Security · Crocodile

What's protected

Only the members of the call can hear it. It's encrypted on your computer, frame by frame, before it leaves.

Only the members of the space or DM can read them, now and later. They're stored on members' devices, never on a server.

Only your own devices and whoever holds your recovery key have it. It's kept encrypted with your system's keychain.

No system that connects people is free of metadata. Here's exactly where Crocodile draws the line.

What you write or say: content is end-to-end encrypted, also when you use the opt-in relay or mailbox.
Your phone number, email or password: Crocodile doesn't ask for any.
Your friends list and blocks: they're encrypted so only your devices can read them.
Who sent a friend request: requests travel as sealed notes that don't name their sender.

Public profiles, space names, channel lists, memberships and device names.
Who's online and who's in which voice room.
While you're connected: whose presence you follow and whom you start a DM or call with (it isn't kept or shared with other servers).
IP addresses, which are needed to connect apps to each other. The host of a room also sees its members' IP addresses.

A threat model lists possible attackers and what each one can and can't do. This is a summary of ours.

Attacker	Can	Cannot
Someone watching the network	See which IP addresses you talk to, and how much.	Read content or metadata, or tell what you say from packet sizes.
Record now, decrypt later	Store your encrypted traffic for years.	Decrypt it with a future quantum computer: every key exchange is post-quantum hybrid.
A malicious server	Lie about who's online, delay or drop connections, keep logs of metadata.	Read content, forge profiles, spaces or invites, swap someone's keys, or get between two apps.
A relay or mailbox operator	See sizes and timing of relayed packets, or who left how many messages for whom.	Read, change or forge them.
The friend hosting a room	See members' IP addresses and who's speaking when.	Do anything another member couldn't: their relay only forwards encrypted packets.
Someone who left a space	Keep what they already saw.	Read anything said after they left: keys are replaced when someone leaves.
Someone who steals a key	Read at most the current 30-minute key period of a conversation.	Read earlier messages (deleted keys) or later ones (fresh keys).
Someone with your unlocked computer	Everything you can. Use disk encryption, and remove a lost device from another one.	Receive new messages once you've removed the device.

Well-studied building blocks from audited, open-source libraries (@noble), combined in standard ways.

Ed25519Signatures on every record, message and connection offer

X25519 + ML-KEM-768Hybrid post-quantum key exchange for every pairwise secret

AES-256-GCMEncryption of messages, voice frames and server connections

HKDF-SHA256Key derivation and the forward-only ratchets

DTLS-SRTPWebRTC's encrypted transport underneath

Padmé · CBR OpusHiding message lengths and speech patterns

We'd rather you hear these from us.

No independent audit yet. The design and code are public, but no outside firm has audited them. Until one has, don't rely on Crocodile where your safety depends on it.
Devices share one account key. Removing a device stops new messages and keys from reaching it, but a stolen device could still sign as you. Per-device signing keys are planned.
Some metadata is visible. Servers see memberships and, while you're connected, whom you contact. Less of it is on the roadmap.
Very large groups. Crocodile uses ratcheting sender keys rather than MLS, so replacing keys costs more as a group grows. MLS is planned for very large spaces.
Key checks are manual. You can compare safety numbers with a friend, but the app doesn't prompt you to.

Please report security issues privately through GitHub, so they can be fixed before they're public.

Report privately Full security model