Three independent layers
Tor hides the route, your account says who you are, end-to-end encryption protects what you write. Each one covers different things, and none replaces the others.
The path of every request
Tor runs inside the app: no VPN, no other app to install. The app doesn't know an IP address for the server, because it has no public one: it only knows its .onion address and the access key.
- Appon your iPhone
- Tor inside the appArti, the Tor Project's Tor
- Tor networkthree relays, layered encryption
- Onion servicefindable only with the key
- Servermessages and attachments stay encrypted
Server setup: onion, port, access key
Chat info
The three layers
Giving one layer credit for another layer's guarantees is the quickest way to leave a hole unnoticed, so we describe them separately.
Protects: the server can only be reached as a v3 onion service, whose address is its public key. With onion client authentication, without the access key the service cannot even be found. Your IP address never reaches the server, and the server's location stays hidden.
Does not protect: it doesn't tell the server who you are, and doesn't hide content from the server: that's the job of the other two layers.
Protects: who you are and what you can touch. A stable identifier for every account, an access token that expires after 8 hours, a revocable renewal (log out, ban, account deletion), an optional TOTP second factor, rate limits per account.
Does not protect: it doesn't hide content from the server, and it doesn't rely on Tor: your identity comes only from your account token.
Protects: the content. The Signal protocol: X25519 key agreement and the Double Ratchet, with a fresh key for every message. In groups, the key reaches each member encrypted. Attachments are encrypted on the phone. Safety numbers, thirty digits, tell you whether someone got in the middle.
Does not protect: metadata: who writes to whom, and when. See the section below.
What stays visible
To deliver messages, the server knows who writes to whom, when, and how large a message is. It doesn't know what it says.
Notifications go through Apple's servers. Apple sees the sender's name, the kind of content (for example “New message” or “sent you a photo”), a conversation identifier and, for groups, the group name. Never the text.
There are no voice or video calls, by design. WebRTC needs to exchange the direct IP addresses of the two devices to set up the connection: the exact opposite of what this app protects. Until it can all be negotiated inside Tor without that address leak, calls stay out.