A conversation starts with consent
Requests stay pending until accepted. Compare the shared safety number or scan its QR code before trusting a contact. Key-change warnings stay explicit; accepted contacts are remembered on your device.
Security Level
How hard it is to break
Panthera composes only vetted, standard primitives — no hand-rolled crypto. Every primitive comes from libsodium (sumo build). Attack surface is minimised to the smallest possible trusted computing base.
Signal-class · 256-bit · Forward & post-compromise secrecy
Confidentiality
XChaCha20-Poly1305 AEAD
256-bit key · 192-bit nonce
Forward secrecy
Symmetric chain ratchet
Each message a fresh key
Post-compromise
DH ratchet on flip
Recovery from key leak
Authenticity
Poly1305 MAC + Ed25519
Authenticated content; verify identity with safety numbers
Handshake
X3DH (3 or 4 DH)
Ed25519 → X25519 conversion
Key storage
Sealed IndexedDB
In-memory KEK only
Fast re-entry. Password first.
On supported devices, Face ID or a fingerprint can reopen an auto-locked app after password sign-in. Closing and reopening still requires your password. The sealed unlock data stays on your device; cancellation leaves it locked.
Privacy beyond the message
Hidden chats with a PIN, auto-lock, local wipe controls and a screen shield when the app leaves the foreground. Alerts appear after local decryption, with preview choices, quiet hours, sound, vibration and per-chat mute.
A restricted server view
The sanitized administrator view shows ciphertext, nonces, masked delivery tags, type, timing and expiry only for conversations that account participates in. Reads are audited; other users' conversations and readable content are not available through that view.
Security evidence, honestly stated
Continuous internal checks cover encrypted conversations, media, groups and device presentation. An independent external security audit remains a next step — internal testing is not third-party proof.