Built from the ground up to protect you, with multiple layers of defense. Here is exactly how it works.
Every direct message is wrapped in both Curve25519 and post-quantum ML-KEM-768 (NIST FIPS 203). An attacker has to break both. Group chats use classical Sender Key encryption (X25519).
Curve25519 + ML-KEM-768Direct messages are encrypted with a unique per-message key derived from a continuously evolving chain, so compromising one key cannot decrypt your past or future direct messages. Group chats use a Sender Key that rotates when membership changes, rather than a new key for every message.
Identity keys, signed pre-keys, and one-time pre-keys establish a shared secret between two people even when one of them is offline.
Local data is encrypted at the field level with XSalsa20-Poly1305 (NaCl secretbox), using a random 256-bit key generated on your device at first launch. On iOS that key lives in the Keychain, marked this-device-only, so it never leaves the device and is never included in iCloud backups.
XSalsa20-Poly1305 ยท iOS KeychainNo phone number, no name, no email. Accounts use anonymous IDs, and we collect no personal information about you.
An emergency PIN that instantly and silently wipes all data from the app. It is irreversible, and it is there for extreme situations.
Voice and video calls are end-to-end encrypted. We never store call content.
Everything that leaves your device travels over TLS 1.3. Direct messages, group chats and calls travel as encrypted blobs our servers cannot read. Community posts, Stories and profile pictures are server-readable by design, so they can be shown to other members and viewers.
Your account is restored with a 12-word recovery phrase you save at signup. If you lose both your PIN and your recovery phrase, your data cannot be recovered. Not even by us.
Don't take our word for it. theSHFT's encryption core (the X3DH and Double Ratchet implementation with the ML-KEM-768 post-quantum hybrid layer) is open source on GitHub. Read the key derivation, the ratchet, and the hybrid construction yourself.
Private. Secure. Yours.
Questions about our security? Email support@theshft.app.