Private apps that prove every claim.
In development · Dead Safe Vault first, then Messenger · Android first
No phone number. No email. No account. Pay with cash if you like. And instead of promising you something no app can deliver, we publish a test for every claim and a list of every limit.
Dead Safe Vault Coming first
A vault on your phone for photos, videos, documents and notes. This is what we are building it to do. None of it is a claim yet: each point moves to the security page only when a test in the code proves it.
- Guesses have to happen on your phone. Your vault key mixes your secret with a key held in your phone's security chip, which can't be copied out. Someone with a copy of your storage can't test guesses on their own computers.
- The storage doesn't say what's inside. Everything lives in one container of identical, padded blocks, so it doesn't reveal how many files, or how many vaults, you have.
- A second vault for forced unlocks. A different secret opens a separate, working vault.
- Photos that never touch your gallery. The vault's camera saves straight into the vault.
- Backups you control. One encrypted file you keep wherever you like. No cloud account needed.
- Nothing sent to us. No account, no analytics, no crash reports.
Dead Safe Messenger Next
End-to-end encrypted messaging with nothing to identify you.
Nothing to identify you
Your account is a 12-word phrase created on your device. Our servers never receive your identity key, your name or your contacts.
Built for the long term
Every conversation starts with hybrid X25519 + ML-KEM-768 key agreement, and every reply refreshes the keys with both again. That protects against “record now, decrypt later with a quantum computer” attacks for the whole conversation, not just its start.
Pay without a paper trail
Pay with cash in an envelope. The licence is collected with a secret only you hold, so the payment never connects to you.
If you are forced to unlock
A second passphrase opens a separate, working profile. Someone examining one copy of your storage can't tell whether you set one up.
Get told when it's ready
Dead Safe Vault launches first, on Android through Google Play, followed by Dead Safe Messenger, then iPhone. Both ship as installed apps rather than websites: an app downloaded from a server each time you open it can be silently swapped for a different one, while an installed app can be checked against its published source code.
What we keep: your email address, which apps you ticked and the month you signed up. No IP address, no cookies, no tracking. We email you once when each app you ticked is available, then delete your address. To be removed sooner, write to hello@deadsafe.org. This address is never connected to the app itself, which has no accounts.
What has to be true before each launch
Vault:
- Every point above backed by a passing test, with its limits published. In design.
- Android app with reproducible builds, so anyone can confirm the app matches the source code. In progress (shared with the messenger).
- An independent security audit, published in full with our fixes. Planned.
Messenger:
- Post-quantum protection on every key update, not just at the start of a conversation. Done.
- Your IP address hidden from our servers. Next.
- Android app with reproducible builds, so anyone can confirm the app matches the source code. In progress.
- An independent security audit, published in full with our fixes. Planned.
Why “proves”?
Security marketing is full of words like “unbreakable” and “military grade” that mean nothing and can't be checked. Dead Safe takes the opposite approach. Each statement below about the messenger is linked to an automated test in our source code (published before launch); if a test ever fails, the build fails and the claim can't ship.
- No phone number, email address or name is needed to use Dead Safe. Your account is a 12-word recovery phrase created on your device.
- Our servers never receive your identity key, your name or your contact list. Even the first message that connects two people is sealed, so its contents don't reveal who sent it. (The server still sees the IP address a message comes from; see the limits.)
- Messages are end-to-end encrypted with the Double Ratchet algorithm (the design used by Signal). The classical building blocks (X25519, Ed25519, XChaCha20-Poly1305, SHA-256, Argon2id) come from open-source libraries that have had independent security audits. How Dead Safe combines them is our own protocol code, which has not been audited yet.
- Post-quantum protection throughout the conversation: every conversation starts with hybrid key agreement (X25519 plus ML-KEM-768, the NIST standard), and every time the conversation changes direction the keys are refreshed with a new X25519 exchange and a new ML-KEM-768 exchange together. To read recorded traffic, an attacker would have to break both X25519 and ML-KEM-768; ML-KEM-768 is designed to withstand quantum computers, as NIST's standard sets out.
- Forward secrecy: someone who steals your device's current keys still cannot decrypt messages your device has already received. (As in every Double Ratchet app, keys for messages that arrived out of order are kept until those messages arrive.)
- Altered or replayed messages are rejected.
- Invitations are signed by the identity they contain, so changing where a conversation is delivered breaks the invitation. A signature can't prove who sent you an invitation; comparing safety numbers does, and the app marks every contact as not verified until you do.
- You can compare a safety number with each contact to confirm no one is intercepting your conversation.
- Each conversation uses its own private delivery queues. Only you can read your queue, and once two people are connected, only your contact can post to it.
- Messages are padded in 256-byte steps, so the server sees only a rough size, never the exact length.
- The server records message arrival only to the nearest minute, deletes each message as soon as your app confirms it has it, and deletes uncollected messages after 14 days.
- Dead Safe never accepts card numbers. Pro can be paid for with cash by post. Your device claims the licence by signing with a key that never leaves it, and it doesn't even ask until the cash has arrived.
And here is what we cannot protect you from yet.