What Tesseract actually does.

Every messenger claims encryption. These are the specific things Tesseract does differently, and — further down — the things it does not do at all.

No phone number

No number, no username, no profile picture. You add people by exchanging an invite, and nothing about the account points back at your identity.

End-to-end encrypted by default

Not a mode you switch on for particular chats. There is no unencrypted path.

Duress PIN

A second PIN that opens a different, innocuous state of the app. For the moment someone is standing over you asking you to unlock it.

Encrypted at rest under your PIN

Messages on the device are encrypted with a key derived from your PIN, so a seized and unlocked phone is not the same as a readable message history.

Messages expire by default

Retention is opt-in rather than opt-out. What is not kept cannot be handed over.

Optional Tor routing

Route traffic over Tor so the relay never sees your IP address. Part of Plus.

Camera-proof text

Protection modes that make a screen readable to you and useless to a camera pointed at it over your shoulder. Part of Plus.

Groups of up to 200

Invite-only, and only the creator can admit people — a joining link alone will not get anyone in. There is no discovery, no public channels and no broadcast, deliberately, because those are what make a messenger worth surveilling.

Self-hostable relay

The relay source is published and you can run your own. You are not required to trust the one we operate.

What it does not do.

Listed here because you should find out now rather than after you have moved a conversation onto it.

No voice or video calls

There are none, and none are planned in the near term. If you need calls, you need something else alongside this.

No desktop or web client

iPhone and iPad only today. A macOS client is in development; there will never be a web version, because keys in a browser tab are keys someone else can serve you.

No large channels

Groups stop at eight. If you want an audience, Tesseract is the wrong tool and Telegram is the right one.

No independent audit yet

The code is public and there is an automated test suite, but no third-party cryptographic audit has been done. We will say so here when one has.

The honest comparison. If the people you need to reach are already on Signal, use Signal — reach beats every feature on this page, and Signal has been audited by people who do not work for Signal. Tesseract is for the case where not having a phone number attached to the account is the point.

Get Tesseract See pricing