Tor® — every hop 3–4 countries E2EE default VPN-hardened pipe

Online messaging in the class of Signal and Session.

A real-time messenger for Windows with end-to-end encryption, Tor® transport on every socket, and a VPN-style encrypted tunnel around your traffic so the path looks like a sealed pipe — not a straight line from your IP to one datacenter. Circuits routinely cross three or four countries before they reach us.

Layer 01

Tor® multi-hop

Each circuit chains independent relays across regions. Your client never opens a naked TCP line straight to us — the path animates through several countries by design.

Layer 02

End-to-end encryption

Keys stay with participants. What leaves your machine is ciphertext inside the Tor cells — defense in depth: even strong transport can’t read the message layer.

Layer 03

VPN-style tunnel

An outer encrypted tunnel hides the shape of your session from coffee-shop Wi‑Fi and ISP-grade observers — the same “opaque pipe” mental model people already trust.

Security & cryptography

Capabilities aligned with what users expect from a private messenger today — Tor® transport, E2EE payloads, and VPN-hardened encapsulation where the stack supports it.

Tor® routing on every connection

Chat, sync, calls, and media all use Tor — not an optional mode. Circuits typically cross three or four countries between you and The Messenger.

End-to-end encryption

Messages, groups, attachments, and call signaling are E2EE. Servers coordinate delivery — they don’t hold plaintext history to mine.

VPN-style outer tunnel

Traffic is wrapped in an additional encrypted tunnel so local networks and providers see an opaque session — complementary to Tor and E2EE, not a replacement.

Forward secrecy

Session keys advance over time so leaked material doesn’t decrypt your entire archive.

Disappearing messages

Per-chat timers so sensitive threads auto-expire everywhere you’re signed in.

Safety numbers & verification

Compare safety numbers or scan QR to catch MITM and wrong-device joins.

Encrypted groups

Same cryptographic model as 1:1: membership, keys, and payloads handled as first-class.

Encrypted voice & video

1:1 realtime over the same Tor® path and tunnel — not a clearnet side channel.

Secure media & files

Attachments and voice notes stay ciphertext in motion across Tor and the outer tunnel.

Tor® is a registered trademark of The Tor Project. Signal and Session are trademarks of their respective projects. The Messenger is an independent product — not affiliated, endorsed, or interoperable unless explicitly stated in future releases.

Messaging features

What a serious chat app ships: the features you use daily, with the stack above always on.

Threads that scale

1:1 and groups, replies, quotes, @mentions, searchable local history.

Voice messages

Encrypted voice notes with modern playback UX.

Reactions & receipts

Reactions, read receipts, typing — configurable per chat.

Multi-device

Linked clients and device revocation when you lose hardware.

Block, mute, report

Moderation basics for real networks.

Private identifiers

Pseudonymous accounts where the protocol allows — no phone bill required for every deployment.

Operations & trust

How the service is run — transport and crypto aligned with serious messengers.

Server-side stance

  • Tor® + tunnel: no single-hop clearnet shortcut; circuits span multiple countries
  • E2EE payloads: we don’t monetize plaintext you never gave us
  • No ad targeting from contact graphs or message content
  • No third-party model training on your threads
  • Onion-ready infrastructure and incident response as standard ops

Your controls

  • Per-chat disappearing messages and granular notifications
  • Explicit verification before trusting devices or contacts
  • Export or delete local data per policy
  • Published threat model as the project matures

Download the Windows client

Feel the stack: Tor® path diversity, end-to-end encryption, and a VPN-style tunnel — together, not as optional extras.

Download