messaging, rooms and calls that keep working when the network is gone.

there is no username database and no password reset, because there is no one on the other end. when you create a profile, the console turns your passphrase into a key on this device and uses that key to lock a second, random key. everything you store is sealed under the random key.

unlocking is the same computation run again. a wrong passphrase does not produce an error message from a server; it simply fails to open the lock, and nothing is revealed about how close it was.

1. each device shows its code

   a short pairing code: this device's public key, a one-time nonce and its name, as a qr code and as text you can read aloud or type.

2. each device reads the other's code

   scan with the camera, or paste the text. no radio, no network, no account is involved; the code is the only channel.

3. compare six digits

   both screens derive the same six-digit number from the shared secret. if they match, nobody sat in between. confirm on both, and the pair is saved, sealed, on each device.

4. hand things across

   a paired device can receive notes as encrypted codes, one frame or several. only that device can open them.

phones cannot talk to each other through a browser without something in between. gabriel's something is a beacon: a small program anyone runs on a laptop or a spare phone plugged into a wall, on a wi-fi hotspot that has no uplink. it forwards sealed messages by random tags. it cannot read them, it cannot tell who is who, and it keeps nothing on disk.

1. found a room

   name it. you are its first member and the only one who can add people or rotate its key.

2. add people you have paired with

   membership is pairing: nobody enters a room unless the founder has verified their device in person. the room key travels to them sealed under that pairing.

3. talk

   every message is encrypted under the room's current key and signed by its sender. remove someone and the key changes; the beacon tag changes with it, so they cannot even watch the traffic.

4. call

   audio, and video if you want it, goes straight between phones on the local network, encrypted; the beacon only carries the sealed handshake. up to eight in a call.

no web page can stop a phone from capturing its own screen; anyone who tells you otherwise is selling something. what the console does instead is limit what a capture is worth.

• messages are blurred until you press and hold one. a screenshot shows one message, never a conversation.
• the moment the console is not in front, it veils itself. app switchers and recording overlays get a blank card.
• shielded text cannot be selected, copied or dragged.
• notifications name the sender and nothing else, or show only that something arrived, or nothing at all. your choice; sender-only is the default.
• in the native mesh app on iphone, the screen goes blank for as long as a recording or mirroring is active.

the setting that turns this on is named plainly, and says exactly this.

the console never reads your position on its own. inside a room you can share where you are once, or live every twenty seconds until you stop. it goes sealed to that room and nowhere else.

whoever receives it gets distance, bearing and a compass arrow that turns with the phone. that works with no map, no tiles and no internet. if a beacon carries a map of the area, or if you explicitly allow openstreetmap.org, a real map appears too. either way there is no account and no tracking.

the first visit installs a small worker that keeps a copy of every file this site is made of. after that, opening the console reads from that copy. pull the sim card, turn on airplane mode, walk into a basement: the page opens, the vault unlocks, pairing works.

the readiness list below is measured on this device right now, not promised.

install it to the home screen from the browser menu and it opens like any other app, still without a connection.

no app store, no account, no download from somewhere else. the installed console is this page, cached, in its own window.

• make a network request after the first load, except to a beacon you configured yourself and, only if you switch it on, openstreetmap.org for map tiles. the worker refuses everything else.
• create an account, ask for an email, a phone number or a name that has to be real.
• send a passphrase, a key, a note or a device list anywhere. there is no anywhere.
• run analytics, load fonts or scripts from other domains, or set third-party cookies.
• keep plaintext at rest. records are sealed; the seal key is wrapped by your passphrase.
• recover your data for you. that is the price of the line above.

everything on this page can be checked by reading the source, which ships with the console itself.