What Titlan is
End-to-end encrypted. Every message is encrypted on your device with the Signal protocol stack (libsignal) and decrypted only on your contact's device. Message content is never on the wire in the clear and never at the relay.
No phone numbers, no accounts, no directory. Your identity is a keypair generated on your device. You connect with someone by pairing: scanning a QR code in person, or exchanging a pairing link. There is no server-side identity to register, look up, or leak. The link path is documented as the weaker of the two; QR is recommended.
A blind relay. Messages travel through a relay that is a stateless, RAM-only mailbox store. It holds no database, writes nothing to disk, keeps no logs, and carries no identity: it stores and delivers opaque blobs addressed by mailbox id. Anyone can run one; a self-hosted relay is a first-class deployment.
Metadata is minimized, not eliminated. There is no cleartext sender, recipient, or message-type field on the wire, and messages are padded to fixed size classes before encryption. What the relay and the network still observe (timing, source addresses, message-size classes) is stated plainly in the threat model. Titlan does not provide anonymity at the network layer.
Trust on first use. A contact's key is recorded when you pair and trusted from then on. Spec 1.0 has no safety numbers and no key-change notification; verifying a contact's key happens out of band.
GrapheneOS first, standard Android second. Titlan targets GrapheneOS first and runs on standard Android. It is Android only.
Open source, verifiable builds. The protocol core and the wire specification are Apache-2.0; the app and the relay are AGPL-3.0. Builds are reproducible from pinned toolchains and locked dependencies, and every tagged build ships with software bills of materials and a build provenance attestation. The wire protocol is frozen at spec 1.0 and is third-party implementable.
What Titlan does not do
- No group conversations: spec 1.0 is pairwise only.
- No attachments: they are out of scope for spec 1.0 and will never transit the relay.
- One device per identity: there is no multi-device.
- No in-app key verification (safety numbers) and no key-change alerts.
- No per-message notifications at spec 1.0: messages appear when you open the app.
Status
Titlan is pre-release. The protocol core, the relay, and the Android pairing and sync layers are implemented, and the wire protocol is frozen at spec 1.0; the conversation screens are still being built. There are no supported releases yet. Official releases appear on GitHub Releases together with their proofs; see how to verify a download.
Security
Report a vulnerability privately to [email protected], or through GitHub private vulnerability reporting. Scope and response times are in SECURITY.md. No custom cryptography exists in the codebase by policy: primitives come from libsignal and mainstream audited TLS crates.
This site is static: no scripts, no cookies, no third-party requests.