Photon
Decentralized Messenger with Social Key Recovery
Zero servers • Rolling-chain encryption • UDP + TCP
Install
Version: Stel Stela · Updated: 2026-10-14
One-line installer downloads pre-built binaries and creates shortcuts.
Release (Recommended)
Linux/macOS/Redox:
curl -sSfL https://brobdingnagian.holdmyoscilloscope.com/photon/install-release.sh | sh
Windows (PowerShell):
powershell -ExecutionPolicy Bypass -c "irm https://brobdingnagian.holdmyoscilloscope.com/photon/install-release.ps1 | iex"
Development
Pre-release build for testing, visually tagged so it's never mistaken for release.
Linux/macOS/Redox:
curl -sSfL https://brobdingnagian.holdmyoscilloscope.com/photon/install-development.sh | sh
Windows (PowerShell):
powershell -ExecutionPolicy Bypass -c "irm https://brobdingnagian.holdmyoscilloscope.com/photon/install-development.ps1 | iex"
After install, find Photon Messenger
in your program list
(Start Menu on Windows, app launcher on Linux).
Or run photon-messenger from terminal.
Why cryptographic signatures?
Every binary is signed with Ed25519 and
self-verifies on startup. This mostly protects against data corruption (bit flips, incomplete writes, storage failures) and tampering. If even a single bit is wrong, the binary won't run—ensuring you're always running the exact code as designed. You'll also know who signed the distribution, establishing cryptographic provenance and an immutable audit trail.
Verify It
A download page that says "trust me" is a password with extra steps. Do not trust this page. Check it.
Every platform, direct
linux x86_64 ·
linux arm64 ·
windows x86_64 ·
windows arm64 ·
macos x86_64 ·
macos arm64 ·
redox ·
android
Yes, Redox. An operating system most people have never run has a build, and most billion-user messengers do not.
Every release binary carries its own signature.
The last 64 bytes are an Ed25519 signature over the BLAKE3 hash of everything before them. The matching public key is published in the source (src/crypto/self_verify.rs) and again right here, so the two channels can vouch for each other:
dff3af0c127c0bebe539c421da37993a517bfd78d2f5ee491d52fbf616444747
The quick check.
The binary verifies that signature at startup and refuses to run if it fails; photon-messenger verify runs only the check. That catches corruption and tampering. It cannot catch substitution, because a counterfeit would happily vouch for itself. That is what the next rung is for.
The independent check.
Verify the signature without running anything you downloaded. Any Ed25519 verifier works; the recipe is verify(last 64 bytes, BLAKE3 of the rest) against the key above (pip install blake3 cryptography first):
python3 - photon-messenger-linux-x86_64-release <<'EOF'
import sys, blake3
from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PublicKey
d = open(sys.argv[1], 'rb').read()
k = bytes.fromhex('dff3af0c127c0bebe539c421da37993a517bfd78d2f5ee491d52fbf616444747')
Ed25519PublicKey.from_public_bytes(k).verify(d[-64:], blake3.blake3(d[:-64]).digest())
print('valid: signed by the key published in the source')
EOF
Keys this binary trusts: 1.
The author's, the one printed above. Today, one person signs every release, and that count is stated here rather than hidden behind a company name. The plan on record is for that list to grow under democratic governance; until it does, the honest number is 1, and you deserve to know whose 1 it is.
Deepest rung.
Skip every binary on this page and build the source yourself. A source build makes you generate your own signing key and sign your own binary. Deliberate friction, because if you build it, you should know what you are signing.
Self-updates are checked the same way, automatically.
Each release ships a signed manifest (BLAKE3, size, version and commit for every binary, Ed25519-signed), and the client verifies before it ever swaps itself. You never need to read VSF by hand to verify a download; the signature on the binary is the check. The one-tap page at passless.org/photon streams these same bytes from the same store, so nothing there can drift from what the signatures cover.
See It In Action
Watch how rolling-chain encryption evolves with each message. Every message is cryptographically bound to
all previous messages—no replay attacks, no reordering,
no tampering. The chain state only advances once the
sender receives confirmation that the message was
received and decrypted successfully. Multiple messages
can be sent using the same chain state, and they're
processed in order once receipts arrive—keeping both
sides synchronized even during network disruptions.
What is Photon?
Photon is a decentralized messaging system that eliminates corporate servers, phone numbers, and centralized control. All messages are end-to-end encrypted with rolling-chain cryptography.
Peer-to-Peer
No company servers. No data centers. Messages route peer-to-peer thru distributed hash tables. Can't be shut down, can't be subpoenaed.
Social Key Recovery
Your identity is distributed as encrypted shards across trusted friends. Lose all devices? They reconstruct your identity.
Rolling-Chain Encryption
Each message affects encryption of all subsequent messages. Position-bound cryptography prevents replay and reordering attacks.
Direct P2P
Messages, transfers and calls travel directly between devices over UDP. No servers in the middle, no routing thru data centers, no third-party metadata collection.
Expiring Messages
Set custom expiration times or delete messages manually. Deleted/expired messages replaced with tombstones to preserve chain integrity.
Privacy by Default
Read receipts, typing indicators, online status are disabled by default. Features that reveal behavior or identity require opt-in.
Messaging Matrix
| Property | SMS | Signal | Telegram | Messenger | Matrix | Photon | |
|---|---|---|---|---|---|---|---|
| Authentication count | >1 | >1 | >1 | >1 | >1 | >1 | 1 |
| E2EE by default | ✗ | ✓ | ✓ | ✗ | ✗ | ✓ | ✓ |
| Decentralized | ✓ | ✗ | ✗ | ✗ | ✗ | ✓ | ✓ |
| Social recovery | ✗ | ✗ | ✗ | ✗ | Partial* | ✗ | ✓ |
| Metadata privacy | ✗ | Partial | ✗ | ✗ | ✗ | Partial | ✓ |
| Self-sovereign data | Local*** | ✗ | ✗ | ✗ | ✗ | Partial | ✓ |
| Multi-device sync | ✗ | ✗ | Cloud | Cloud | Cloud | Federation | Decentralized |
| Phone number required | Yes | Yes | Yes** | Yes | No | No | No |
| Open source | N/A | ✓ | ✗ | Client only | ✗ | ✓ | ✓ |
| Immutability | Local*** | ✗ | ✗ | ✗ | ✗ | Partial | Full |
* Partial social recovery: Facebook Messenger allows selecting 3-5 "trusted contacts" who can help recover your account. They receive codes to give you. This requires Facebook account access and doesn't work if Facebook locks you out. Facebook controls the keys.
** WhatsApp phone-only recovery: Account tied to phone number via SMS. If carrier invalidates your SIM (account closure, porting hijack, lost abroad), you're permanently locked out. No alternative recovery. Worse than no recovery system because it creates false sense of backup.
*** SMS local-only: Messages stored only on device. No cloud backup, no server storage, no synchronization. Messages immutable on your device but can be deleted by carrier, lost with device, modified on recipient's device, or trivially spoofed (sender ID is not authenticated).
About Immutability:
Message immutability means conversations cannot be altered, deleted, or reordered after transmission without cryptographic evidence of the modification. This prevents gaslighting, protects against retroactive censorship, and establishes verifiable provenance for disputes.
Most platforms let senders delete messages from both sides, edit history silently, or revoke entire conversations. "Unsend" features sound convenient until someone deletes evidence of harassment, agreements, or admission of wrongdoing. Courts can't subpoena deleted Signal messages. Businesses can't prove contract terms discussed over WhatsApp if the other party unsends them.
Photon supports deletion as a convenience feature, but rolling-chain encryption makes any modification cryptographically detectable—each message is mathematically bound to all previous messages. Deleting or editing requires consent from both parties and leaves verifiable proof in the chain. Your conversation history becomes cryptographic evidence. No "he said / she said"—the mathematics documents everything, and maths don't lie.
How It Works
Rolling-Chain Encryption
For a conversation between Ada and Turing, each party maintains two independent unidirectional chains:
- Shared seed exchanged out-of-band → Initial state:
state₀ = BLAKE3(seed) - Ada encrypts message with
stateAda→Turingand sends to Turing - Turing receives, decrypts, advances his receiving state
- Turing sends reply (or ACK), completing the loop
- Ada advances her
stateAda→Turingsending chain - Each chain advances only when the loop completes
- Send → receive → acknowledge → advance
- Both parties can decrypt because neither advances until confirmed
- Each message cryptographically bound to entire chain history
stateᵢ = BLAKE3(stateᵢ₋₁ ‖ ciphertext)
Unlike Signal's Double Ratchet (which advances immediately), rolling-chain requires completing the loop before advancing thus guaranteeing message order and immutability.
Social Key Recovery
Your 256-bit private key is split into overlapping shards distributed across trusted friends:
- Each friend stores encrypted shards
- Lose all devices? Friends' devices notify them: "Ada is recovering identity"
- System generates unique 3-word phrase per friend
- You contact friends out-of-band via POTS, video or in-person
- They approve, read phrase to you, you enter it on new device
- After threshold reached, identity reconstructs cryptographically
Network Discovery
Photon uses a custom distributed hash table for discovery:
- Your handle hashes to a DHT address for peer lookup
- Kademlia XOR routing locates peers across the network
- UDP for direct P2P messaging and status
- HTTPS for initial DHT bootstrap only
- All message content is end-to-end encrypted
Identity is human-readable: message fractal decoder instead of 68325246092135005593188004702279567398142131080053653706547690190910173287891.
Names are bound cryptographically to public keys via deterministic DHT addressing—no DNS, no blockchain, no registration fees.
Project Status
Mainnet is live — install, pick a handle, and message. Early and rough in places, but real and running.
What Works
- ✓ Cross-platform app: Linux, Windows, macOS, Android, Redox
- ✓ CLUTCH key ceremony (8 algorithms, quantum-resistant)
- ✓ Rolling-chain encrypted messaging, device to device
- ✓ Multi-device fleet: add by near-tap or phrase; contacts, settings and history converge
- ✓ Waves: end-to-end encrypted voice, direct, kept as recordings
- ✓ Files of any type, byte-exact, with previews; every device keeps a copy
- ✓ The bridge: drive one of your devices from another, drop files into it
- ✓ Self-updating signed builds, release notes in the app
- ✓ Sixteen languages; dozenal, hexadecimal or arabic numbers
- ✓ Handle registration and DHT discovery
In Progress
- ◐ Beams (video)
- ◐ Social key recovery
- ◐ Molecules (group conversations)
- ◐ Off-grid Wi-Fi Direct (built, field test pending)
- ◐ Relay carriage for waves between two carrier-NAT phones
Open to everyone: FGTW is up, so anyone can install Photon, register a handle and start messaging. The network will not be wiped; handles lock in fully once ferros is running and has been in use for a while.
License: MIT OR Apache-2.0 (dual)
Repository: github.com/nickspiker/photon
What's new
Stel Stela
- Fixed: Macs that never asked for the microphone. A Mac installed before the microphone description existed kept an old app description that updates never replaced, so macOS refused the microphone without asking and Photon wasn't even listed in Settings. Photon now repairs its own app description on launch; if macOS refused without asking, quit and reopen Photon once and it will ask. The wave screen's microphone messages now wrap onto several lines, and a beam you start says "beaming", not "waving".
- Switch cameras mid-beam. Tap your own picture during a beam to move to the next camera: the front camera, then each back lens from widest to longest, including the zoomed modes. The beam carries on without dropping, and each lens sends its own colour.
- Beams use the camera's own shape. A phone beam now sends the whole picture the camera sees, at up to about 5 megapixels and 30 frames a second, instead of cutting it to widescreen. Lower quality steps are exact halves of it.
- Development builds move onto a newer release by themselves. With "Install updates automatically" on, a development build now installs a newer release when one comes out, the same way a release build does. A newer development build is still never installed automatically: those stay a choice on the Updates page.
- Fixed: beam colours were tinted green. Photon was reading its colour conversion tables in the wrong order, so a camera that Photon trusts to send ordinary sRGB, including Macs and many Samsungs, arrived with a green cast. Whites are white now.
- Calibrate a phone's camera for beams. On phones whose camera Photon can take raw colour from, a Calibrate button sits beside a running beam. Hold a VERICHROME target up to the camera and tap it, and the beam switches to a calibration measured from your own camera under your own light. The first scan of a target downloads that target's data from VERICHROME; scans after that work offline.
- Beams are picture and buttons. Once a beam's picture is up, the wave screen drops the avatars, the ripples and the name; only a warning (such as a microphone problem) still shows over the picture.
- Fixed: missed parts of a beam showed as flat green. A beam now sweeps in over Photon's own background: any part of the picture that hasn't arrived yet is see-through, so the picture fills in stripe by stripe as it starts, with no green and no black.
- Fixed: beams from some phones looked very green. On phones that can't hand Photon their camera's raw colour completely, such as many Samsungs, Photon now leaves the phone's whole colour pipeline in charge (white balance, colour and tone curve) instead of sending half-processed green pictures. Samsung switched its white balance off whenever Photon supplied its own tone curve.
- Beams adapt to your connection. A beam now runs from a postage stamp to full 1440p, stepping down at the first sign of a struggling link and back up once it's been clean for a few seconds. Most steps only soften or sharpen the picture, which costs nothing and causes no hiccup; changing the picture's size is reserved for big moves, and the ladder holds the lower setting when a connection hovers between two, so it doesn't flicker back and forth. On a metered connection, beams stay at 640×360 or below.
- Beams arrive the right way up. Your phone sends its camera's picture as the camera sees it, with a note of which way is up from Photon's own sense of how you're holding the phone, and the other side turns it upright. The picture fills the top of the screen, as large as fits, with the wave buttons in the space below it; your own camera shows in its corner, mirrored the way a mirror shows you.
- Fixed: a phone could look offline for days while Photon was still running. If Android closed Photon's screen in the background, or restarted it on its own, Photon stopped talking to anyone until you opened it again. It now keeps running without its screen, comes back by itself after Android restarts it, and a watchdog revives it if it ever stalls.
Stel Stel
- Beams: video in a wave. Tap Beam on a conversation to start a wave with your camera on, or tap Beam during a wave to turn your camera on or off. The picture is encoded once on your device, carried on the wave's own encrypted path, and never passes through a server.
- Beams work on phones, Macs and Linux computers. Phones send with their own video hardware and show incoming beams; Macs and Intel or AMD Linux computers with a camera send and receive. Windows and ARM Linux computers can't send or show beams yet, so their Beam button stays greyed.
- Your camera's true colour. On a phone, the camera's automatic colour adjustments are switched off and the camera maker's own colour data travels with the picture, so a room lit by warm bulbs looks warm, as it really is.
- See what you're sending. While you beam, a small picture in the corner of the wave shows your own camera, in the colour the other side sees.
- Answer in kind, or the other way. Every incoming ring offers Wave back and Beam back, plus Decline. The big button is whatever is coming at you: a wave is waved back, and a beam is beamed back with your camera on. The smaller button above it answers the other way. When someone beams you, the ring screen says "incoming beam".
- On a Mac, Photon now asks for the microphone and the camera. The first wave or beam raises the system's permission prompt. If either is switched off for Photon, the wave screen says so and System Settings opens on the right page, where one switch fixes it. Before this, a Mac with no permission captured silence and nobody was told.
- Fixed: a Mac installed from the release installer could never be asked for the microphone, because its app description lacked the line macOS needs before it will ask.
- A silent microphone is named. If your microphone delivers nothing for three seconds during a wave, the wave screen says "your microphone is silent", so you know which end is broken.
- Fixed: a slow log submission could knock your clock minutes into the future, which put your messages out of order, made the other side ignore your wave answers, and made the wave screen show seconds of delay that weren't there. A server refusing a slow upload is no longer mistaken for a wrong clock, log uploads are given the time they take, and one loose clock reading can no longer tilt the clock.
- Fixed: your phone stayed quiet when the mouse merely crossed Photon on your computer. Only an actual click, tap, key press or typed text now counts as using a device; hovering and scrolling do not.
Stel Lunor
- Fixed: files dropped onto the bridge could vanish. On a fast network the file's pieces could arrive before the host knew a file was coming, and were thrown away. Now every piece introduces itself, so they can arrive in any order. The host asks again for anything missing, picks up where it left off after a restart, and the sending device keeps its copy until the host has every piece. A drop of a large file also no longer freezes the window while it is read.
- Files in conversations finish sooner on fast networks. A piece that arrives ahead of the file's outline is now kept instead of being re-requested twenty seconds later.
- The release notes on the Updates page and on the website no longer show stray asterisks around the first sentence of each note.