Wi-Fi or over the radios, so a conversation still works with the connection cut off entirely and nothing leaves the room.
Has Discrio been audited?
Not yet, and nothing here should be read as though it had been. The source is public under AGPL-3.0 and the cryptography is libsignal unmodified, pinned to an exact commit — but no independent security audit has been published, and until one is, no security claim about this app should be taken as established. That includes ours.
8192 B