Security model
Honest about what we protect.
What CIPHER protects
- Message bodies are encrypted on the sender's device and decrypted only on the recipient's device.
- Authentication uses short-lived, single-use, server-issued challenges signed by your wallet and verified server-side.
- Only members of a conversation can read its records; only the recipient can read incoming handshake requests.
What CIPHER never asks for
- Seed phrases or private keys — ever. Any prompt requesting them is not CIPHER.
- Wallet signatures are used to prove ownership, never as encryption keys.
What remains visible
- Your Solana wallet address and all public blockchain activity remain visible on-chain.
- The server sees metadata: which wallets talk to each other, when, and approximate message sizes.
- CIPHER does not provide metadata anonymity.
Current status
- CIPHER V1 is pre-release software and has not been independently audited.
- Forward secrecy, key rotation and lost-device recovery are planned and will be documented as they ship.
- If encryption is unavailable for a conversation, the app will say so — it will never show a false encrypted indicator.