Sealed. Dropped. Delivered.

Like a night deposit box: every message is a sealed envelope, dropped for one person only, opened by no one in between. Anonymous, end-to-end encrypted 1:1 chat over Tor. No accounts. No phone number. No server-side keys. No logs.

Get Night Drop See how it works

Free and open. Peer-to-peer over Tor. Android · Linux.

Built privacy-first, from the ground up

🕵️ Anonymous by default

No sign-up, no email, no phone number. Your identity is a key that lives only on your device. The default name is just “Anon”.

🔒 End-to-end encrypted

Every message uses the Signal Double Ratchet. Only you and the person you’re talking to can read it — with forward secrecy on every message.

🧅 Peer-to-peer over Tor

Messages travel directly between devices through the Tor network. There’s no central server watching who talks to whom.

📵 No server-side keys, no logs

We can’t read your messages because we never hold your keys — and we keep no logs. There’s nothing to hand over, because there’s nothing to keep.

📱 Local-first storage

By default your history stays on your device, encrypted at rest. Optionally store it on the server for 24 hours to save space — and both of you are clearly warned while that’s on.

🛂 You approve who reaches you

Pair by QR code or a short code with a shared secret. A stranger can’t message you until you approve the request.

📮 Delivered even when they’re offline

If your contact is offline, the encrypted message waits on an untrusted relay for up to 24 hours — it sees only ciphertext, never content. You see when it’s queued and when it’s delivered.

🛰️ More ways to reach you

Add extra relays that also hold your mailbox. Messages are copied to all of them, so one relay being down or blocked doesn’t drop your mail — and every relay still sees only ciphertext. Run your own if you like; nothing about it is trusted.

📷 Photos and videos, encrypted too

Attachments travel end-to-end encrypted like every message, and are stored sealed on your device. Images are compressed on-device so they move fast over Tor.

🗝️ Backups you own

Optional encrypted backups protected by a recovery password shown to you exactly once — never stored, never sent anywhere. Lose the password, lose the backup: that’s the point. Restore keeps your identity and chats.

🎚️ Back up your way

Choose Lite (just your identity and contacts, no messages) or Full (with history and media) — save it to a file, or opt in to an encrypted 24-hour copy on the server that only your password can open. You can even back up a single chat and merge it back later.

⏱️ Disappearing messages

Set a per-chat timer — an hour, a day, a week — and older messages delete themselves on both devices. It’s a shared setting, so changing it keeps both sides in sync.

↩️ Unsend and edit

Change your mind? Edit a message or delete it for everyone. If it hasn’t reached them yet it’s pulled back before it ever arrives; if it has, it turns into a “deleted” marker on both sides.

🫥 Nothing hidden between you

When the other person keeps a backup of your chat, or turns on 24-hour server storage, you see a clear, persistent warning. Privacy you can’t see isn’t privacy — so the app tells you where your messages live.

🔕 Notifications without leaks

New-message alerts are generated on your device and say only “New message” — no content, no sender, and nothing goes through a push provider tied to your identity. On Android you can opt in to keep receiving them in the background over Tor — still with no push provider.

🧹 Leave without a trace

Delete a chat and the other person is told; log out and your identity, keys, messages, and decrypted files are wiped from the device. Nothing lingers on a server, because nothing was there.

💻 One app, every device

Android and Linux from one codebase — with the same Rust security core doing the cryptography on every platform.

Why Night Drop is different

Most “private” messengers still tie you to a phone number, keep metadata on their servers, or hold keys that can be compelled. Night Drop is designed so there is simply nothing to collect.

Night Drop

  • ✅ No phone number or account
  • ✅ No server-side keys
  • ✅ No logs, minimal metadata
  • ✅ Peer-to-peer over Tor
  • ✅ Local-first; optional 24h server storage with a warning
  • ✅ You approve contacts before the first message
  • ✅ Encrypted backups only you can open — Lite, Full, or one chat
  • ✅ Disappearing messages and delete-for-everyone
  • ✅ Clear warnings when a message is stored or backed up
  • ✅ Donations in privacy coins — no payment trail

Typical “secure” chat apps

  • ⚠️ Require a phone number that identifies you
  • ⚠️ Keep accounts and metadata on central servers
  • ⚠️ Hold keys or routing data that can be compelled
  • ⚠️ Connect over the open internet by default
  • ⚠️ Store history in the cloud, sometimes by default
  • ⚠️ Anyone with your number can reach you
  • ⚠️ Cloud backups the provider can open or be compelled to share
  • ⚠️ Quietly sync or store data without telling you
  • ⚠️ Paid tiers tied to your identity

Get Night Drop

One app, every device.

Running 0.1.15 on Linux? Please update.

The Linux download on this page pointed at 0.1.15 for longer than it should have. If you downloaded the Linux AppImage before 5 August 2026, you are very likely on that build, and it is missing three fixes that matter:

A new identity could come up on your previous identity's .onion address — reachable by anyone who knew the address you walked away from, and linkable to the identity you thought you had left. A shut-down transport could fall back to resolving a relay through your system DNS resolver instead of Tor. And a message the other person never received could still show as “Delivered”.

Download again from this page to get the current release. Your identity, chats and contacts are stored locally and are not affected by replacing the AppImage.

Android was never affected: that link has always resolved to the latest release. Nothing about your data was exposed to us — we have no accounts, no logs and no way to tell who is running what.

The Android button opens the list of builds so you can pick one. The universal build runs on any phone; the per-processor builds are roughly a third the size, and arm64-v8a suits almost every phone made since 2015. If you install a per-processor build you can't switch back to the universal one without uninstalling first, because Android reads it as a downgrade.