Ultra-secure messaging with zero compromise on privacy.

Website • Security • Privacy Policy • Open Source

Hash is a messaging app built for people who take privacy seriously. No phone number, no email, no personal data required — just install and start messaging.

Every message is end-to-end encrypted using the Signal Protocol (Double Ratchet), wrapped in a Sealed Sender envelope so even the server doesn't know who's talking to whom. Messages are deleted from the server the moment they're delivered.

• Total Anonymity — No phone number, no email. One device = one account.
• Zero Trace — Messages are deleted from the server after delivery confirmation. 24h max retention.
• End-to-End Encryption — Signal Protocol (Double Ratchet) + Sealed Sender for metadata protection.
• No Recovery by Design — If you lose your device, your data is gone. That's a feature.
• Panic Mode — Instantly wipe all data with a duress PIN or panic button.

• Text, images, videos, voice messages, files, contacts & location sharing
• Ephemeral messages with configurable timers
• View-once media
• Message reactions, replies & editing
• Delete for everyone
• Typing indicators
• Read receipts

• Encrypted voice & video calls via LiveKit
• P2P when possible, relay when needed
• E2E encryption derived from Signal Protocol identity keys

• PIN + Biometric authentication
• Duress PIN (enters a fake empty state or wipes data)
• Configurable max PIN attempts (lock or destroy)
• Screenshot protection (FLAG_SECURE)
• Shake-to-lock
• BIP-39 recovery phrase
• Security number verification (QR code)

• Sealed Sender (server can't see sender identity)
• Message padding to hide content length
• Anti-replay counters
• Certificate pinning
• No analytics, no trackers, no ads

• Encrypted personal notes with rich text editor
• Optional password protection per note

• 13 alternate app icons
• 14 notification sounds
• Dark theme (default)
• 60+ languages

├── hash/                    # Flutter app (iOS & Android)
│   ├── lib/
│   │   ├── config/          # Environment-based configuration
│   │   ├── core/
│   │   │   ├── network/     # Certificate pinning
│   │   │   ├── services/    # Business logic (Signal, crypto, calls...)
│   │   │   └── theme/       # Design system
│   │   ├── data/            # Repositories
│   │   ├── domain/          # Models (Hive for local storage)
│   │   └── presentation/    # Screens, widgets, providers (Riverpod)
│   └── assets/              # Icons, sounds, fonts
│
└── supabase/                # Backend
    ├── config.toml          # Supabase project configuration
    ├── migrations/          # PostgreSQL schema & RLS policies
    └── functions/           # Edge Functions (Deno/TypeScript)
        ├── _shared/         # Auth validation & rate limiting
        ├── send-sealed-message/
        ├── register-user/
        └── ...              # 35+ Edge Functions

Users cannot write directly to the database. All mutations go through PostgreSQL security-definer functions and Edge Functions with:

• Custom session validation (not Supabase JWT)
• Per-endpoint rate limiting
• RLS policies (SELECT only on own data)

Plaintext
  → Signal Protocol (Double Ratchet encryption)
    → Sealed Sender (XEdDSA signature + AES-GCM envelope)
      → TLS (transport)
        → Server (can't read anything)

• Flutter 3.29+
• A Supabase project
• A Mapbox account (for map tiles)
• A LiveKit server (for calls)
• Firebase project (for push notifications)

git clone https://github.com/devolim/hash.git
cd hash

cp hash/.env.example hash/.env
cp supabase/.env.example supabase/.env
cp supabase/functions/.env.example supabase/functions/.env

Edit each .env file with your own credentials.

supabase start
supabase db push

cd hash
flutter pub get
flutter run --dart-define-from-file=.env

Place your Firebase config files (not included for security):

• hash/android/app/google-services.json
• hash/ios/GoogleService-Info.plist

Contributions are welcome! Whether it's bug fixes, new features, translations, or security audits — every contribution matters.

1. Fork the repository
2. Create your feature branch (git checkout -b feature/amazing-feature)
3. Commit your changes (git commit -m 'Add amazing feature')
4. Push to the branch (git push origin feature/amazing-feature)
5. Open a Pull Request

If you discover a security vulnerability, please report it responsibly to hash-security@devolim.fr. Do not open a public issue.

This project is licensed under the GNU Affero General Public License v3.0 — see the LICENSE file for details.

• Email: hash-support@devolim.fr
• Abuse: hash-abuse@devolim.fr

Your messages. Your privacy. No compromise.