Start Here: Komms in Plain Words

No cryptography knowledge needed. Five minutes.

What is this?

Komms is a messenger being built so that people carrying your messages are not given the keys to read or scan their contents. It also offers more than one route, so no mandatory exclusive provider is the only way to communicate. Encryption cannot promise delivery against every network block, device seizure, radio jammer, or compromised endpoint; the goal is to preserve useful alternatives when at least one supported path remains.

Three things make it different from the messengers you know:

1. There is no mandatory exclusive provider. Komms messages may travel directly, through chosen volunteer mailbox operators holding sealed ciphertext, or over local and radio links. Standard mode can consume disclosed, signed, replaceable defaults, although no qualified default operator currently ships. Optional post-pairing rendezvous and phone wake services cannot read message content or hold identity private keys; removing them leaves the pure-core routes available.
2. It is designed for more than one kind of network. Messages can use Meshtastic radios, local links, or a .kkb courier file carried on removable media. The software paths have automated tests; the physical two-radio and real-world mobile matrices remain open Beta qualification work. During a shutdown, communication still needs a supported route, working devices, power, configuration, and sometimes radio hardware.
3. You are not a phone number. No number, no email, no account, no sign-up. Your identity is a cryptographic key created on your own device. There is no centrally administered Komms account for one operator to deactivate. Contacts can block an identity, and networks, app stores, service operators, and device owners can deny access to their own resources.

What do the crypto words mean?

You'll see five terms around the project. This is all you need:

What does it protect me from, honestly?

It is designed to protect: the content of your messages; who you talk to (as far as the selected routes and threat model allow); your message history on a lost or stolen locked device; and communication options during internet shutdowns when a supported alternate path remains.

It cannot protect: a phone that is already hacked or taken from you unlocked; the fact that a radio transmission physically happened (radio can be detected); you, if the person you message shares your messages; or all timing/network metadata when you enable an optional convenience service. No honest privacy claim says otherwise. Our full, frank list is in the threat model.

Can I use it today?

Yes, as a careful Beta tester. Komms 0.4.2 is a public, explicitly unsigned pre-production test release for Windows, macOS, Linux, Android, and the iOS Simulator. Download it only from the v0.4.2 release, then follow the Beta testing guide to select the exact asset, verify its checksum and test-signing boundary, migrate safely, and report what you find. A source build or other retained validation artifact is not the published 0.4.2 test set, and a platform with no listed release asset is not supplied. Hands-on device qualification, production signing and store distribution, the physical radio bench, qualified operators, and an external audit remain before a stable release. Fresh internet installs also need deliberate bootstrap/mailbox configuration today. Deterministic local Standard-blackhole, replacement, and pure-core journeys exist, but clean supported devices behind distinct real NATs and qualified operators remain P0 work, not a current plug-and-play claim. The 0.4.2 release record explains the one-version unsigned exception and every gate it leaves open. The 0.3 Alpha remains a historical test release and predates the 0.4 trust and evidence design.

Messages may use a small safe formatting subset for emphasis, strong text, quotes, lists, and code. The exact readable source stays encrypted in history and on the wire; each app renders it locally without HTML, clickable links, remote images, or background fetches. See Safe Text Formatting for the exact promise.

Received files never open automatically. Their displayed name and type are sender-provided hints, not a malware verdict. Unknown, mismatched, or active types remain export-only; a reviewed matching type still requires an explicit warning and user action before operating-system handoff. See Safe File Presentation.

You can edit canonical text you authored in a pairwise or group conversation. Komms sends that change as a new encrypted event, keeps an edited marker and inspectable version history, and derives the same winner even when offline carriers deliver edits out of order. Current pairwise and upgraded group authorship is authenticated separately for each recipient device; legacy group history retains its visible weaker label. Editing does not erase what another device already received or copied. See Authenticated Message Editing.

You can also choose disappearing text or a view-once attachment. Komms removes its local decryptable copy at the selected deadline, or after the first explicit view-once reveal, and prevents delayed delivery or backup restore from reviving that item. This does not delete a recipient's capture, control another device, or guarantee screenshot prevention. Relays see one coarse deletion bucket but not the exact deadline or content. See Disappearing Messages and View-Once Attachments.

Groups can also create encrypted single-choice polls. Votes and voter identities are visible to members—Komms does not call them anonymous—and the apparent creator closes the exact vote snapshot they have received. Offline, duplicate, and reordered events still converge locally. Current Beta groups authenticate each claimed voter and creator separately to every recipient device while retaining one shared sender-key ciphertext and recipient deniability. Legacy group history remains labelled as membership-authenticated. See Group Polls and ADR-0029.

Groups can upgrade to signed owner, admin, and member roles. There is always one owner. Admins can request common work while the owner is offline, but the owner still commits one ordered change and refreshes the group's encryption keys. Ownership can be transferred; the owner must transfer before leaving. A signed owner moderation close is visibly different from an apparent creator's ordinary close. There is no server account or hidden moderator behind these roles. See Group Roles, Ownership, and Moderation.

One Komms identity can authorize up to eight independently keyed devices through a mutually confirmed QR or paste ceremony. Sync is explicit and encrypted between those devices; there is no cloud account. The stable account root is a separately held offline recovery authority and never enters ordinary device linking. Routine changes require a strict majority of the previous active set; forks remain visible and fail closed. Recovery revokes the former set and creates fresh device credentials rather than reviving credentials from a backup. See Linked Devices.

Already paired contacts can also make Beta live-audio calls when both devices have a fresh direct QUIC connection. Call setup stays inside the ordinary end-to-end encrypted ratchet and the audio uses fresh call-specific keys; there is no Komms call server. Calls do not work through volunteer relays, TCP fallback, mailboxes, radio, or sneakernet and never become delayed work. Real phone/network/audio-route qualification remains before a stable release. See Live Audio Calls.

The published packages are the quickest start. If you are developing Komms or want to inspect it from source, run the desktop shell with:

git clone https://github.com/AndriGitDev/Komms && cd Komms
cd apps/desktop/src-tauri && cargo run     # the desktop app (Linux deps: see apps/desktop/README.md)

Or watch two devices exchange encrypted messages through a file, no GUI at all:

cargo run --example sneakernet_demo

Platform build instructions:

• Desktop
• Android
• iOS

Where should I read next?

How can I help?

• Not technical? Read this document and tell us what confused you: that's a real contribution—file it as an issue. Hands-on testing of the published Beta packages and their setup instructions matters too.
• Organizer / activist? Read the threat model and tell us where it doesn't match your reality on the ground.
• Developer? Start with CONTRIBUTING and the bounded contributor path, then use the implementation guide for the relevant architectural boundary.
• Cryptographer? Attack the crypto spec. Please.

Why does this exist?

Because private conversation is a human right, and rights need infrastructure, not just arguments. The longer version—including Komms's position on European policy proposals and temporary rules commonly discussed as “Chat Control”—is in Why Komms.