Say it in any chat app.
Only your friend can read it.
CamoChat turns what you write into ciphertext on your phone. Paste it into WeChat, SMS or any messenger you already use — only the person you paired with can turn it back. Text never touches a server, not even ours.
- Open source · AGPL-3.0
- Text never goes online
- No account, no phone number
CamoChatYour chat app carries it. It can't read it.
CamoChat has no channel of its own. It locks the message on your phone and hands you the ciphertext; you send that through whatever app you already use.
Encrypted here, with a key that exists only on your phone and your friend's.
Sees only a 🔒 followed by gibberish. Nothing to read, nothing to scan.
Decrypted here. A paired contact is the only one who can.
Pair once
Scan your friend's QR code or open their invite link, then check that both screens show the same 8 emoji.
Write
Chat in CamoChat as usual. Tap send and you get ciphertext, ready to share — not a message sent on your behalf.
Pass it on
Share or paste it into any chat app. Your friend taps it, sends it to CamoChat, and reads the original.
Same 8 emoji = nobody in between
Pairing swaps public keys right inside a QR code or link — no server introduces you. Both phones then derive the same secret, and show it as 8 emoji.
Trust the maths, not a promise
Our privacy doesn't rest on "we won't look". For text there is nowhere for us to look.
| Who | Can read it? | What they get |
|---|---|---|
| You and your friend | ✓ Yes | The original message. The keys live only on your two phones. |
| The chat app (WeChat, SMS…) | ✕ No | 🔒 㔲䴎㩛䂇… and the fact that you sent something. |
| The CamoChat team | ✕ No | Nothing for text: it never reaches us. For media, an encrypted file we can't open. |
| Our media relay | ✕ No | Encrypted voice/photo/video blobs, deleted within about 1–2 days. Its source is public. |
| Someone on your network | ✕ No | The same gibberish the chat app sees. |
Keys never leave your phone
Your identity is a key pair made on your device. It isn't tied to a phone number or email, and it is never uploaded.
A fresh key for every message
Each message key is derived one way from a chain and thrown away after use, so a ciphertext opens once, and keys can't be run backwards to older messages.
Big files take a short detour — still sealed
Media is too big to paste, so it is encrypted on your phone and parked on our relay as ciphertext. The chat carries only a short link, and the key travels inside your encrypted message.
Encrypts the photo with a one-off key.
Holds a locked file it can't open. Gone within about 1–2 days.
Fetches it and decrypts locally. The app marks it expired after 24 hours.
The relay's complete source is published at /source. Plain text never takes this route.
Read every line. Check every build.
The apps, the crypto core and the relay are all public under AGPL-3.0. Releases are signed, and you can check the signature yourself.
All the source
Rust core, iOS and Android apps, the relay and this site: github.com/kaitu-io/camochat.
Verify your copy
Every APK is signed with one certificate. Compare its fingerprint before you trust it.
Written-down protocol
Handshake, ratchet, wire format and emoji fingerprint are described in docs/protocol, with test vectors.
CamoChat is built and maintained by the team behind Kaitu.
Questions
Things people usually ask first.
Does my friend need CamoChat too?
Yes. End-to-end encryption needs a program on both ends that can decrypt. But neither of you has to leave the chat app you already use.
Does CamoChat send my messages?
Not text. CamoChat has no message server and text never goes online; you choose how the ciphertext travels. Voice, photos and video are the exception: they are encrypted on your phone and stored as ciphertext on our relay, and the chat carries a short link. The app marks them expired after 24 hours and the relay deletes them within about 1–2 days.
Can you read my messages?
No, and not because we promise. Text never reaches any server, ours included. Media reaches our relay only as ciphertext, and the keys exist only on your phone and your friend's.
Do I need an account?
No. Your identity is a key pair on your device. No phone number, no email, no contact upload. You name your contacts yourself.
Why does the ciphertext look like Chinese characters?
Chat apps mangle long random strings, links and unusual symbols. CamoChat packs the ciphertext into a compact run of characters that survives copy-paste through common messengers, behind a 🔒 so you can spot it.
What happens if I lose my phone?
Keys never leave the device, so there is no cloud copy to restore from. Export your recovery phrase in the app ahead of time and you can restore your identity on a new phone; otherwise pair again with your contacts.
Get CamoChat
Free, no sign-up. The Android APK is available now; the iOS app is in App Store review.
iOS
In App Store review. This button will link to the App Store once it's live.