P2P · End-to-end encrypted · Android

Encrypted.
Peer‑to‑peer.
Yours.

SecureComm is a P2P-first encrypted messenger. Messages, calls, and files flow directly between devices over WebRTC — no relay reads them, no server stores them. Your keys never leave the device.

Install for Android

securecomm-….apk·— MB

Sideload APK · Android 9.0+ · arm64-v8a default

Other ABIs: arm64 · armv7 · x86_64

What you get

Built for people who don't want to trust a server.

01E2E

End-to-end encrypted

Per-message forward secrecy via Double Ratchet. AES-256-GCM bulk. ECDSA-signed envelopes. Audited primitives only.

02P2P

Peer-to-peer first

Direct WebRTC DTLS between devices. Signaling and relay only carry blobs they can't decrypt. Falls back gracefully behind NAT.

03PQ

Post-quantum hybrid

ML-KEM-768 layered with classical ECDH so today's traffic stays safe even if quantum hardware lands tomorrow.

04Yours

Recoverable, not custodial

Hardware passkey recovery via WebAuthn. No central key escrow. Lose your device, keep your identity.

Cryptography

Open primitives. Zero trust required.

Key exchange: ECDH P-256 ML-KEM-768 hybrid (CRYSTALS-Kyber)
Per-message secrecy: Double Ratchet (Signal protocol) AES-256-GCM · 12-byte nonce
Group fan-out: Sender-key · HMAC-SHA-256 chain AES-256-GCM per message
Signatures: ECDSA P-256 per-envelope Ed25519 account-recovery proof
Key derivation: HKDF-SHA-256 PBKDF2-SHA-256 300k iters (vault)
Recovery: WebAuthn passkeys · hardware-bound Ed25519 · BIP-39 mnemonic derived

Installing

Three steps. No store, no ads, no telemetry.

Download the APK

Tap Install for Android above on your phone. The browser will ask if you want to keep the file — accept.

Allow sideload

Open the downloaded APK. If Android blocks it, grant Install unknown apps for your browser, then retry.

Open SecureComm

First launch creates a fresh identity. Pair a passkey in Settings → Recovery to restore on any device.

Verify before installing

Trust math, not us.

integrity manifest · live from /android/latest.json

Version: — · build —
APK URL: —
SHA-256: —
Signing cert: 24:DD:02:09:D8:0D:C5:0D:5A:75:F2:03:98:6A:FA:40:11:FB:F8:90:6D:B0:75:25:4E:96:2F:C0:7D:60:B2:51

# verify after download
$ shasum -a 256 securecomm-*.apk
# expected:
$ —