In plain English Every feature below has a one-line plain-English summary. If the technical line is more than you want, the summary is all you need. For definitions of any term, see the glossary.
Anonymous registration
Your account is created with an auto-generated 8-character PIN PIN (in beChat) A random 8-character code your phone generates when you install beChat. It is your account identity, like a gym locker number. It is not a password you choose, and it says nothing about who you are. Click for full glossary → and device fingerprint Device fingerprint A unique identifier derived from your phone's hardware. beChat pairs it with your PIN so your account is bound to your physical device, without ever collecting your name, email, or phone number. Click for full glossary →. beChat does not require email, phone number, or legal name.
In plain EnglishYou get a random 8-character code, like a gym locker number. The app asks for your name, email, or phone number nowhere in the process.
End-to-end encrypted messages
Messages are encrypted with a Double Ratchet Double Ratchet The key-ratcheting construction beChat implements for end-to-end encryption, the same mechanism Signal and WhatsApp use. It generates a brand-new key for every message so a single compromised key does not expose past or future messages. Click for full glossary → construction plus post-quantum cryptographic protection. The server stores encrypted blobs but cannot decrypt message content.
In plain EnglishYour messages are scrambled on your phone and only unscrambled on your contact's phone. The server in the middle only ever sees noise.
Encrypted attachments
Attachments are encrypted with AES-256-GCM-SIV AES-256-GCM-SIV The encryption beChat uses to scramble message content and attachments. It is a hardened variant of AES-256-GCM, the standard the U.S. government approves for top-secret documents, designed to stay safe even if a nonce is accidentally reused. Click for full glossary → before upload, so file content is protected before it leaves your device.
In plain EnglishPhotos and files are scrambled before they leave your phone, using a hardened variant of the encryption approved for U.S. top-secret documents.
Encrypted local storage
Local message data is stored in SQLCipher SQLCipher An encrypted version of the database that stores your chat history on your phone. It is locked by your PIN, so without the PIN even someone holding your phone sees only scrambled noise. Click for full glossary →-encrypted storage keyed by the user's PIN PIN (in beChat) A random 8-character code your phone generates when you install beChat. It is your account identity, like a gym locker number. It is not a password you choose, and it says nothing about who you are. Click for full glossary →.
In plain EnglishYour chat history on your phone is locked behind your PIN. Without it, even someone holding your phone sees only scrambled noise.
Transport protection
Requests use TLS TLS The encryption that protects the connection between your phone and a server, the same technology that puts the padlock in your browser. beChat uses it for every request. Click for full glossary →, certificate pinning Certificate pinning A rule where your phone only trusts one specific ID badge for the beChat server. So even if someone fakes a badge that looks officially issued, your phone refuses to talk to them. Click for full glossary →, and HMAC request signing HMAC request signing A tamper-proof seal on each network request that proves it really came from your account and was not modified on the way. Works alongside TLS for defense in depth. Click for full glossary → to protect transport integrity.
In plain EnglishThe connection between your phone and the server is tamper-proof and refuses impostors.
No third-party tracking
beChat does not include analytics, crash reporting, advertising libraries, or third-party SDKs SDK A "software development kit," a bundle of third-party code an app can include. Many apps include analytics or advertising SDKs that quietly collect your behavior. beChat includes none of those. Click for full glossary →. The only external service it uses is Google Firebase Cloud Messaging for Android push notifications, and those payloads carry no message content.
In plain EnglishThe app skips analytics, ads, crash reporters, and third-party data collectors entirely. The only external service it touches is Google push delivery, which never sees your message content. It does not quietly report home to anyone.
Group chats
Multi-participant conversations are end-to-end encrypted with the same Double Ratchet construction used for 1:1 chats. The server routes encrypted blobs without learning group membership or message content.
In plain EnglishYou can talk to several people at once in an encrypted group. The server only sees sealed envelopes being moved around, never the names of the people in the group or what they say.
1:1 voice and video calls
One-to-one voice and video calls are end-to-end encrypted. Group voice and video calls are not yet available.
In plain EnglishYou can call one other person by voice or video, and the call is scrambled end to end so nobody in between can listen in. Group calls are coming but not ready yet.
Voice messages
Voice notes are encrypted like any other attachment before they leave your device, using AES-256-GCM-SIV AES-256-GCM-SIV The encryption beChat uses to scramble message content and attachments. It is a hardened variant of AES-256-GCM, the standard the U.S. government approves for top-secret documents, designed to stay safe even if a nonce is accidentally reused. Click for full glossary →. The server stores only the encrypted audio blob.
In plain EnglishVoice notes are scrambled on your phone before they are sent, just like photos and files. The server only ever sees the scrambled version.