A standalone Threema client for the desktop (Windows/macOS/Linux).

• Policies
  • Bug Reports / Feature Requests / Security Issues
  • Contributions
  • Source Code Release Policy
• Building
  • Requirements
  • Install Dependencies
  • Set Up Fonts
  • Build libthreema
  • Build binaries
  • Build and Package
• Development
  • Dev Container
  • Development Outside Dev Container
  • Starting a Dev Build
• License

To report bugs and request new features, please contact the Threema support team through threema.ch/support.

If you discover a security issue in Threema, please adhere to the coordinated vulnerability disclosure model. To be eligible for a bug bounty, please file a report on GObugfree (where all the details, including the bounty levels, are listed). If you’re not interested in the bug bounty program, you can contact us via Threema or by email; for contact details, see threema.ch/contact (section “Security”).

Contributing to Threema for desktop can be done over GitHub pull requests. See CONTRIBUTING.md for details.

This source code repository will be updated for every public release. The full commit history since the last release will be published.

• Node.js / pnpm (we recommend using something like nvm and corepack for version management)
• Python3 with distutils (for node-gyp, e.g. python and python-setuptools on Arch)
• C/C++ compiler toolchain (e.g. build-essential on Debian or base-devel on Arch)
• Rust compiler and Cargo through rustup
• For building libthreema: wasm-bindgen and wasm-opt (part of the binaryen package)

It is highly recommended to use a Linux- or macOS-based system for building and developing Threema Desktop! Building on Windows 10+ should mostly work, but not everything may work as smoothly and we cannot provide any support.

On macOS you might need to manually install and configure the C compiler toolchain in order to use node-gyp. Usually that can be done by installing the required "Command Line Tools" with the command xcode-select --install. Alternatively, you can install Xcode (note that it might take more than 1h between download and installation!) and then select a "Command Line Tools" version in Preferences > Locations. For a detailed guide and diagnostics, please refer to the "Installation notes for macOS" from the node-gyp project itself.

When building on Windows, it is important to clone the repository with symlink support. For this, you first need to enable Developer Mode. Then, run the following command to enable git support for symlinks globally:

git config --global core.symlinks true

Afterwards clone the repository as usual. (Alternatively, clone with git clone -c core.symlinks=true ... if you don't want to enable this option globally.)

First, make sure that you're using the correct Node.js version (check out the .nvmrc file). If you have nvm installed, you can simply type nvm use.

Next, install dependencies:

pnpm install

Note that this requires a C/C++ compiler toolchain due to native dependencies, as mentioned above.

When building the project or starting it in dev mode, the libthreema-wasm package will be built automatically. If you want to build it separately, run pnpm run build:packages:libthreema-wasm.

Note: To build libthreema, wasm-bindgen and wasm-opt need to be installed on the system.

To build the application for the current platform without packaging it, run:

pnpm run dist:desktop:<flavor>

Now you can find the binaries at build/apps/desktop/packaged/.

To build and package the application for the current platform, run:

pnpm run package:desktop:<flavor>

For example, to build Threema for your current platform, run:

pnpm run package:desktop:consumer-live

Now you can find the application bundle at build/out/.

Note: To build a signed package, set TURBO_PACKAGE_SIGNATURE to true, and make sure the necessary tooling for signing binaries on the respective platform has been set up.

Below we'll provide a couple of hints and rules for working on this project.

More developer docs can be found under docs/.

When developing, you should use the dev container environment to run appropriate commands inside of an isolated environment considering that any Node.js dependency can run arbitrary code and we have a ton of development dependencies.

This dev container can be used in VS Code by using VS Code Dev Container. Note that this currently requires Visual Studio Code (not Code OSS).

> Dev Containers: Reopen in Container

You will have to rebuild the Dev Container every time the dev environment script rebuilds the image. VS Code will prompt you in that case but you can also force a rebuild manually.

> Dev Containers: Rebuild Container

Alternatively, you can use the devcontainers/cli if you don't use VS Code.

Limitations:

• Cannot run pnpm run package:* commands currently, because this will try to package for Flatpak, which is currently not supported by the container's security configuration.
• Cannot run pnpm run generate:desktop:icons:* commands because it needs native MacOS tools.
• To run pnpm run update:protocol the threema-protocols repository needs to be cloned and the structbuf-typescript project needs to be installed inside the project working directory or inside of the container.

This is discouraged but unfortunately necessary on platforms other than Linux.

The project provides an .nvmrc file in case the default Node.js installation on your device is being rejected by npm install.

nvm use
nvm install

To start a dev build of Threema with hot code reloading, run pnpm run dev:desktop:<flavor> in the terminal, e.g. pnpm run dev:desktop:consumer-live.

Threema for Desktop is licensed under the GNU Affero General Public License v3.

Copyright (c) Threema AG

This program is free software: you can redistribute it and/or modify
it under the terms of the GNU Affero General Public License, version 3,
as published by the Free Software Foundation.

This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU Affero General Public License for more details.

You should have received a copy of the GNU Affero General Public License
along with this program. If not, see <https://www.gnu.org/licenses/>.

The full license text can be found in LICENSE.txt.

If you have questions about the use of self-compiled apps or the license in general, feel free to contact us. We are publishing the source code in good faith, with transparency being the main goal. By having users pay for the development of the app, we can ensure that our goals sustainably align with the goals of our users: Great privacy and security, no ads, no collection of user data!