Vault encrypts messages on your device and delivers them as ordinary email — through any mail account. No storage servers, no logs, no metadata. Just you and the recipient.
There is simply no server side. Your email is the transport, your device does the encryption.
Gmail, Outlook, Zoho, your own domain — any account with IMAP/SMTP. Vault runs on top of your existing email and creates nothing new.
Cryptographic keys are generated on your device. Verify contacts via QR code or key fingerprint. The private key never leaves the device.
A message gets encrypted and sent as an email. The recipient's app decrypts it automatically. To the mail provider it's just opaque data.
Everything you need for daily conversations — and nothing you don't.
Encrypted group chats with a shared group key.
Calls over the same mail account: Opus codec, XChaCha20-encrypted media stream.
Messages that self-destruct after a set time.
Photos, documents, files — encrypted, never uploaded to a cloud.
Polls in chats and groups: up to 10 options, votes are encrypted, results visible to everyone.
Forward messages to other chats; an unfinished message is saved and waits for you.
Share a map point (OpenStreetMap); chat folders, archive and per-chat mute.
Dark, light and accent themes — from strict to cozy.
English, Russian, Chinese — switch right in the app, no restart.
From install to your first call in five steps. Everything is configured inside the app — no sign-ups anywhere.
Android. Download the APK from the "Download" section (or inside the app: Settings → Help → "Check for updates"). When the system asks to allow installs from this source, allow it and confirm. Updates: the same button shows the new version and a link to the APK.
Windows / Linux. Unpack the archive and run the executable. No installation required; data lives in your user profile.
What lives where. Encryption keys, chat history and settings are stored only on your device (a local SQLite database). There are no Vault servers and no cloud copies — right after the first launch, enable key backup in "Settings → Keys".
Your account is a regular email address. Pick a provider (Gmail, Yandex, Mail.ru, Zoho, Outlook, iCloud, GMX, WEB.DE, Fastmail, Rambler and more — servers are filled in automatically; for "Other" enter IMAP/SMTP manually) and enter your address and password.
Gmail and iCloud may require an "app password" instead of the regular one — create it in your provider's security settings. The password is stored encrypted on your device only; "Remember on this device" enables automatic sign-in.
No registration with Vault or anyone else: messages travel between your mailboxes, Vault servers do not exist.
Tip: use a separate, clean mailbox. Email is only a transport for Vault, so it works best with a mailbox you don't use for regular correspondence: provider notifications, filters and mail lists stay separate from your personal mail, and all Vault messages live in one place.
You can change your email at any time. Settings → "Change email": contacts and groups are kept — encryption keys are not tied to the address. After switching, send a message or your profile and your contacts learn the new address automatically.
Encryption keys are generated automatically at first launch. To start a chat, add the other person in one of two ways:
QR code (in person). Both of you open "Keys" (🔗) and show/scan each other's QR. The most secure option: keys never cross any network.
By member id (remotely). Exchange codes over any channel — optionally verify the key fingerprint (40 hex characters) by voice or in person.
After adding, the contact's fingerprint is pinned: the app warns you if the key unexpectedly changes.
Chatting works like any messenger: IMAP IDLE delivers messages in seconds, sent/delivered status shows under each message. You can reply with a quote, edit and delete your own messages for everyone.
"Delete for me". Long-press (phone) or right-click (desktop) any message — including call records — to open the menu with "Delete for me": the message disappears only on your side, the other person keeps it. Clean up your chat without touching theirs.
Attachments and voice. Photos, documents and voice messages are encrypted exactly like text and never uploaded to any cloud.
Groups. "+" in the chat list → "Create group": members are invited with the same keys, the group key is encrypted for each member separately. Up to 50 members, with roles and message pinning.
Disappearing messages. Set a timer in the chat — messages get deleted for all participants after the chosen time.
Auto-clean. Settings → Chats: automatically remove messages older than 1/7/30/365 days from this device — history stays out of the mailbox.
Voice calls run over the same email account, with no separate servers. Enable the calls switch in "Settings → Experimental features" — a phone button appears in the chat.
Calling: if the person is online you get ringing tones and a live call; if offline they will see a "Missed call". Missed and completed calls appear in the chat as records, which can also be removed with "Delete for me".
The conversation does not start immediately after accepting. When you tap "Accept", the app establishes a direct encrypted connection between the two devices (session setup is exchanged via email): this usually takes a few seconds, with "Connecting…" shown on screen. Wait until the status changes to the active call — audio starts as soon as the connection is established. This is normal and does not mean the call is broken.
The media stream is encrypted with XChaCha20, the codec is Opus (same as WhatsApp). Sound quality and ringtones are configurable. Calls are beta: some networks/devices may have limitations.
"Settings → Keys" offers key-store export/import plus a recovery key (mnemonic phrase). It restores your keys and account access on a new device — chat history stays in the mailbox and local copies.
Not a single third-party server between you and your recipient.
| Layer | Technology | Status |
|---|---|---|
| Key exchange | X25519 — ephemeral exchange, session keys per conversation | in release |
| Message encryption | XChaCha20-Poly1305 — authenticated AEAD | in release |
| Conversation key derivation | X25519 + SHA-256 (HKDF-like) — ephemeral exchange, session keys | in release |
| Call media | XChaCha20 — stream encryption, Opus codec | in release |
| Quantum-resistant exchange | ML-KEM-768 + X25519 — hybrid scheme (FIPS 203) | in release |
| Server-side metadata | None: the only servers are your own IMAP/SMTP, holding nothing but encrypted blobs | |
Transparent about what's done and what comes next.
Encryption, contacts, QR key exchange, groups, attachments, calls (beta) — Android and desktop.
Repository is public (github.com/kmakan/vault, AGPL-3.0), APK and installers published, this website, announcements in privacy communities.
Hybrid ML-KEM-768 + X25519 key exchange (FIPS 203) — quantum computer attack protection shipped in the release.
Paid channels, mini-app marketplace, premium features — per the 2026 roadmap.
Current version — 0.1.157 (September 10, 2026). Updates in-app: Settings → Help → "Check for updates".
Short answers to the most common questions.
Vault keeps a persistent IMAP connection (IDLE), so messages arrive as fast as in any regular messenger. Email is only the transport: it stores and processes nothing.
Only the fact of an email between two addresses and the size of an encrypted blob. Subject and body carry no meaningful data.
The app is free. Monetization will come from premium features (channels, mini-apps) — core messaging stays free forever.
The account is yours. Connect another mailbox at any time: chat history lives locally on your device and is not tied to a provider.
Vault works like a messenger: automatic key exchange, groups, calls, attachments — no manual key management. The cryptography is modern (XChaCha20-Poly1305), not from the 90s.