Private messaging · No accounts
Read once.
Then gone.
Vanisher is a messenger that leaves nothing behind. No phone number, no account, no history — just two people, end-to-end encrypted, while they’re both online. When a message has been read, it dissolves on both screens at once, and the server never had anything but ciphertext going past.
No phone number Nothing stored on any server No message history
No phone number
Your identity is a key pair generated on your device — not an account in a database. There is nothing to sign up with, and nothing to look you up by.
Nothing stored
The server is a relay that forwards ciphertext between two live devices and forgets. No database, no disk, no access logs. Restart it and it remembers nothing — because there is nothing to remember.
No history
Messages exist in memory on your two devices while you talk, then vanish from both. Nothing is ever written to disk on either side. There is no archive to leak, because no archive exists.
The whole idea in one gesture
Press and hold to read. Let go, and it’s gone.
This is the actual mechanic, not a video. A message stays hidden until the recipient holds it. The moment they release — or the five-second fuse burns out — it is deleted on both screens at the same time. Try it on the right.
The villa is booked. Flying out Thursday, 06:40. Tell no one.
SENT · waiting to be read
Deleted on your screen the moment it was read. Both copies go together — there is never one left over.
Gone — and the sender’s copy went with it. In the real app, the blurred bubble is watermarked with your name and key fingerprint, so a forwarded photo points back at its leaker.
How it works
Four steps. No forms. No phone number.
Pick a nickname
First launch generates your identity: an Ed25519 key pair on your device, stored encrypted. The nickname is just a label — the key is you. Nothing is registered anywhere.
Invite one person
Create an invite link: valid 24 hours, single use, signed. The payload rides in the link fragment, which browsers never send to any server. They confirm, you confirm.
Compare safety numbers
Both screens show a 40-digit number. Read it aloud in person or by voice. If the digits match, nobody sits between you. It is the one ritual worth doing right.
Talk while you’re both online
Sealed, end-to-end encrypted chat with fresh session keys. Messages live in memory on your two devices while you talk — then vanish, on a timer you choose.
Under the glass
Built so there is nothing to take.
End-to-end encrypted
libsodium throughout: XChaCha20-Poly1305 message encryption with fresh ephemeral session keys for forward secrecy. The server only ever sees ciphertext and public keys.
A relay that forgets
No database. No disk. No access logs — not even IPs. It forwards frames between two live connections and holds nothing else. That isn’t a policy we could change later; it’s the architecture.
Identity without accounts
You are your key. It stays on your device, encrypted — optionally wrapped with a passcode (Argon2id). No server has a copy, so there is nothing to leak and nothing to hand over.
Safety numbers
Every contact pair gets a 40-digit number, and both screens must agree on it. Compare it in person and you know the channel is yours — the same ritual private messengers have trusted for years.
Invites that expire
24 hours, single use, cryptographically signed — and carried in the URL fragment, so the invite never touches a server. A used or expired nonce is ignored without a reply.
You set the fuse
5, 10, 30 or 60 seconds — and the timer starts when the message is revealed, not when it lands. Every message is padded to one fixed size, so the server can’t even tell how long it was.
Honesty, in writing
What “vanish” means — and what it doesn’t.
Gone, for real
- Deleted from both screens at the same moment, by design.
- Never written to disk on either device — memory only.
- The server never had the plaintext and keeps nothing, not even logs.
- Background the app and anything unread is wiped on the spot.
- Encrypted with keys that live only on the two devices.
What no app can promise
- Screenshots and cameras exist. Browsers cannot block or detect them — and anyone who claims otherwise is selling you magic.
- Vanisher adds deterrents, not blocks: hold-to-reveal, a per-recipient watermark, and a wipe when the app goes to the background.
- A determined recipient with a second device can always photograph a screen.
- Anyone who holds your key can tell whether you’re online.
“We would rather tell you exactly what this is than sell you magic.”
No inbox
Both of you, online at once. That’s the design.
There is no queue of messages waiting for you on a server — because a stored message is a stored liability. You’ll see “Waiting for Frost to come online…”, and your message goes the moment they do.
If it never gets through, it was never kept anywhere. Not in a drafts folder, not in the cloud, not on disk. It existed on your device, in memory, and nowhere else.
One honest caveat: on iOS, the connection drops whenever the app goes to the background, so expect some “not read, expired” results. We tell you now so it doesn’t surprise you later.
Where this goes
Shipped in daylight, in order.
Private testing — live text chat
Identities, invite links, safety numbers, end-to-end encrypted text with hold-to-reveal, timers and two-sided vanish. Text first, got it right first.
View-once images
Sent peer-to-peer over WebRTC, encrypted with the session key. The relay only ever forwards signalling — images never touch a server.
Download-once documents
The recipient can keep their copy — and we’ll say so plainly, because they can. Vanisher deletes what Vanisher held: everything.
Quiet extras
An optional “knock” alert — off by default; enabling it stores only a notification address, never a message — and an Android build.
Straight answers
Questions people actually ask.
Does the server really store nothing?
Really. The relay holds ciphertext in RAM for the milliseconds it takes to forward it between two live connections, then forgets. There is no database, nothing is written to disk, and there are no access logs. Turn it off and on again and it comes back empty — because there is nothing to remember.
Can Vanisher block screenshots?
No — and neither can any web app. Browsers cannot block or detect screenshots. What Vanisher does is raise the cost: messages stay hidden until held, carry a watermark of the recipient’s name and key fingerprint, and vanish when the app is backgrounded. We call them deterrents because that is what they are.
What happens if I lose my phone?
Your identity is gone. The key lives only on your device, encrypted; there is no server copy and no recovery by design. You can export an encrypted copy of your key (passcode-protected) if you want a backup — that file is yours to guard. A new device means a new identity.
Who can tell whether I’m online?
Anyone who holds your public key can test whether you’re connected — that’s inherent to live delivery. But keys are not listed in any directory; only people you’ve given your key to can do it, and you can always see who your contacts are.
Why do both people have to be online?
Because nothing waits on a server. A message that sat in a queue somewhere would be a message that exists somewhere — and then we’d be storing things, which is exactly what Vanisher doesn’t do. Live-only is the privacy guarantee wearing a slightly less convenient coat.
What does Vanisher know about me?
While you’re connected, the relay sees your public key and ciphertext passing through — never your nickname, phone number or email, because it never receives them. There is no account to attach a profile to, and nothing is logged.
Vanisher is in private testing.
A small circle is kicking the tyres on live, vanishing chat right now. The public build arrives when it’s honest to say it’s ready — not a day before.
In private testing