Security in layers.
Plain words first. The standards and the limits one tap below. Nothing we can’t show you.
Made on your device. Never on ours.
One account key is made on your first device and kept in its secure store. Your 24-word recovery kit, or a passkey, brings it back if every device is lost.
- Where keys live
- In your device’s system key store, wrapped by its Secure Enclave or TPM where the device has one. On Linux there is no such wrap.
- Recovery
- Your 24 recovery words or a passkey bring your account key back. We never store either, so we can’t recover it for you. The words follow BIP-39.
- Signing
- Each device signs with its own key, and a signed list of your devices is published to a public key log. Signatures use ML-DSA-87 (FIPS 204).
- 01
- 02
- 03
- 04
- 05
- 06
- 07
- 08
- 09
- 10
- 11
- 12
- 13
- 14
- 15
- 16
- 17
- 18
- 19
- 20
- 21
- 22
- 23
- 24
- Key made
- ······
- Held by LMN8
- ·····
New devices get in when you say so.
Sign in on a new device, then approve it from one you already have; the codes on both screens must match. Removing a device changes the account’s keys.
- Approval
- Sign in with a password, passkey or one-time code, then approve from a device already on your list. The six-digit code is a commit-then-reveal over SHA-384.
- Key transparencyObserve mode
- Every device key is published to a public log, so a swapped key can’t hide. Today the log records problems rather than blocking them, and LMN8 runs its only witness; independent witnesses are planned.
- Sign-in codes
- Text, WhatsApp or email codes only sign you in. They never carry keys.
- Codes
- ·····
- New device
- ········
Only the people in the chat can read it.
Every chat agrees its own keys. Calls take their keys from the chat, and everyone on a call sees the same code to compare.
- Standard
- Chats use a post-quantum cipher suite: ML-KEM-1024, AES-256-GCM, SHA-384 and ML-DSA-87. Its code point comes from an IETF draft and may change once. The protocol is MLS (RFC 9420).
- Calls
- Calls take their keys from the chat and only start in a post-quantum chat. Frames are encrypted with SFrame (RFC 9605).
- History
- The server keeps encrypted history without a key to it. Delete for everyone destroys a key, so offline copies become unreadable too, within the 24-hour offline window.
- Server limit
- Messages nobody collects are deleted after 30 days.
- Chat keys
- ·······
- Call code
- ·· ·· ·· ··
Encrypted before it leaves. Opened only on theirs.
Shares, Cloud files, attachments and vaults are one kind of encrypted file. What changes is where it lives and who can open it.
- Content
- Encrypted in chunks and padded, so sizes give little away. The cipher is AES-256-GCM.
- Shares
- The key is encrypted to each recipient device and the rules (expiry, views, view only) are signed. Opening asks the server for its half, so revoke and expiry work even on a downloaded file, within a 24-hour offline window. ML-KEM-1024 and ML-DSA-87.
- Cloud
- Keys are derived from your account key. We store objects, sizes, times and region, never names or contents.
- Vaults
- Opened by your password, stretched with Argon2id, and encrypted with AES-256-GCM.
Vault: lives on your device; opened by your password.
- Lives
- on your device
- Opened by
- your password
The key goes first.
Zero encrypts the file with a one-off key, destroys the key, then overwrites, trims and checks what’s left, and can sign a certificate.
- Method
- The report records the passes actually written and whether the drive confirmed TRIM. The approach is the Clear method of NIST SP 800-88.
- Certificates
- Each certificate is signed, and anyone can check one on the Verify page. The signature is ML-DSA-87.
- SSDs
- Best effort: SSDs move data out of reach of any app. That’s why the key goes first.
- Remote Zero
- Commands are signed on the sending device and checked on the target device.
- Key destroyed
- Overwritten, then checked
- Copies on your other devices too
What our servers see, listed.
Who talks to whom and when. Padded sizes. Your account details and public keys. Never the words, files or keys.
| Part | Our servers see | Never see |
|---|---|---|
| Chat | Our servers see: Who is in which chat, who sent each message and when, padded sizes | Never see: Message text, file or chat names, timers or read receipts |
| Calls | Our servers see: Who joins which call, and when; encrypted frames passing through | Never see: What is said or shown, or the call keys |
| Share | Our servers see: Who shares with whom and when; file counts and sizes, within about 12% | Never see: File names or contents, the share key, a link’s secret or password |
| Cloud | Our servers see: How many objects you store, their sizes and times, and the region | Never see: Names, folders or contents, which object is which, or your keys |
| Vaults | Our servers see: Nothing, on your device; in Cloud, one encrypted object and its size | Never see: Your password or key, what’s inside, or whether a decoy exists |
| Zero | Our servers see: That a Remote Zero was sent; a certificate’s counts, times and method | Never see: Which files you zero, their names or contents, or their keys |
| SOS | Our servers see: That an SOS is live; your contacts’ phone or email; encrypted location frames | Never see: Where you are, or your messages to contacts |
| Devices | Our servers see: Your username, public keys, signed device list and device approvals | Never see: Your account key, private keys or recovery kit |
| Footprint | Our servers see: One encrypted summary per device, and when it was replaced | Never see: What was found or where, file names or contents |
| Assistant | Our servers see: Nothing: it runs on your computer | Never see: File names or paths, file contents, or your prompts |
- Transport
- TLS 1.3 only to our servers, with a hybrid post-quantum key exchange (P-384 with ML-KEM-1024). Storage uploads use the provider’s TLS, at best a hybrid with ML-KEM-768; everything sent there is already encrypted.
- Residency
- Your data is kept in your region, under its local laws. Files go to the region you pick.
- Retention
- Uncollected messages: 30 days. SOS data: 24 hours after it ends. Ended shares: removed at once. Cloud Trash: 30 days.
Help that stays on your computer.
The Assistant runs on your own computer, shows a plan, and does nothing until you approve. No file name, path or prompt is sent anywhere.
- Where it runs
- On your own computer: inference happens on the device, and nothing is sent to us.
- Models
- Optional models come from a signed list, and each is pinned by its hash.
- Deleting
- Anything it deletes goes through Zero, after a seven-day holding area.
Built for the computers that don’t exist yet.
Data copied today could be opened by quantum computers later. Every key exchange and signature in LMN8 uses the algorithms NSA chose for that future.
- Suite
- NSA CNSA 2.0: ML-KEM-1024 (FIPS 203), ML-DSA-87 (FIPS 204), AES-256-GCM, SHA-384 and HKDF-SHA-384.
- CertificationPlanned
- CNSA 2.0 is the algorithm standard we follow, not a certificate. A FIPS 140-3 lab certificate for our encryption module is the next step.
- Still classical
- WebRTC’s transport under calls. App-update and key-log signatures carry Ed25519 beside ML-DSA-87. Device TLS client certificates use P-256, in observe mode. Sign in with Apple, Google or a passkey relies on their signatures, and only signs you in.
And this is 2 of the maze’s 1,024 directions. Your key is out there.
What no app can promise.
Every promise on this page has an edge. Here they are, in one place.
- View only is best effort
Watermarks and screenshot blocking make copying harder, not impossible. A screen can still be photographed.
- SSDs keep their own secrets
SSDs move data around out of reach of any app, so deletion on them is best effort. That’s why the key goes first.
- Some metadata is visible
Our servers can see who chats and shares with whom, when, and roughly how much.
- A decoy has limits
A decoy password is a shield against pressure, not magic. A vault’s size hints at the size of what it holds.
- A password is the real lock
Argon2id makes guessing slow, but a short or reused password is still a weak one.
- An unlocked device is you
Malware on your unlocked, approved device can do what you can. The key log detects a swapped key; it doesn’t prevent one.
- Kept under your local laws
Your account details and device list are kept in your region and handled under its local laws, whichever Cloud region you pick for files.
- Not an anonymity tool
Our servers see your IP address and the email or phone you sign up with. LMN8 hides what you say and store, not that you use it.
The same protection on every plan.
Noob is free for good, with 10 GB Usage Data, up to 2 GB in the cloud. Paid plans start at ₹149 a month, GST included, and you can try Vanish free for 7 days.