Skip to content

Roadmap

Where PrivaMesh is, and what comes next

Every release so far, the one being built now, and what is queued after it. Filter by platform, open any step to see what is in it.

  1. Shipped

    Out, dated by when it reached people

    • iPhone 1.0

      iPhone

      The first App Store release: one-to-one encrypted messaging with no phone number and no account. It needed iOS 26.5.

      What is in it

      • X3DH, the Double Ratchet and AES-256-GCM
      • An account is a 12-word recovery phrase made on the device
      • A fresh one-time address for every message
      • Padding to fixed sizes; cover traffic as an option, off by default
      • Paid sending through blind signatures, so a send cannot be tied to a purchase
      • The post-quantum handshake was built but switched off

    • Windows 1.0.0

      Windows

      A desktop client with its own fee wallet and no relay in the path.

      What is in it

      • Installer and portable .zip, Java bundled, no administrator rights
      • The duress code, from the first version
      • Not code-signed, so Windows shows a publisher warning
      • Has not yet sent a message on mainnet

    • Android 0.1

      Android

      A signed release APK, tested on an emulator rather than a phone.

      What is in it

      • Signed with the real key, so later versions install over it
      • The duress code, from the first version
      • Free tier only: the relay cannot verify a Google Play purchase
      • Messages can take up to 15 minutes to arrive
      • Has not yet sent a message on mainnet

    • iPhone 1.1

      iPhone

      Runs on iOS 18 and later, so most iPhones can install it. This is the version on the App Store now.

      What is in it

      • iOS 18 and later, down from iOS 26.5
      • Invite links instead of scanning a QR code or pasting a card
      • A passcode bug fixed that could demand an old passcode after a restart
      • Post-quantum handshake switched on for iOS 26, but its upload fails, so every session still opens classically
  2. We are here

    Building now

    Written and tested, not yet released

    • iPhone 1.2

      iPhone

      No date

      Written and tested, not yet on the App Store. The larger of the two releases so far.

      What is in it

      • Fixes for twelve external reports and two internal audits
      • Safety numbers: confirm you added the person you meant
      • Key-change alerts that take the verified mark off
      • The duress code on iPhone
      • A post-quantum handshake that completes
      • Notifications that do not name the sender unless you turn it on
      • The interface in 33 languages

  3. Next

    Queued after the current release

    • Android on a real phone

      Android

      No date

      Run the client on a real device and send its first message on mainnet.

      What is in it

      • Until this happens, the Android build is a preview, not a messenger you can rely on

    • Paying on Android

      Android

      No date

      A way to pay that does not depend on an Apple receipt.

      What is in it

      • The relay verifies Apple receipts only, which is why Android is free tier only
      • It has to keep a purchase unlinkable from a send, as blind tokens do on iPhone

    • A signed Windows installer

      Windows

      No date

      A code-signing certificate, so the installer stops raising a publisher warning.

      What is in it

      • It is also what would let you check that the file really came from us

  4. Later

    Planned, further out

    • An opening message that names nobody

      Protocol & audit

      No date

      If you publish a handle, the first message of a conversation still shows who you start it with.

      What is in it

      • Fixing it means a new message format, which older installs could not read

    • An independent security audit

      Protocol & audit

      No date

      None has been done. Until one is, treat the security claims as unverified.

      What is in it

      • When it happens, the security page will name the auditor, the version and the exact commit

How to read this

Shipped items carry the date they reached people. Nothing else carries a date, on purpose: a date we miss would tell you less than no date at all. Building now means the code is written and tested but not yet in your hands, which for iPhone means it has not reached the App Store. Until it has, read the app you have as lacking it.

The page cannot fall behind the App Store: the site will not build while the version Apple serves is missing from the shipped list. What each release actually changed is on the changelog, and what none of this fixes yet is on known limitations.

Keep reading

ChangelogWhat each release changed, and when.
Known limitationsWhat PrivaMesh does not protect you from.
SecurityAudit status, fixes and how to report a vulnerability.