SimpleX Chat

SimpleX: the first network where you own your identity, contacts, and groups. Secure / decentralized / open-source. Get the app: https://simplex.chat/downloads

Security assessments:
2022: https://simplex.chat/blog/20221108-simplex-chat-v4.2-security-audit-new-website.html
2024: https://simplex.chat/blog/20241014-simplex-network-v6-1-security-review-better-calls-user-experience.html

website: https://simplex.chat
github: https://github.com/simplex-chat
donate: https://simplex.chat/donate
release key: https://keys.openpgp.org/vks/v1/by-fingerprint/BBDF7BDAD1548B16836AF5B9D53BDFD153C366BA

Public Key

npub1gsunl7x2y8ka4rn72y9zmzh0j8ntw8ln3956dxe4vg2mldpt4svsuzfy6l

NIP-05 Address

[email protected]

Profile Code

nprofile1qqsygwfllr9zrmw63el9zz3d3there4hrlecj6dxnv6ky9dlks46cxgprpmhxue69uhhyetvv9ujumt0d4hhxarj9ecxjmntp0rc5h

Publishing to

relay.momostr.pink

Author Public Key

npub1gsunl7x2y8ka4rn72y9zmzh0j8ntw8ln3956dxe4vg2mldpt4svsuzfy6l

Show more details

Last Notes

2025-12-31 09:49:35 UTC

Happy New Year!
Thank you for your incredible support of SimpleX network in 2025:
- to users for over 2,000,000 app downloads and thousands of groups.
- to enthusiasts for hundreds of community servers.
- to businesses/projects using SimpleX Chat for customer/user support.
- to developers for SimpleX integrations and libraries.
- to all who donated, and especially to
Vitalik Buterin for his game-changing donation of 128ETH.
2026 will be great for privacy and for SimpleX network!

2025-07-19 14:13:04 UTC

- reply

We're all good, no hard feeling here at all, and thank you for the comments.
As for being targeted - there's no such thing as a bad publicity, and mass-media writes lots of shit, that fewer and fewer people pay attention to - they lost all influence they had.
You need to tell your story.
E.g. see this: https://simplex.chat/blog/20241016-wired-attack-on-privacy.html

2025-07-11 07:31:12 UTC

- reply

No hard feelings, and appreciate the correction. Any way we can help, let us know - e.g., some joint messaging might be helpful.

2025-07-10 17:05:57 UTC

- reply

Just to clarify, what you do or don't recommend, is entirely your business - no hard feelings here.
But not sure what you mean by "sock puppet" accounts, the implication here is that we are creating some accounts that would undermine GrapheneOS? If so, this is ridiculously untrue - all statements we make, we make under our own name.
That various people spread FUD about any system, including SimpleX network and GrapheneOS, is inevitable - whatever is their reasoning.

2025-07-04 15:05:20 UTC

- reply

The presense of code of conduct is a rather recent tradition, and a vast majority of open source code was created prior to the invention of this idea. So most likely having no impact on contributors or contributions, and at worst. Everybody does it because everybody does it, but whether it solves any real problem is unproven and unclear.

2025-07-04 15:02:56 UTC

- reply

At the same time we are strongly against any positive discrimination or preferential treatment to any contributors - it would still be a discrimination. We will publish some document about that, but we find it somewhat academic, and in a way - "cargo-cultish". There is no proof that the presence or absence of code of conduct document affects contributions in any way, and that anybody would refuse to make a contribution solely because this document is absent.

2025-07-04 15:00:03 UTC

- reply

we accept contributions based on whether it benefits the majority of the end users, and on their quality - there is no universal right to contribute. We never look into who makes these contributions, and we obviously would not discriminate against people making contributions. So it is not a question of diversity. And we treat all contributors with equal respect, and remove any comments that are not respectful. So "code of conduct" is just a common sense that we follow.

2025-07-03 19:27:17 UTC

- reply

You are welcome to join users groups, but SImpleX network as a whole is not a community.
It is a technology that allows you can create your own communities – you don't need anybody's permission to use it.

2025-06-06 06:44:02 UTC

- reply

we retweet what we agree with, without dividing people to those who we like or not. Post stuff on X that we agree with, and we would retweet you too.
Regardless of politics and our views on society we all have a common enemy with the goal to take away our rights and liberties. The hate and divide you are spreading shows that you fell prey to this enemy, sadly.
Stay safe. Of all people you should not spread hate.

2025-06-06 06:29:47 UTC

- reply

make love not war. Why so much hate?

2024-12-25 16:10:25 UTC

https://files.mastodon.social/media_attachments/files/113/714/332/722/982/201/original/13030459d6135ce7.png

2024-12-18 19:45:24 UTC

Oppose digital IDs – they break the law and lead to mass scale surveillance.
The UK government plans to introduce digital IDs to prove your age in pubs.
If you are based in the UK, email your MP to voice your opposition - the post has the email draft.
https://simplex.chat/blog/20241218-oppose-digital-ids-they-break-law-lead-to-mass-scale-surveillance.html

2024-12-10 20:41:23 UTC

- reply

added Catalan to weblate

2024-12-10 19:50:31 UTC

- reply

Yes, and sorry! We're a bit drowning in everything!
Make sure to join translators group - ask our support to invite you please

2024-12-10 19:13:10 UTC

SimpleX Chat v6.2 is out!
The app now includes both servers that we operate and servers independently operated by Flux – thanks to Daniel Keller and Flux team!
More privacy and decentralization for all users!
Also in v6.2:
- business chats!
- better UX: open chat on first unread (not on iOS yet), show who reacted.
- better iOS notifications!
Read more: https://simplex.chat/blog/20241210-simplex-network-v6-2-servers-by-flux-business-chats.html

2024-11-26 20:37:26 UTC

- reply

That you believe it's possible means that you either don't understand how strongly protocols impact UX, or you don't understand XMPP limitations well enough, or you don't understand SimpleX differences well enough.
It is simply impossible to build the product we have, with the qualities we already have, leave alone future qualities, based on XMPP.
SimpleX is build around a very different concept of identity than XMPP has, and this is the core of XMPP that can't change.

2024-11-25 21:11:08 UTC

- reply

SimpleX does provide metadata privacy. XMPP doesn't. Why should we use XMPP? It's a rather bloated spec with lots of extensions without any single client or server supporting all of them. Imagine if Web spec was like that.

2024-11-25 19:07:02 UTC

- reply

XMPP has very similar problems as matrix, Matrix was just used as an example of federated messaging network.
Don't think WhatsApp uses it anymore. We believe that protocols only matter if successful products use them, and it's important to be in control of protocol to be able to build a successful product.

2024-11-25 19:02:58 UTC

- reply

We agree, and it is an ongoing improvement. Groups, in particular, consume a lot of traffic and battery.

2024-11-25 19:02:21 UTC

- reply

we have experience with XMPP, and it doesn't provide metadata privacy, and the security of e2e encryption has many limitations. So we're building something better.
The core problem of XMPP is that it was protocol-first, and it's a dead end for any widely adopted software system - it has to be product-first.
We only have wide adoption of the Web thanks to Netscape who made it a product people can use, disregarding competing browsers.

2024-11-25 18:56:49 UTC

- reply

what problem would it solve?

2024-11-25 18:55:02 UTC

- reply

we don't do xmpp, it's different protocol.

2024-11-25 18:54:06 UTC

- reply

we indeed mean that Flux team owns and maintains them, we don't control these servers.

2024-11-25 14:25:47 UTC

Servers operated by Flux (https://runonflux.com) added to SimpleX Chat apps (v6.2-beta.1) to improve metadata privacy – a game changer for SimpleX network users!
https://simplex.chat/blog/20241125-servers-operated-by-flux-true-privacy-and-decentralization-for-all-users.html
Huge thanks for supporting our vision for extreme decentralization of communications!

2024-10-18 16:37:44 UTC

- reply

The quote was taken out of context annoyingly, and rephrased to the point of being distorted.
What was said that we never expected the current groups design to work with more than 50 members. That Groups can work with 1000 members doesn't mean that they are usable - the traffic for senders is really bad, delivery is inconsistent, and ordering got broken. For some scenarios they can be used of course.

2024-10-18 16:35:34 UTC

- reply

it's far from "fixed", but battery usage is much better unless you are active in large groups. Lots' to do still.

2024-10-18 16:34:50 UTC

- reply

we have an idea, and it looks like the blocking got "broken" in the latest release.

2024-10-16 21:31:25 UTC

- reply

It is unfortunately not the case, if it were their article wouldn't merit a response. In our bubble of privacy enthusiasts we forget about a real world where 50% of people, many highly intelligent, trust mass media.
Criminal abuses on non-private platforms, and by platforms themselves (look at criminal cases alleging large platforms enabling child abuse), are under-reported, while privacy is vilified.
So shrugging it off would be wrong, it requires ongoing education and responses.

2024-10-16 21:26:32 UTC

- reply

Great you are using it!
For the record, our response published by Wired was taken out of context and an important part of it was not published.
Wired article violated code of journalism ethics as relates to factual reporting and avoiding harm, so a stronger criticism would have been justified.
Attacks on privacy, irrespective of the angle, are a threat to democracy and path to totalitarianism, so being silent would be a mistake.

2024-10-16 19:29:44 UTC

- reply

Thank you!

2024-10-16 18:39:56 UTC

Our criticism of recently published
Wired article: "Wired's Attack on Privacy"
https://simplex.chat/blog/20241016-wired-attack-on-privacy.html

2024-10-14 17:25:52 UTC

- reply

try v6.1, it works for some users.
https://simplex.chat/blog/20241014-simplex-network-v6-1-security-review-better-calls-user-experience.html

2024-10-14 17:24:12 UTC

New security review by Trail of Bits and new v6.1 released – better calls, better iOS notifications and better user experience!
https://simplex.chat/blog/20241014-simplex-network-v6-1-security-review-better-calls-user-experience.html

2024-09-19 08:20:58 UTC

v6.1-beta.0 is released with support for SOCKS proxies both in iOS (via TestFlight) and Android (via Github releases as direct APK download).
You can host your own SOCKS proxy (this one looks good: https://github.com/heiher/hev-socks5-server) or you can try ours, if you use preset servers (it won't allow connecting to any other servers directly, but you can still send messages to anybody who uses other servers):
Address: 139.162.173.97
Port: 443
Username: user
Password: YJHolWSzTfOny7es

2024-09-19 08:20:18 UTC

- reply

There is a valid reason to add quantum resistant encryption, even though there is 1) no quantum computers 2) no proven encryption algorithms, because security is always the game of chance - and it is better to have the defence that might work, as long as it doesn't replace the defence that works (hence hybrid schemes), than no defence.
"Record now, break later" attacks are no doubt ongoing, at least for some share of communication users. PQ encryption might mitigate them.

2024-09-19 08:18:53 UTC

- reply

No need to apologise.
We wrote in our post (https://simplex.chat/blog/20240314-simplex-chat-v5-6-quantum-resistance-signal-double-ratchet-algorithm.html#adding-quantum-resistance-to-signal-double-ratchet-algorithm):
So, to say it provocatively, post-quantum cryptography can be compared with a remedy against the illness that nobody has, without any guarantee that it will work. While there is a reasonable hope that it might work, so it's not exactly a snake oil, these limitations and risks have to be much better communicated to the end users than they are.

2024-09-16 07:58:39 UTC

- reply

Not sure how it's related. 1) Tor doesn't always prevent blocking. 2) SimpleX Chat can be used via Tor, it doesn't require embedding Tor.
And, actually, a standard SOCKS proxy with 6.1-beta update (today/tomorrow) and 6.0.5 (later this week) will work too.
E.g., this one: https://github.com/heiher/hev-socks5-server

2024-09-14 21:16:45 UTC

- reply

it should

2024-09-14 21:14:06 UTC

- reply

I don't think we said "safe" at any point. We said "resistant".
For several reasons we chose sntrup761, over NIST finalists, in a hybrid construction. Another term experts use in a blog post is "believed to be secure".
https://simplex.chat/blog/20240314-simplex-chat-v5-6-quantum-resistance-signal-double-ratchet-algorithm.html

2024-09-14 21:11:06 UTC

SimpleX Chat is blocked in Russia. We might have a solution next week.

2024-09-05 21:29:27 UTC

- reply

no, SimpleX is not p2p.

2024-09-05 21:00:17 UTC

- reply

point 5 is the footnote to the line specifically about MITM attack, but yes, can be clarified (all these points are footnotes to specific cells in the comparison table).
We probably should modify p2p column from "vulnerable to MITM" to "sometimes vulnerable", as including key material in the address is rather common (although not universal).

2024-09-05 20:43:28 UTC

- reply

Signal allows optional mitigation of MITM attack via security code verification.
SimpleX and some p2p networks non-optionally prevent this attack by passing keys or their hashes as part of the connection link / address.
The table here has this comparison under "2-factor key exchange": https://simplex.chat/blog/20240314-simplex-chat-v5-6-quantum-resistance-signal-double-ratchet-algorithm.html#end-to-end-encryption-security-attacks-and-defense
For example, Session, Cwtch and SimpleX have it. Signal and Matrix do not have it, but offer mitigation.

2024-09-05 20:40:24 UTC

- reply

MITM attack isn't based on mathematics. Please review how it works. It is based on the simple idea: if attacker controls and can substitute all communication between two parties, then it can also substitute all key exchange, and re-encrypt all sent messages.
No key exchange design or mathematics can prevent this attack.
The only way to prevent or mitigate MITM attack is by using some out-of-band channel that attacker cannot substitute for passing some of the key material or hash.

2024-09-05 20:14:16 UTC

- reply

yes, we are working on diversifying the preset operators in the app.
> e2ee protocol is especially designed to be resistant against MITM attacks, you don't need to trust intermediate operators.
Sorry, but this is incorrect. Resistance of ee2e to MITM attacks is achieved by passing some part of the key material out of band - it cannot be achieved via protocol design. If no key material or hash is passed out of band, and all communication happens via operator, then MITM attack is possible.

2024-09-05 20:02:55 UTC

- reply

vulnerability to MITM attack is not special to Matrix - it is present in any operator-mediated key exchange, so it does not need to be documented.
The post I sent has detailed comment on how MITM attack works - it's a general thing, not a protocol specific.

2024-09-05 19:32:11 UTC

- reply

re 5 in Signal, it is no longer the case, even iMessage (and SimpleX) has more secure PQ encryption implementation than Signal, by rotating PQ keys in ratchet steps - something Signal does not do.
See: https://simplex.chat/blog/20240314-simplex-chat-v5-6-quantum-resistance-signal-double-ratchet-algorithm.html
and
https://security.apple.com/blog/imessage-pq3/
You may also look at this:
https://x.com/kaepora/status/1810611336675565934
and this:
https://x.com/kaepora/status/1828466690897703359
Re 5 in Matrix - they can attack key exchange, and compromise e2ee. You cannot just ignore this vector.

2024-09-05 19:24:06 UTC

- reply

"acentral" is some terminological innovation, frankly speaking, the concept of centralization is rather binary - it is either present, in some degree, or not.

2024-09-05 19:22:51 UTC

- reply

we can debate definitions, but the "central helper" is the same, strictly speaking, as "central authority" - if no other party can play "helper" role, then this party automatically becomes "authority" in this network, so there is no difference between these concepts, other than the level of authority.

2024-09-05 19:20:51 UTC

- reply

the comparison puts "No" for dependence of P2P on DNS, which is the good thing about P2P (that's why it's green).

2024-08-31 16:23:52 UTC

Answering your questions about private message routing in SimpleX network:
1. Does SimpleX protect IP addresses? Yes.
2. Doesn't private message routing reinvent Tor? No.
3. Why don't you embed Tor? Tor is great, but not for all.
Read more in FAQ: https://simplex.chat/faq/#does-simplex-protect-my-ip-address

2024-08-30 16:02:33 UTC

- reply

Irrespective of how it is done, changing the brand colours without consent is the violation of the designers and design owners rights.

2024-08-24 12:22:52 UTC

- reply

The invitation links contain all key material and is passed out of band. This results in a large links, but we are about to move to a new design where invitation link will be ~120 characters - it will be a hash of all data represented by that link, so it would still be protected from MITM (and from access by the relay to the information stored in the link). This new design is documented here: https://github.com/simplex-chat/simplexmq/blob/short-links/rfcs/2024-06-21-short-links.md

2024-08-24 12:12:54 UTC

- reply

Thanks to our users who highlighted these inaccuracies to us!

2024-08-24 12:12:42 UTC

- reply

6. Is the design well documented? Somewhat
The design documentation was reviewed in preparation for design security audit - report is about to be published.

2024-08-24 12:12:27 UTC

- reply

5. Does the company log timestamps/IP addresses? Yes
This is incorrect, we never logged IP addresses and access timestamps of the users.
Further, the private message routing that is now enabled by default for all users prevents such logging by any 3rd party servers with modified code:
https://simplex.chat/blog/20240604-simplex-chat-v5.8-private-message-routing-chat-themes.html

2024-08-24 12:12:08 UTC

- reply

4. Directory service could be modified to enable a MITM attack? Yes
This is incorrect, as there is no user directory service, and MITM by relays is not possible by design, even without optional security code verification (that exists to mitigate MITM by the channel you used to pass one-time invitation link, e.g. email).

2024-08-24 12:11:48 UTC

- reply

3. Cryptographic primitives: Curve25519 / XSalsa20 256 / Poly1305 (downgraded for the absence of PQ encryption).
We added PQ encryption in March this year: https://simplex.chat/blog/20240314-simplex-chat-v5-6-quantum-resistance-signal-double-ratchet-algorithm.html
This is done in the same way as Apple describes as PQ3 here: https://security.apple.com/blog/imessage-pq3/

2024-08-24 12:11:07 UTC

- reply

2. Company jurisdiction: UK
We disagree that there are any jurisdictions that are particularly good for privacy. Also, this might be important for centralised services, like Threema, where the users can't host servers, and much less important for decentralized network, such as SimpleX, where there are hundreds (if not thousands) of servers that we don't control.

2024-08-24 12:10:24 UTC

- reply

1. Main reasons why the app isn't recommended: Provide a transparency report
It is available online and updated at least quarterly, or if anything changes: https://simplex.chat/transparency/

2024-08-24 12:09:52 UTC

https://www.securemessagingapps.com is the great comparison of messaging apps, but there are several incorrect statements about SimpleX Chat.
Commenting in the thread below!

2024-08-20 15:15:15 UTC

- reply

Opened now! accidentally was limited to 100 responses.

2024-08-20 15:14:54 UTC

- reply

Opened now! accidentally was limited to 100 responses.

2024-08-20 15:14:31 UTC

- reply

didn't realise that with the current settings it was limited to 100 responses! Should be open now!

2024-08-20 10:47:51 UTC

Please fill this survey about SimpleX Chat: https://gdlgeuc34xt.typeform.com/to/XAKc5N1l
It is a smaller version of the survey we did last year, please answer again if you answered then.
Thank you!

2024-08-16 09:02:06 UTC

- reply

possibly, we will see!

2024-08-16 09:01:24 UTC

- reply

yes, all apps and servers are open-source - no plans to change that.

2024-08-16 09:01:05 UTC

- reply

working on that. But the balance between security/privacy and usability is a hard one!

2024-08-14 13:39:10 UTC

- reply

yes. Financial privacy was also destroyed after many attempts. It should not pass this time.

2024-08-14 13:37:33 UTC

Announcing $1.3m pre-seed investment from Jack Dorsey and Asymmetric VC in SimpleX Chat🚀
https://simplex.chat/blog/20240814-simplex-chat-vision-funding-v6-private-routing-new-user-experience.html
Also SimpleX Chat v6.0 stable is now released with the new user experience and private message routing – details in the post.

2024-08-12 16:01:06 UTC

In case you missed the news, #ChatControl is back on the agenda of the EU governments.
We wrote before that strong e2e encryption is the only way to protect children online: https://simplex.chat/blog/20240601-protecting-children-safety-requires-e2e-encryption.html
Write to the MPs you voted for – every single letter can change the outcome.
https://mastodon.social/@[email protected]/112768472207989491

2024-08-12 15:59:04 UTC

- reply

we don't yet know what the domain holders want.
We've seen too that the links are currently correct, so it may be an attempt to resell the domain or to collect IP addresses.
So better to avoid.

2024-08-12 15:57:23 UTC

- reply

yes

2024-08-11 20:25:14 UTC

- reply

it's certainly not yet for the faint-hearted :)))
Joking aside, version 6 is MUCH better than the previous, so it may be good enough to try.

2024-08-11 20:18:55 UTC

Please note: we do NOT own the domain simplexchat.org - it might be a phishing site to collect the data (it has an exact copy of our website https://simplex.chat).
We submitted the complaint to the domain registrar (GNAME).
Do NOT download anything from simplexchat.org, obviously.

2024-08-08 21:42:54 UTC

- reply

"yet another messenger" is how all messengers have to start :)

2024-08-08 21:41:30 UTC

SimpleX Chat v6.0-beta.4 is released!
It is stable to use, and please let us know any issues - any help testing it is really great!
You can get beta version for iOS from Apple TestFlight, and for Android from GitHub or from our F-Droid repo (it's still in review in Play Store beta channel): https://simplex.chat/downloads/
The final release will be published on 8/14, together with the announcements.
https://files.mastodon.social/media_attachments/files/112/928/573/433/865/105/original/9eadc92c396e7c7c.jpeg

2024-05-09 19:40:50 UTC

- reply

it certainly can be hashed - when user provides the main email and the recovery email, you can validate it. Obviously, user has to remember what the recovery email was for that to work. But a reasonable compromise would be to store hash, salt and x***@***.com pattern so a user could remember which recovery email was used (with or without correct letter count).