Graphite

Android v1.13.32 is now required. Older Android builds say “Update required” and stop connecting: install the new APK over the old one — your account and messages stay put. Windows installs older than v1.13.31 also need downloading again, once. New installs need nothing.

Private messenger · Public beta

Private messaging with nothing to hand over.

End-to-end encrypted. Routed over Tor. No phone number, no email, no logs.

Download for Windows See how privacy works

Portable · no install · v1.13.32 · Windows 10/11  ·  Android APK v1.13.32

Win v1.13.32 · Android v1.13.32 — release manifest available

No phone or email

Your account is a 12-word phrase, generated on your device.

12 words = your identity

Tor by default

Bundled Tor connection to a hidden service, fail-closed.

No clearnet fallback

7-day max ciphertext

Undelivered envelopes are deleted after 7 days at most.

Verify the release

The product

A private messenger that still feels like a messenger.

Chats, groups, calls, files. Same shape you already use — with a smaller footprint of things anyone else can see.

Graphite behaves like the messenger you already know, and hides the parts you shouldn't have to share. Message content is end-to-end encrypted, delivery is routed over Tor, and the relay never handles anything but sealed envelopes.

  • Encrypted voice & video calls (DTLS-SRTP)
  • Groups & encrypted file sharing
  • Voice notes, offline voicemail
  • On-device search — nothing uploaded
  • Receipts you control · appear-offline mode
  • Safety-number verification per contact

Protocol details are in the security section below.

Graphite messenger on a phone and a laptop

Identity

Your identity is not an account.

No sign-up form, email confirmation, or phone number. Just twelve words held by you.

  1. Generate 12 words. Graphite creates a recovery phrase on your device the first time you open the app.
  2. Keep them on your device. The relay only receives public routing and key material — never your 12 words.
  3. Restore anywhere. Type the 12 words on another device to get your identity back. Lose them and nobody — including us — can recover the account.

Privacy architecture

Designed to leave less behind.

Message content lives only on the endpoints. In transit, only sealed ciphertext moves through Tor and the Graphite relay.

Plaintext here

Your device

Creates, pads and encrypts the message locally.

Ciphertext only

Tor circuit

A separate Tor circuit hides the network path.

Sealed envelope · TTL ≤ 7d

Graphite relay

Queues a sealed envelope. Sees delivery state, never message content.

Plaintext here

Their device

Receives and decrypts the message locally.

Message content exists only at the endpoints.The same sealed payload moves through the route.

Leaves your device

  • An encrypted envelope with your message inside.
  • Delivery routing data needed while in transit.

What the Graphite relay can read

  • Not message content, ever.
  • Sealed envelopes and short-lived delivery state (TTL ≤ 7 days).

Transparency document · Release manifest

Security

Modern cryptography, explained like a product.

Real primitives underneath, plain language on top.

  • Only you and the person you're talking to can read messages.
  • New keys on every message — a stolen key can't unlock the past.
  • Post-quantum protection for messages you send today.
  • Voice and video are encrypted end-to-end.
  • Verify a contact by comparing a short safety number.

Under the hood

Message cryptoX25519 + libsodium sealed boxes
Post-quantum layerHybrid ML-KEM-768
Session stateSignal-style double ratchet
CallsDTLS-SRTP, media encrypted end-to-end
VerificationPer-contact safety number

A mismatch warns that the contact key has changed — verify again before you keep talking.

Beta reality

What "public beta" honestly means.

Rapid updates

The Windows app updates itself over Tor against the signed release manifest; builds before v1.13.31 have no update path and must be downloaded again from this page, once. Android cannot install its own updates: when a release is required the app stops and says so, and you install the new APK from here over the top of the old one — your account and messages stay put.

Windows SmartScreen

The current build is not Authenticode-signed, so Windows may warn on first launch. Check the SHA-256 below before you run it.

Android is sideloaded

There is no Play Store listing; you install a signed APK.

Recovery is on you

Lose your 12 words and no one can recover the account.

Everyday

Everything you'd expect from a modern messenger.

Calls

Encrypted voice and video, end-to-end.

Voice notes

Send audio; voicemail waits, encrypted, until they're back.

Groups & files

Encrypted group chats and attachments.

On-device search

Search history locally — nothing uploaded.

Receipt controls

Toggle ticks and go incognito when you want.

GrapheneOS-ready

Runs on de-Googled Android without Play Services.

Download

Get Graphite on the platform you use.

Free public beta — Windows v1.13.32, Android v1.13.32. Windows updates itself over Tor from here on (a build older than v1.13.31 has to be replaced by hand once); Android asks you to install a new APK from this page when a release is required.

Release integrity manifest — the signed record both apps check before they install an update, and the one to compare these SHA-256s against.

Windows · v1.13.32

Windows

Portable EXE, Windows 10/11, bundled Tor.

No installBundled TorAuto-updating
Download for Windows

SHA-25638d8ffa6dbf9aa9eb1fc0f1efffb278994c870b36800955a1045a5de2d49a83a

Android · v1.13.32

Android

APK you sideload. No Play Services required.

GrapheneOS-readyDe-Googled phonesAuto-updating
Get the APKInstall GrapheneOS (optional)

SHA-256fa1fc974bc345ffb80f517aa5e4d55abeedf9734d9951c0018f2a7508d64af81

The Windows build is not Authenticode-signed and may show SmartScreen — compare the SHA-256 above and check the release manifest to verify update integrity. Android is sideloaded — verify the release manifest before installing.

Moving to another device? Type your 12 words there to restore the same identity locally. Chat history stays on each device — it does not sync from a server.

Tor users. Both apps reach the relay through its hidden service automatically. If you want to check it yourself, the relay's onion address is:

Onionux24z2gggqr6j4zntooai3db264xnlrgwqd7uitoz45gcibeaolsx6qd.onion

The relay also publishes this address in its transparency document.

FAQ

Questions, answered.

Is it really free?

Yes. Graphite is in free public beta.

Do I need a phone number or email?

No. Your identity is a 12-word recovery phrase — nothing else.

Does it work without Google / on GrapheneOS?

Yes. The Android app needs no Google Play Services and runs on GrapheneOS and other de-Googled phones.

What happens if I lose my 12 words?

They are the only key to your account. Store them safely — no one, including us, can recover them for you.

It’s a beta — is it stable?

It’s usable day-to-day and improves quickly. The Windows app updates itself over Tor against the signed release manifest; a Windows build older than v1.13.31 has no update path and must be replaced from this page once. The Android app cannot install its own updates: when a release is required it stops and says so, and you install the new APK from this page over the old one, which keeps your account and your messages.

Who’s behind Graphite?

PrivacyPortal (privacyportal.co.uk).

Ready to leave less behind?

Download for Windows Get the Android APK

Free public beta by PrivacyPortal.