Let’s talk.
Just between us.
Encrypted conversations. A local vault.
No account, no cloud history, no analytics.
iPhone: Safari → Share → Add to Home Screen.
Android: Chrome → menu → Add to Home screen → Install.
Keep backups in a local folder to avoid cloud sync.
Your conversations
No active connection
Invite someone to get startedCompare this code with the other person in person or over a trusted call. Every group must match.
Both people must stay online. No background delivery.
Backups & saved conversations
Your vault, in your hands.
Encrypted on this device. Save a backup regularly.
Saved conversations
How privacy and installation work
Invite links use this site to briefly hold encrypted connection-setup data. Links expire after ten minutes; records are removed after connection/cancellation when possible, or cleaned up on the next service request after expiry. The invitation secret stays in the URL fragment and is not sent to the setup service. Anyone you share the link with can try to join. No chat messages or history are uploaded to this service.
Messages travel over encrypted WebRTC data channels. Compare the session code each time to authenticate the person at the other end. Your peer can read, copy, or save your messages and may learn your IP address. An optional relay sees network metadata and encrypted traffic, never plaintext messages. Quietlink has no server-side message history; it cannot control what an independently operated server records. This does not provide anonymity.
The vault and backups use AES-256-GCM with a key derived from your passphrase using PBKDF2-SHA-256. The passphrase is never stored. Locking clears the app’s references to plaintext and disconnects; JavaScript cannot guarantee memory erasure.
The browser stores the vault on your device, not directly in a visible folder, and may delete it. Export backups yourself and keep the passphrase separately. Restoring replaces this device’s current history. On iPhone, choose Files → On My iPhone instead of iCloud Drive. On Android, choose a local folder in Files rather than Google Drive. Device-wide cloud backups are controlled by your phone settings.
On iPhone and Android, the PWA must first load from HTTPS, then be installed on the Home Screen. Opening an HTML file from Files does not install a PWA. A Shortcut can open the installed app’s HTTPS address. Offline caching stores the client, not undelivered messages. The website host sees requests for the client and could change its code; use hosting you trust.
This is an unaudited prototype for one-to-one text messaging, not a production security guarantee. No push notifications, account recovery, group chat, or offline delivery.