I heard about a messaging app called "Zerion", and when I looked into it, it sounds better than any messaging app I have heard about before. It can be found at https://zerion.chat with its source code at https://github.com/zerionproject/Zerion .
Some features:
Tor-only transport - No WiFi, Bluetooth, or LAN exposures
Built on the bramble protocol
No phone number, email, or central server
No telemetry, analytics, or crash reporting
No logging - verified at build time
Encrypted at rest with SQLCypher and password derived key
No screenshots
No message previews in notifs
Open source
No account recovery
Hybrid Post-Quantum key exchange (X25519 + ML-KEM-768)
Hybrid signatures (Ed25519 + ML-DSA)
Forward-Secret message ratcheting
Calls encrypted with AES-256-GCM - storage with SQLCypher (AES-256)
The following are under an opt-in hardened mode:
Refusal to start on tampered devices (unlocked bootloader/modified system)
Refusal to start when debugger, root, or hooking framework is detected
Wipe if ADB or file transfer over USB is detected
Is this the future?
Hacking / Opsec
Better than SimpleX and Signal, is there a reason no one is talking about it??!
Started by dh37h58thdwtsn · Jun 18, 2026
Site doesn't load, probably needs JS.
I don't have time to investigate.
I don't have time to investigate.
if i remove the links, can you allow the post, someone in the community may investigate
I mean, who heard about Zerion ? I never heard about him on privacy or opsec forum, you're the first one mentionning it. It has all the current buzzwords people looking for privacy and security will look for. You know what we say about to good to be true ?
Moreover, at what you state about the hardened mode, first I have my doubt that it will refuse to start but if you have a good passphrase it should not be brute forced and the amount of permissions that goes very deep in the phone... I'm not even sur you can have this level of access without Shizuku or root, but still let's say it can, you give access to you full phone to the application, perfect for malwerare.
You want a messaging that goes over Tor you have cwtch.im that are bit known and cited sometimes. It's supported by a team of 3 researchers let's just hope that it will continue to have support even if they cut fundings.
Signal, even if you have to give a phone number, is an established messaging apps and for what I know LE can't access its content if it's locked.
SimpleX, I know it's plebiscited a lot here, but even if I tried it, I'm not confident using it. Again, to good to be true and it's ran by a society in UK which to me is kind of a red flag. I really hope I'm wrong but it smells undercover LE or we'll have someday an "unfortunate" leak in clear of the messaging app leading to arrestations. I mean I see Protonmail being cited sometimes especially because they have onion service, but they handle metadata and gave people to the police because of that, so no, you can't trust Proton.
I think here we have the new Potato messaging app
Edit: I might be wrong you shared a github link so the code might be auditable. Again supposing that we can have reproducible builds to ensure that what is in gihub and only in github is in the application. So worth keeping an eye on or asking for people to audit the code but too risky to be early adopters or you use it for normal stuff.
Moreover, at what you state about the hardened mode, first I have my doubt that it will refuse to start but if you have a good passphrase it should not be brute forced and the amount of permissions that goes very deep in the phone... I'm not even sur you can have this level of access without Shizuku or root, but still let's say it can, you give access to you full phone to the application, perfect for malwerare.
You want a messaging that goes over Tor you have cwtch.im that are bit known and cited sometimes. It's supported by a team of 3 researchers let's just hope that it will continue to have support even if they cut fundings.
Signal, even if you have to give a phone number, is an established messaging apps and for what I know LE can't access its content if it's locked.
SimpleX, I know it's plebiscited a lot here, but even if I tried it, I'm not confident using it. Again, to good to be true and it's ran by a society in UK which to me is kind of a red flag. I really hope I'm wrong but it smells undercover LE or we'll have someday an "unfortunate" leak in clear of the messaging app leading to arrestations. I mean I see Protonmail being cited sometimes especially because they have onion service, but they handle metadata and gave people to the police because of that, so no, you can't trust Proton.
I think here we have the new Potato messaging app
Edit: I might be wrong you shared a github link so the code might be auditable. Again supposing that we can have reproducible builds to ensure that what is in gihub and only in github is in the application. So worth keeping an eye on or asking for people to audit the code but too risky to be early adopters or you use it for normal stuff.
Probably because it's new. No matter how good something looks, it can't be considered safe until we've let some less security conscious people try it for a couple of years and seen how many of them get arrested. P2P architecture is less secure than trusting a third-party server for some threat models because it makes timing attacks easier. The website looks suspiciously flashy too, if it wasn't built on bramble - which IIRC is good for people who prefer P2P - I'd assume looking at the website that it was some manner of scam or profit-making enterprise.
yeah android only lol. "privacy focused" when you have to run it on compromised hardware.
oh also the only contributor other than zerion project on github is claude