End-to-end encrypted messaging with no phone number, no email, and no account — just an identity key you keep to yourself. Private one-on-one chats and large group conversations, encrypted and ephemeral by default.
TunnelTalk is for anyone whose conversations cannot afford to be intercepted, retained, or attributed. No account, no phone number, no metadata trail.
Talk to sources without leaking who they are. No phone number to subpoena, no account to seize, no server-side history to hand over.
Coordinate under hostile networks. End-to-end encryption hides what is being said; ephemeral storage means there is nothing to find after the fact.
Discuss vulnerabilities, coordinate disclosure, and share findings on a channel that doesn't persist your work for later.
Legal, medical, and executive conversations that need real confidentiality — not vendor-trust, not policy-trust, math-trust.
Identity keys instead of accounts. Noise Protocol end-to-end encryption. Memory-only message history. Group chats that scale. Anti-leak posture by default. Every feature exists to keep one promise: nobody but the people in the conversation ever sees it.
tt1: token fits in an SMS or emailFLAG_SECURE blocks system screenshots and recents thumbnailsThree layers, each doing one job. Identity keys prove who you are. Noise sessions encrypt what you say. The relay routes without ever reading the content. None of them depend on TunnelTalk being trustworthy — that is the point.
Long-term Ed25519 + X25519 keypair generated locally on first launch. Encrypted at rest with your passphrase under Argon2id and stored in IndexedDB. The public-key fingerprint is the only thing you ever share. There is no account on any server.
Each DM runs a Noise IK handshake between the two identity keys, producing forward-secret session keys. Every message is sealed with XChaCha20-Poly1305 before leaving your device. Group messages use a shared symmetric key with a random nonce per message. Keys live in memory only.
Encrypted bytes are routed through a WebSocket relay that acts as a dumb forwarder — it sees routing headers only, never content. The relay cannot decrypt anything. I2P transport for full network anonymity is on the roadmap as a future upgrade layer on top of the same crypto.
Privacy software has a culture of overclaiming. We won't. These are the honest limits of what TunnelTalk can do right now — documented up front so you can decide whether the tradeoff is acceptable.
Browsers have no API to block OS-level screen capture. We watermark the view with the viewer's fingerprint to make a leaked image identifiable, but we cannot stop the capture itself. If screenshots matter, use the Android app.
Anything that runs on your device can be read. We minify and ship clean release builds to raise the cost of reverse engineering, but the security is in the protocol, not in source secrecy.
The current release routes messages through a WebSocket relay. The relay cannot read content, but it can see routing metadata. Full I2P transport that hides who is talking to whom is on the roadmap. We will not claim anonymity we haven't built yet.
If the device is rooted, key-logged, or under malware, no encrypted messenger saves you. TunnelTalk minimises damage with passphrase locking and ephemeral storage, but it cannot replace endpoint security.
Two ways to run TunnelTalk. The same protocol, the same encryption, the same UI — with the strongest anti-leak posture each platform can actually deliver.
Open directly in any modern browser. No install required. Works on any device with a browser. Screenshot prevention is watermark-only on web.
Live — v0.0.2Native APK. FLAG_SECURE blocks system screenshots and recents thumbnails. Strongest anti-leak posture. Android 7.0+ required.
No account. No phone number. No metadata trail. Identity keys, end-to-end encryption, and group chats — the way private messaging should have been from the start.
v0.0.2 — Web and Android available now. I2P transport coming soon.