Security
What this protects, and what it does not.
The audience for a product like this is exactly the audience that will check. So this page is written to be checked: the weaknesses are on it, in the same size type as the strengths.
What holds up
End-to-end encryption with forward secrecy
Keys change as the conversation moves, so compromising a device today does not hand over everything said before it. The message layer is a hybrid post-quantum key agreement — a classical curve and a lattice scheme together — chosen so that traffic captured today is not trivially decryptable by a future quantum computer.
Storage on your device is encrypted
The daemon’s database is encrypted at rest, and the demonstration script proves it the only honest way: it searches the receiving daemon’s raw files for the plaintext of a message that was definitely delivered, finds nothing, then runs the same search against a file that does contain the string to show the search itself works.
No account, no sign-up, no phone number
Nothing identifies you to Nex itself: no phone number, no email address, nothing to register. That also means there is no password reset — if you lose your keys and your recovery phrase, the data is gone, and it is not recoverable by anyone, including us. That is the cost of there being no escrow. The one list that can exist is the opt-in mailbox directory, which is under "What does not" below rather than here.
Automation is gated, and revocable instantly
An agent holds a scoped, expiring token that a human signed for, kept in memory and never written to disk. Revocation takes effect on the next call rather than at the next expiry.
What does not
None of these are things we intend to quietly fix and stop mentioning. Three of the six are permanent; one is waiting on an audit, and two are switches that are off until somebody deliberately throws them.
The cryptography has not been externally audited
It is original work — a hybrid post-quantum handshake and a ratchet written for this project, not a wrapper around an audited library. An external protocol review is planned and budgeted, and it has not happened. Until it does, treat the strength of the construction as unproven regardless of how carefully it was built or how many tests it passes.
A compromised device is game over
Encryption protects messages in transit and at rest. It does nothing about malware with your permissions, someone reading your unlocked screen, or a backup you made yourself. No design here changes that.
Metadata is reduced, not eliminated
When a mailbox is involved, its operator can see that a queue received something, how big it was, and when. The mitigations are real — padding, deletion on acknowledgement, a fourteen-day ceiling, no logging of queue identifiers — but "the operator learns nothing" would be false, so we do not say it.
Push notifications involve Apple
A phone cannot be woken without going through the platform’s push service. It learns that something arrived for a device, never what. That is unavoidable on iOS and it is stated here rather than buried.
A mailbox can be configured to publish an opt-in directory
It exists so a stranger on the same mailbox can send you a pairing request without either of you already holding a card. A listing is a random handle, a label of up to 32 characters that you type, and an expiry of at most 24 hours — no queue identifier, no key, nothing derived from either. It is off unless the operator switches the service on and you then switch yourself on; a mailbox with it off answers a request for the directory with a 404, indistinguishable from a build that never had the feature. What it costs is stated below, because it is a real cost and not a solved one.
Local discovery is visible to the network you are on
Switch it on and Nex announces itself over mDNS so devices in the same building can find each other. The announcement names nothing — no account, no key, no identifier that survives leaving the network — and the value in it is redrawn every fifteen minutes. What it cannot hide is that a Nex device is here: an announcement has to carry an address to be answerable, so anyone listening on that network links every rotation by address without ever reading the name. Rotation buys you the next network, not this one. It is off until you turn it on, and the browser cannot do it at all.
If you run the default mailbox, we are your service provider
That comes with obligations, and pretending otherwise would be its own kind of dishonesty.
Operating a mailbox that accepts a stranger’s ciphertext makes the operator a service provider in the eyes of several regulators: a contact point for legal requests, a published risk assessment, transparency reporting, and a process for handling law-enforcement demands. The answer to most such demands is structurally the same — the content is sealed and is deleted on delivery, so there is nothing to produce. The levers that do exist are quota, expiry and blocking a queue. There is no content moderation, because content moderation would require being able to read the content.
Turning the directory on changes that answer, and it is the only thing on this page that does. A mailbox offering a directory holds a current list of labels its users typed, which is personal data in a way an opaque queue identifier arguably is not — it is producible, it is subject to access and erasure requests, and it is a thing a demand can name. An operator who enables it is taking on obligations that switching it off would not have created, and should read the self-hosting page before doing so.