01
Device to device
When you and your contact are both online, messages travel straight between your devices. There is no server in the middle to read, keep or lose them.
01 · On the wire
Type anything. The relay sees 16 KB of noise.
Every message is padded to the same size before it is sealed, so a relay or anyone on the network learns nothing from length. Not even whether you said yes.
0Bytes you typed
0Characters
The relay sees
Ciphertext0Bytes on the wire
SameSize as an empty message
Your contact reads
DecryptedWaiting for a message.
This demo pads exactly as Straylight does, then seals with AES-GCM in your browser so you can watch the shape of it. Straylight itself agrees keys with X25519 plus ML-KEM-768 and seals with XChaCha20-Poly1305. Nothing you type leaves this page.
02 · How it stays yours
Direct when it can. Blind when it can’t.
Three decisions do most of the work. None of them asks you to trust a company, including us.
01
02
Blind relays
If your contact is offline, a relay holds the message: padded ciphertext under an address that changes every day. It can’t tell who sent it, who it’s for, or what it says. Anyone can run one.
03
Two locks on every key
Each key exchange pairs X25519 with ML-KEM-768, and each signature pairs Ed25519 with ML-DSA-65. Breaking one gets an attacker nothing. Keys renew every time the conversation turns.
03 · Verify, don’t trust
Sixty digits instead of a phone number.
Your identity is a keypair on your device. To know you’re talking to the right person, you compare a safety number with them once, in person or on a call. It covers the post-quantum keys too, so a swapped key can’t hide.
Safety number · Example
Verified
398932910472192870975942516099413027596257928244844939180499
04 · Where we’re at
The protocol is built. The apps are next.
Straylight is built in six stages. The first is done: the shared core every app will run on, with a relay and a reference client to prove it end to end.
Protocol core
Built · Sep 2026Real network
Now- 3
Windows app
Next - 4
Groups and files
Planned - 5
Calls and devices
Planned - 6
Audit and beta
Planned
Shipped
- M1September 2026
Protocol core
A hybrid handshake that hides the sender from the relay, a double ratchet with a post-quantum step at every turn, padded envelopes and encrypted storage on the device.
- RelaySeptember 2026
The blind relay
A small mailbox server anyone can run. Everything in memory, nothing logged; a message is gone once it is fetched, or after 14 days.
- ClientSeptember 2026
Reference client
Direct peer-to-peer chat and relay delivery from one code path, with safety-number verification and a working end-to-end demo.
- DesignOctober 2026
Night Valley
One look for this site and the apps: near-black and warm sand, an editorial serif over a light grotesk, one ember accent, moss only for “verified”.
- 13protocol tests passing, including replay, tampering and forged invites
- 16,384bytes on the wire for every message, long or short
- 0accounts, phone numbers or relay logs
05 · Where we’re going
Roadmap
The current direction, not a promise. Each stage ships on its own, and nothing is called ready for real secrets until an outside audit says so.
NowReal network
- Peer to peer over QUIC. Hole punching through home and office routers, so most messages never touch a relay.
- Post-quantum to the relay. The link to a relay gets hybrid protection too.
- Fresh keys for first contact. One-time prekeys, and signed keys that roll over every few weeks.
- Hidden headers. Ratchet keys and counters encrypted, so messages can’t be linked on the wire.
- Verified cryptography. Formally verified ML-KEM and ML-DSA, and every parser fuzzed.
NextWindows app
- Windows first. A native desktop app on the shared core.
- Keys in the TPM. The database key lives in Windows’ own key store, not a password file.
- QR invites. Scan to add someone; the full invite is fetched and checked against their fingerprint.
- The safety-number screen. Compare sixty digits or scan a code; a changed key stops the chat until you look.
ThenEverywhere
- Group chats. MLS, the open standard for group encryption, with a post-quantum suite.
- Files and images. Encrypted per file and sent in pieces, with photo location stripped first.
- macOS, Linux, iPhone and Android. The same core, one app per platform.
- Silent wake-ups. Phones learn that something arrived, never what or from whom.
LaterExploring
- Voice and video. Direct calls with end-to-end encrypted media.
- Every device, one identity. Laptop and phone, cross-signed.
- Tor mode. Hide your address from relays and contacts.
- Archiving for regulated teams. Kept on the organisation’s own devices, never readable in transit.
- Audit and public beta. Formal proofs of the handshake and an outside review first.
06 · Fixed points
What won’t change.
No accounts. You are a keypair on your own device. No phone number, no email, nothing to sign up for.
Servers can’t read you. Relays hold padded ciphertext under addresses that change daily, then forget it.
Two locks, always. Every key is classical plus post-quantum. Breaking one is never enough.
Run your own relay. It’s one small program. Host it yourself, or use ours; either way it learns nothing.
Status
Pre-release, and honest about it.
The protocol core is built and tested; the apps come next. Until an outside audit is done, Straylight isn’t for real secrets, and this page will say so.