LADON messenger is the iPhone messenger that knows nothing about you. No phone number. No account. No trace. Not WhatsApp, not a hacker, not a government — not even us. Just the two of you.
Police, hacker or data broker — whoever demands everything we have on you gets exactly this file. No name, no number, no contacts, no content. What the servers hold is sealed: a random ID, encrypted mail waiting to be picked up, and encrypted attachments until they expire. We can't hand over what we never had.
Requested: everything we hold about this user. Delivered:
To surveil you, someone doesn't even need to read your messages. Who with whom, when and how often — that often reveals more than the content itself.
Even without the content, someone can build a full profile of you — just from your connections.
Sender sealedEven encrypted traffic gives you away: its rhythm shows exactly when a real conversation is happening.
Hidden by cover trafficToday's data gets archived. In a few years, quantum computers decrypt it all at once.
Quantum-safe todayA phone number, email or device ID instantly links your "private" account to your real name.
No identity to linkSince July 2026, providers in the EU may once again scan messages without any suspicion — and the follow-up law on the table would make scanning mandatory. LADON messenger was built for exactly this moment: our servers see only noise. No text, no sender, nothing to hand over.
Between your keyboard and your contact's screen, every message goes through this — automatically, before it ever leaves your phone. No setup, no buttons. Keep scrolling.
Turned into code only your contact can open — before it leaves.
Every message gets its own key. Crack one, the rest stay sealed.
The server passes it on without ever learning who sent it.
Padded to a fixed size and hidden among fake messages over Tor.
Other messengers promise security. Here's who actually delivers what.
| Feature | LADON messenger | Signal | Telegram | iMessage | |
|---|---|---|---|---|---|
| End-to-end encryptedOnly you and your contact hold the keys. | ✓ | ✓ | ✓ | optional only | ✓ |
| New key per messageCrack one message, the rest stay sealed. | ✓ | ✓ | ✓ | — | ✓ |
| Quantum-safeBuilt to resist future quantum computers. | ✓ | ✓ | — | — | ✓ |
| Sender hiddenThe server never learns who sent it. | ✓ | ✓ | — | — | — |
| Built-in TorYour IP address stays hidden, always. | ✓ | — | — | — | — |
| Cover trafficFake messages hide when you really talk. | ✓ | — | — | — | — |
| No phone number requiredNothing ties the app to your identity. | ✓ | paid, Android only | — | — | — |
| No contact uploadYour address book never leaves your phone. | ✓ | — | — | — | — |
| No chat historyMessages vanish after 30 minutes at most, or after 30 seconds if you want. | ✓ | optional only | optional only | optional only | — |
| Panic buttonOne button destroys every key on the phone. | ✓ | — | — | — | — |
| Screenshots blockedScreenshots and recordings show only black. Always on. | ✓ | optional only | view once only | optional only | — |
| No third-party keyboardsNo outside keyboard reads along. Autocorrect is off. | ✓ | — | — | — | — |
| Neutral notificationsAlways just “New encrypted message”, no name, no text. | ✓ | optional only | optional only | optional only | optional only |
| Nobody can find youNo number, no name to search. Contact only via QR code or invite link. | ✓ | — | — | — | — |
| No read receipts, typing or online statusNobody sees when you read, type or are online. Never. | ✓ | optional only | partial | partial | partial |
| No link previewsLinks are never fetched in the background. | ✓ | optional only | optional only | — | — |
| No cloud backupChats are excluded from iCloud backups and never leave the phone. | ✓ | — | — | — | — |
| Quantum-safe signaturesEvery message is also signed with ML-DSA, not just encrypted. | ✓ | — | — | — | — |
| Fresh quantum-safe key every turnEvery reply brings a new ML-KEM key exchange. | ✓ | periodic | — | — | periodic |
| Every message the same size16 KB each, attachments in fixed size steps. | ✓ | — | — | — | — |
| App lock always onFace ID cannot be switched off. 10 failed attempts wipe everything. | ✓ | optional only | optional only | optional only | optional only |
| Text can’t be copiedMessages can’t be copied. Copied IDs leave the clipboard after 10 s. | ✓ | — | — | — | — |
| Servers forget fastMailbox only in RAM, attachments deleted after 24 hours. | ✓ | — | — | — | — |
| Push timing hiddenEvery push is identical and leaves with a random delay. | ✓ | — | — | — | — |
| Open source, app and serversAnyone can check what the code really does. | ✓ | ✓ | — | apps only | — |
As of October 2026, based on each provider's own public documentation. “—” means: not offered or not publicly documented. Signal: post-quantum ratchet (Oct 2025), sealed sender, phone number required at sign-up except a paid Android option (Signal Login beta, Sep 2026), usernames hide it (TechCrunch, Feb 2024), contacts matched as hashes in a server enclave (Signal). WhatsApp: security whitepaper, optional daily contact upload (WhatsApp), no public post-quantum statement (Surfshark, Sep 2026). Telegram: end-to-end only in opt-in secret chats, new keys after 100 messages or a week (Telegram), sign-up with a phone number or a paid anonymous number, open apps but closed server (IEEE Spectrum), disappearing messages (Telegram), screenshot block for groups and channels, and with Premium in one-to-one chats (Telegram; Telegram). Disappearing messages are optional at Signal (Signal) and WhatsApp (WhatsApp). Screenshot block is optional at Signal (Signal) and covers only view-once media at WhatsApp (TechCrunch, Aug 2022). Hiding name and text in notifications is a setting everywhere else (Signal; iOS: Apple). iMessage: PQ3 protocol with a new key per message (Apple, Feb 2024), tied to an Apple Account, recipient numbers and addresses are looked up on Apple’s directory server, routing metadata unencrypted (Apple Platform Security), no sender hiding documented, closed source. Signal lets you switch off read receipts (Signal), typing indicators (Signal) and link previews (Signal); WhatsApp can hide read receipts, last seen and online, not typing (WhatsApp), and can stop sending link previews (WhatsApp); Telegram can hide last seen (Telegram); iMessage can turn off read receipts (Apple). Cloud backups exist at Signal (BleepingComputer), WhatsApp (WhatsApp) and iCloud (Apple); Telegram keeps normal chats in its cloud (Telegram FAQ). Signatures stay classical at Signal (PQXDH spec) and iMessage (PQShield); Signal spreads new quantum-safe keys across several messages (Signal), iMessage re-keys about every 50 messages (Apple). Signal (Signal code), Telegram (Telegram) and iMessage (Apple) pad messages only partly, not to one fixed size. App lock is optional at Signal (Signal), WhatsApp (WhatsApp), Telegram (Telegram FAQ) and for iMessage via iOS (Apple).
Every claim on this page can be checked against code you can read yourself.
App and servers, under the AGPL-3.0. The README ties each security claim to a file and a line.
Open on GitHub 02 — PROOFProVerif and Tamarin models of pairing and the ratchet, with the scripts that check them.
See the models 03 — LICENCESTor, liboqs, SQLCipher and every other part we ship, with its licence text.
See the licencesJournalists protecting a source. Lawyers and doctors bound to secrecy. Activists in the wrong country at the wrong time. And you — because a private life shouldn't be a privilege for tech professionals. You don't need a reason to close your curtains.
No sign-up. No data. No waiting. You install — and start writing.
From the App Store the day LADON messenger launches — free, no invite needed. Needs an iPhone with iOS 26 or later.
No account. No number. No email. On first launch, LADON messenger creates your key right on your phone.
Every message is encrypted automatically — before it leaves your phone. There's nothing to set up.
Honest about where we are — and where the Kickstarter takes us.
Entry and exit run on one machine. The roles are separate in software — whoever controls the machine could still correlate timing.
When the app is ready, the campaign goes live. The waitlist gets one email — nothing else.
Spread across different jurisdictions, so no single country or operator sees both sides. The app stays free unless the servers can't carry the growth.
LADON messenger is free, and its code is public. Anyone can check what the app does. The servers your messages travel through cost money every month, and right now I pay for them myself. If LADON messenger grows and the servers need a real upgrade, the app may one day cost CHF 2 to 5 per month. If it comes to that, you'll hear it here first, with the reasons. What won't change: no ads, no trackers, no selling of data. You are never the product.
Technically, LADON messenger has protection layers Signal doesn't offer today: cover traffic, built-in Tor, keys sealed by Apple's security chip, quantum-safe signatures. Signal, in turn, has years of independent audits and hundreds of millions of users. Security is more than code — it's trust, scrutiny and reach. For most users, Signal remains the right choice today.
If someone records your encrypted messages today, they will likely be able to decrypt them with quantum computers within a few years. LADON messenger combines classical and quantum-safe encryption. An attacker would have to break both — so recording today's traffic to decrypt it later is built not to pay off.
Your keys exist only on your device. There's no cloud backup and no recovery service. You'd have to scan new QR codes with your contacts. That's inconvenient — but no one can steal your keys from a cloud.
No. Neither we nor the server operator can decrypt anything. A seizure turns up only sealed data packets, each tied to a random ID — no names, no phone numbers, no sender.
LADON messenger automatically sends fake messages at regular intervals through the same line as your real ones. An observer can't tell what's real and what's just camouflage.
Right now it doesn't: the app is free, the code is public, and I pay for the servers myself. If LADON messenger grows beyond what the servers can carry, it may one day cost CHF 2 to 5 per month — announced here first, with the reasons. No ads, no trackers, no selling your data.
iPhone 11 or newer and iPhone SE (2nd generation) or newer, with iOS 26 or later. iOS 26 is needed because only from that version on can Apple’s security chip hold the quantum-safe key that seals your keys.
A small team's focus: get one platform right before tackling the next. Android is on the roadmap.
LADON messenger launches in 2026. Get a single email when the App Store build is live — no marketing, no follow-ups. Promised.
You'll get a confirmation email. Your address is used only for the launch notification.