A fully encrypted, serverless messenger.
No accounts. No phone numbers. No servers. Online and offline.
▶ Open the web app · ⬇ Download the Android APK · ⬇ Get‑started PDF
SGPChat is an end‑to‑end encrypted messenger with no accounts and no central server. You share a link, your contact opens it, and you chat directly — your phone is the node. Because there is no server, no one in the middle can read your messages. Not a hacker, not a server, not even us.
It works online (peer‑to‑peer over WebRTC) and offline (Bluetooth mesh, Wi‑Fi Direct, QR codes, even sound). You can also pair an SGP Card Mini and reach kilometers over LoRa.
| Explainer (90s) | Reel · Encrypted | Reel · "Secret messages" |
|---|---|---|
 |
 |
 |
(Click a thumbnail to download/play the video.)
- 🔒 End‑to‑end encrypted messages, voice calls, video calls, photos and files.
- 🔗 No account, nothing to download. Share a link, open it in a browser, start chatting. Install it to the home screen in one tap, or get the full Android app.
- 📴 Works offline: send by QR code, by sound (acoustic modem), or over Wi‑Fi Direct — no internet needed.
- 📡 Bluetooth mesh & LoRa: hop phone‑to‑phone over a BLE mesh (bitchat‑style, up to 7 hops), or pair an SGP Card Mini for kilometers over LoRa.
- ⏱ Auto‑delete messages on a timer, PIN lock, and a calculator decoy that hides the app behind a secret code.
- 👥 Groups with an optional member limit; single‑use 1:1 chat links.
- 💸 Completely free, no ads, nothing tracked.
- Identity: Ed25519 (signing) + X25519 (key agreement), generated on device, never leaves unencrypted.
- 1:1 chats: simplified X3DH + Double Ratchet (forward secrecy + post‑compromise healing).
- Groups: per‑sender keys with a symmetric ratchet, each message signed.
- Offline / sessionless (QR, sound, BLE, LoRa): sealed envelopes (ephemeral X25519 → XChaCha20‑Poly1305, signed Ed25519).
- At rest: IndexedDB encrypted with a device key (optionally wrapped by a PIN via scrypt).
- Signaling for the online P2P uses public relays (Nostr/MQTT/BitTorrent via Trystero) that only carry the encrypted handshake; message data goes directly between phones.
Web (no download): open https://sgpcard.com/sgpchat/, then install it from your browser menu → Install app / Add to Home Screen. It works full‑screen and offline, like a native app.
Android (full version with Bluetooth mesh): download SGPChat.apk, open it on your phone and allow Install from unknown sources.
A one‑page get‑started PDF (link + QR + steps) is in the latest release.
npm install
npm run dev # http://localhost:4890
npm run build # production build in dist/
./build-apk.sh # web build → Capacitor → signed Android APKRequires Node 18+. The APK build uses a local JDK 21 + Android SDK (see build-apk.sh). Signing keys are not in this repo.
firmware/SGPChat_LoRa_Bridge.ino turns an SGP Card Mini (ESP32‑S3 + SX1262) into a Bluetooth↔LoRa bridge, so the app can send encrypted messages over LoRa (868 / 915 / 433 MHz). Arduino IDE + RadioLib + NimBLE‑Arduino + Adafruit NeoPixel.
src/ web app (Vite, vanilla JS)
crypto.js identity, Double Ratchet, sender keys, sealed envelopes
net/online.js peer‑to‑peer rooms (Trystero)
transports/ ble.js · lora.js · lan.js · qr.js · sound.js · envelope.js
ui/ screens and sheets
android/ Capacitor Android project (+ native SgpMesh / SgpLora plugins)
firmware/ SGP Card Mini LoRa bridge
SGPChat is provided for private, lawful communication. Audit the code before relying on it for high‑risk use; it has not undergone a formal third‑party security audit.
MIT © SGP — see LICENSE.