How to use this

Terms are grouped by theme. Each definition is one sentence in everyday language. If a definition still feels too technical, the post-quantum encryption guide walks through the hardest concepts with analogies.

The basics

Encryption: Scrambling information so that only someone with the right key can read it. The scrambled form is called ciphertext; the readable form is called plaintext.
End-to-end encryption (E2EE): Encryption where only the two people talking can read the messages. The service in the middle cannot. The server sees scrambled noise, not your words.
Plaintext: The readable, unscrambled version of a message or file. This is what encryption protects. beChat never sends plaintext over the network or stores it on the server.
Ciphertext: The scrambled, unreadable version of a message after encryption. It looks like random noise to anyone who does not have the key.
Public-key cryptography: A way to encrypt things using two linked keys: a public one you can share with anyone, and a private one you keep secret. It is how two phones that have never met agree on a shared secret over an open network.
Symmetric encryption: Encryption where the same key both locks and unlocks the data. Faster than public-key cryptography, and what beChat uses to scramble the actual message content (AES-256-GCM-SIV).
Key: A long random number used to lock or unlock encrypted data. A longer, more random key is harder to guess. beChat uses 256-bit keys for message content.
Digital signature: A mathematical stamp that proves a message really came from you and was not altered in transit. Only your private key can produce it; anyone with your public key can verify it.

The post-quantum world

Quantum computer: A different kind of computer that uses quantum physics to solve certain specific math problems extremely fast. It works on different principles than your laptop, not just faster hardware.
Qubit: The quantum equivalent of a bit. Unlike a normal bit (0 or 1), a qubit can be both at once. Linking many qubits together is what gives a quantum computer its power for certain problems.
Shor's algorithm: A 1994 mathematical trick that lets a quantum computer break the encryption used by most of the internet, including the key exchange in Signal and WhatsApp. It is the reason post-quantum cryptography exists.
Post-quantum cryptography (PQC): A new generation of encryption built from math problems that no one has found a way to solve quickly, not even with a quantum computer. It is insurance against a future machine that does not exist yet.
Harvest now, decrypt later: An attack where someone records your encrypted traffic today, while it is still unbreakable, and stores it for years until a future quantum computer can crack it. It is why post-quantum encryption matters now, not later.
Lattice-based cryptography: A family of post-quantum math problems built on multi-dimensional grids (lattices) of points. They are hard for both normal and quantum computers. ML-KEM and ML-DSA are lattice-based.
Key encapsulation mechanism (KEM): A way for two devices to agree on a shared secret over an open network, with the secret locked inside a box only the recipient can open. ML-KEM is a post-quantum KEM.

The algorithms beChat uses

ML-KEM: The post-quantum key-exchange algorithm beChat uses to let two phones agree on a shared secret that a future quantum computer cannot figure out. Standardized by NIST as FIPS 203.
ML-DSA: The post-quantum signature algorithm beChat uses to prove who sent a message and that it was not tampered with. Standardized by NIST as FIPS 204.
AES-256-GCM-SIV: The encryption beChat uses to scramble message content and attachments. It is a hardened variant of AES-256-GCM, the standard the U.S. government approves for top-secret documents, designed to stay safe even if a nonce is accidentally reused.
Double Ratchet: The key-ratcheting construction beChat implements for end-to-end encryption, the same mechanism Signal and WhatsApp use. It generates a brand-new key for every message so a single compromised key does not expose past or future messages.
Double Ratchet: The algorithm that generates a brand-new key for every single message. If one key ever leaks, the others stay safe. This is what provides forward secrecy.
Forward secrecy: A property where every message uses its own fresh key, so a key stolen today cannot unlock messages sent yesterday or tomorrow. The Double Ratchet provides this automatically.

Accounts and your phone

PIN (in beChat): A random 8-character code your phone generates when you install beChat. It is your account identity, like a gym locker number. It is not a password you choose, and it says nothing about who you are.
Device fingerprint: A unique identifier derived from your phone's hardware. beChat pairs it with your PIN so your account is bound to your physical device, without ever collecting your name, email, or phone number.
Zero-knowledge (server): A design where the server that runs the service cannot read your data. The beChat server stores only scrambled blobs. It has no key to unscramble them. Think of it as a post office that moves sealed envelopes but cannot open them.
SQLCipher: An encrypted version of the database that stores your chat history on your phone. It is locked by your PIN, so without the PIN even someone holding your phone sees only scrambled noise.
SIM swap attack: When an attacker tricks a telecom provider into moving your phone number to a SIM card they control. They then receive your calls and SMS one-time passwords. beChat is immune because it does not use phone numbers or SMS at all.
SS7 (Signaling System No. 7): The 1970s-vintage protocol telecom networks use to route SMS messages between operators. It has no encryption and no sender authentication. Anyone with access can read texts in transit. This is why beChat does not use SMS.

The connection and the infrastructure

TLS: The encryption that protects the connection between your phone and a server, the same technology that puts the padlock in your browser. beChat uses it for every request.
Certificate pinning: A rule where your phone only trusts one specific ID badge for the beChat server. So even if someone fakes a badge that looks officially issued, your phone refuses to talk to them.
HMAC request signing: A tamper-proof seal on each network request that proves it really came from your account and was not modified on the way. Works alongside TLS for defense in depth.
Firebase Cloud Messaging (FCM): Google's service for delivering push notifications on Android. beChat uses it only to tap your phone and say "wake up, fetch something." The notification contains no message content, and the message itself never goes through Google.
SDK: A "software development kit," a bundle of third-party code an app can include. Many apps include analytics or advertising SDKs that quietly collect your behavior. beChat includes none of those.
NIST: The U.S. National Institute of Standards and Technology. It ran the multi-year public competition that chose the post-quantum algorithms beChat uses (FIPS 203 and 204). It also standardized AES and SHA-3.
FIPS: Federal Information Processing Standards, the official U.S. government standards for cryptography. FIPS 203 and 204 are the post-quantum standards beChat uses.

Still confused about something?

Read the full how beChat works walkthrough, the plain-English guide to post-quantum encryption, or check the FAQ. For anything else, email privacy@bechat.world.

Every term, in plain English.