SILNT
How to Privacy

Tech

SILNT is sealed on the iPhone, then routed by a dumb server.

MLS RFC 9420 OpenMLS

The important bits live as pictures on the home page. This page is the stack. Nothing here is a waitlist, and nothing phones home from this site.

A close stack of metal key blanks on dark felt.

MLS / OpenMLS

Group encryption is MLS (RFC 9420) via OpenMLS, ciphersuite 0x0003. Text, groups, reactions, receipts and search are sealed on the iPhone before they leave. A removed member reads nothing after the removal epoch.

How to
  • Ciphersuite 0x0003
  • Groups, media, voice notes
  • Removal epoch cuts access
  • Search stays on the device

Sealed sender

The delivery service sees padded sealed envelopes, not content and not who socially sent a message. Envelope sizes sit in buckets. The 64 KiB bucket appears only on post-quantum handshakes of larger groups. Timing remains.

  • Padded size buckets
  • No social sender
  • Timing still exists
  • 64 KiB bucket is rare

SQLCipher

Message history, contacts and wallet state sit in an encrypted database on the phone. That live database is excluded from iPhone and iCloud device backups. Deleted rows are overwritten. Compact after expiry.

  • Encrypted on-device DB
  • Not in device backups
  • Overwrite on delete
  • Compact after expiry

BIP-39

Identity is a 12-word recovery phrase generated on the device. BIP-85 domain-separates the wallet and messaging keys. SILNT never receives a copy. The phrase restores identity and funds. History needs the sealed backup.

  • Twelve words on device
  • BIP-85 domain split
  • No copy leaves the phone
  • Backup is a second object

The DS is dumb

The delivery service is a small Rust server. It relays envelopes, holds routing metadata, and can send content-free APNs wakes. It makes no other outbound calls. Fiat rates come from an operator file. You can run it yourself. Content-blind either way.

  • Relay, not a reader
  • Content-free APNs wake
  • No other outbound calls
  • Self-host if you want

New groups on the current build default to ML-KEM-768 with X25519. Signatures stay Ed25519. Transport, the backup key, and Lightning stay classical. Older builds cannot join a post-quantum group. Handles sit on a signed, append-only directory log. Honesty table: metadata. Policy: privacy.