MLS for every chat
The IETF's Messaging Layer Security (RFC 9420): forward secrecy and post-compromise security. A one-to-one chat is simply a group of two.
Flux is an end-to-end encrypted messenger that lives in your browser. Every chat is an MLS group, envelopes carry no sender, and the server can't tell who is writing to whom.
No phone number. No app store. Just a browser.
The IETF's Messaging Layer Security (RFC 9420): forward secrecy and post-compromise security. A one-to-one chat is simply a group of two.
Envelopes have no "from". You write with a token your contact handed you inside the encrypted chat, over a connection that isn't logged in.
Ordinary TLS on port 443, every frame padded to one of five sizes, random cover pings. No protocol signature for a filter to catch.
MLS encrypts it, then it is padded so long and short messages look the same.
A second, logged-out connection puts it in your contact's mailbox with their send token.
The server stores an opaque blob and sends a push with no content at all.
Their device decrypts it and confirms; the server deletes the blob for good.
SQLite and the web app are inside. Put it behind nginx and you have a private messenger for your people.
./flux-server --addr 127.0.0.1:8787 --beta
./flux-server invite 5
The source opens under AGPL-3.0 together with the public beta.