PULSHADE
Anonymous, end-to-end encrypted messaging over Tor. Talk freely, and leave no trace of who you are.
Sealed twice. Sent through Tor.
Seen by no one.
Tor runs inside the app, with nothing else to install. Every message is encrypted on your phone and only opened on theirs. The relay in between is an onion service that holds random blobs until they're picked up.
The relay sees
- Padded random blobs
- A one-way send id
- That Tor connected
It never sees
- Your IP or who you are
- Who you talk to, or what
- Logs. There are none
Built so it can't tell,
not just so it won't.
Post-quantum from the start
X25519 and ML-KEM-768 together, refreshed as the chat goes on.
A fresh key every message
A Double Ratchet, the design Signal uses. Stolen keys don't open old messages.
Tor, built in
Runs inside the app from the first launch, with a circuit per persona.
Nothing you say is signed
Your friend knows it's you, but can't prove it to anyone else.
Personas and burners
Separate identities with their own keys. Burners destroy themselves on a timer.
Decoy and panic passcodes
One opens an empty account, the other shreds the real one. The disk looks the same.
Voice calls and notes
Encrypted calls over Tor. Voice notes live in memory, never in a file.
Groups, channels, stories
Owners, admins and posting rules. Photos lose their location before sending.
Disappearing messages
Reactions, typing dots, unsends and timers all travel encrypted.
One-time chats
A throwaway identity for both sides, shared as a QR code or a 12-digit code.
Pulse check
Compare ten emoji or scan each other's screen to know nobody's in the middle.
Face ID and a covered screen
Pulshade hides itself while the screen is recorded or mirrored.
Lock
Closes the vault. Everything stays encrypted on the device until your passcode or Face ID opens it.
Detach
Removes the account from this phone. Your other devices, or your recovery code, bring it back.
Burn
Every chat on both sides, every contact's memory of you, every @handle and every device. Nothing brings it back.
Recovery code
Written on paper at sign-up. It's never offered for copying, because clipboards sync and keep history.
Your network or carrier
Sees that you use Tor, not that it's Pulshade or who you talk to.
Pulshade's own relay
Holds sealed, padded blobs. Never your address, contacts or words.
Someone who copies your files
Sealed with your passcode and your phone's Secure Enclave.
Watching both ends of Tor
Tor hides addresses, not timing. That limit is Tor's, and Pulshade shares it.
The person you talk to
They can always photograph a screen.
A compromised phone
Malware on an unlocked device can read what you can.
Pulshade is new and hasn't had an independent audit yet. The full list of known limits ships with the source.
Coming to iOS soon.
Open source and built for iPhone. No account to make when it lands, just a passcode.