한국어 · English · 日本語 · 简体中文 · 繁體中文 · Español · Français · Deutsch · Português (Brasil) · Русский · Italiano · Bahasa Indonesia · Tiếng Việt · Türkçe · हिन्दी

An end-to-end encrypted messenger over Tor, with no servers and no phone numbers

A key generated on your device is your account. Tor hides your IP, and friends and crews run
a Discord-style space with channels, calls and screen share, with no operator in the middle.

Why YANGPA · Screens · Security design · What it can't protect · Getting started · Documentation

Why YANGPA

• There is no sign-up. It asks for no phone number and no email. Your account is just a key generated on your device, and there is no operator holding a roster and no account server. Even bootstrap nodes, relays and seeders are ordinary nodes that anyone can run.
• Your IP stays behind Tor. The app has no setting to turn off the built-in Arti (Tor); only a headless node can be started with --direct. If Tor can't be used, the app stops starting instead of falling back to a direct connection. The exceptions are all listed in the table below.
• It uses classical and post-quantum cryptography together. Signatures are Ed25519 + FN-DSA-512, key exchange is X-Wing (X25519 + ML-KEM-768), and transport is X25519MLKEM768. The design takes into account attacks that collect traffic now to decrypt it later.
• Some conversations leave no trace. The content and keys of ephemeral channels exist only in RAM, and the code separates them from storage paths by type.
• You decide how far your data goes. You choose what to store, hand out to others and fetch, by data type and per channel.
• You can script it. The app, the CLI, the local API and MCP are all clients of the same core daemon (yangpad).
• It doesn't hide its limits. What it can't protect is written down in the docs and in the app. The "What can't be prevented" note on the ephemeral channel screen below is one example.

Screens

These screenshots use the app's development sample data. Click an image to enlarge it.

Ephemeral channel Content and attachments exist only in memory and are erased when their lifetime ends. The screen shows both what is guaranteed and what can't be prevented.	Tor and bridges Tor can't be turned off in the app. On blocked networks it connects through Snowflake or obfs4 bridges. It also tells you which features are off because of Tor.
Safety number and trust switch You compare the safety number yourself to stop a man in the middle, and connect directly only with people you allow to see your IP.	P2P-only channel In channels that need fast files and calls, only devices that joined after seeing the warning connect directly. The content stays closed until you join.
Approving a new device A new device can join only through a one-time QR code from a device you already use, and the person who matched the 6-digit numbers on both sides approves it.	Anonymous channel Authors are shown under a per-channel pseudonym. It hides them only in the app's display (table below).
Tor call Only audio is carried over Tor, without WebRTC. Speech arrives about 0.5 to 1.5 seconds late, but your IP is not revealed.	Screen share P2P-only channels and mutually trusted peers connect over WebRTC. Every frame is end-to-end encrypted.
A human approves for the AI Destructive actions requested by an automation token run only after a human approves them. Every authenticated call is recorded in the audit log.	Seeder settings You decide the data types to hand out, the bandwidth and the number of concurrent transfers. Speed is also limited per person, crew and channel.
Forum and light theme There are forum channels organized by posts and tags, and you can choose the light or dark theme.	Android It uses the same UI code as the desktop, and the daemon runs inside the app.

Features

Some features, such as the Library tab and the content viewer, are for supporters only (License).

Anonymity: who is hidden from what

"Anonymous" means something different at each layer. This table separates what YANGPA does from what it doesn't.

Tor does not hide you from your friends. Friends and members know your identity inside the encrypted channel.

Security design

flowchart LR
  subgraph device["My device"]
    clients["App · CLI · MCP"] -->|"Local API (token)"| daemon["Core daemon yangpad"]
    daemon --> db[("SQLCipher")]
    daemon --> ram[["Ephemeral RAM store"]]
  end
  daemon -->|"Tor (Arti)"| peers["Friends · crew devices · seeders"]
  daemon -.->|"Direct connection (exception)"| direct["P2P-only channels · trusted peers · my devices"]

Here are three design decisions experts may want to look at first.

• It uses its own key group instead of MLS. In a crew of 45,000 devices, MLS Welcome and Remove commits grew to 50 to 61 MB, so it was replaced. It is not a standard and has had no external review. The design is in docs/protocol.md and the measurements are in docs/performance.md.
• There is no per-message forward secrecy. Keys change at the intervals in the table above, not for every message. One-to-one conversations have the same structure. If a key leaks, the messages of that same key period can be opened.
• Tor circuits still use classical cryptography. Arti 0.47 has no post-quantum circuit handshake. The libp2p connection inside it and the end-to-end content are protected by hybrid key exchange, but if someone stores guard-side connections and breaks them later, when you connected to which onion address may be revealed.

Where the app talks to the outside

The app has no usage statistics, error reporting or automatic update check code. The places where the app talks to the outside are the following, and nothing else. The CSP of the app's UI (the webview) opens connect-src only to the app itself. The operating system's and the webview engine's (WebView2 and so on) own traffic is not controlled by the app.

Sponsorship checking runs only after you press a button to turn it on, and after that it re-checks once a day. Your YANGPA identity is not sent.

What it can't protect

The full list and the attacker model are in SECURITY.md.

• Data that has reached the other person's device. Deletion, lifetimes and ephemerality hold only with honest clients. Screenshots, camera photos and modified clients can't be stopped.
• Metadata. Event headers are not encrypted, for signature verification and sync, so members who receive an event and seeders know who wrote in which channel and when.
• When your device is compromised. Malware running as the same OS user can manipulate the daemon. There is not yet a feature to wrap the DB key separately with a password.
• Tor's own limits. It can't stop timing correlation by an observer who sees the whole network.
• Paths outside the scope of ephemeral channels. Hibernation files, crash dumps, clipboard history, and screen capture on Linux.
• Hiding your IP from direct-connection peers. P2P-only channels and trusted peers see your IP as it is.
• The authenticity of the distribution. There is no code signing, and SHA256SUMS.txt only confirms that the download wasn't corrupted. If authenticity matters, build from source.
• Device loss. If you lose all your devices, the account can't be restored.

Verify it yourself

These are things you can check instead of trusting.

Please report vulnerabilities privately instead of in a public issue.

Getting started

Supported platforms

Windows x86_64, macOS (one build for Apple silicon and Intel), Linux x86_64 and ARM64. For Android ARM64, install the APK from the release (YANGPA_…_arm64.apk, docs/android.md).

Desktop app

1. Download the bundle for your operating system from the releases.

   Operating system	File
   Windows	…_x64-setup.exe (recommended) or …_x64_en-US.msi
   macOS	…_universal.dmg
   Linux x86_64	…_amd64.deb or …_amd64.AppImage
   Linux ARM64	…_arm64.deb or …_aarch64.AppImage (glibc 2.35 or later)

2. Verify it with SHA256SUMS.txt from the same release.

   sha256sum -c SHA256SUMS.txt --ignore-missing
   

   The bundles are unsigned, so on macOS allow opening in "System Settings → Privacy & Security", and on Windows choose "More info → Run anyway" in SmartScreen.

3. Open the app and create your identity with Get started. Add other devices with Connect a new device in Settings › Devices.

4. Start a conversation by creating a contact link and sending it, or by pasting a link you received.

Command line (CLI)

The release's yangpa-cli-<version>-<target>.tar.gz (.zip on Windows) contains yangpad, yangpa and yangpa-mcp. Put the three files in the same directory (or on your PATH).

yangpa daemon &                         # Start the daemon (skip if the app already started it). Arguments pass straight to yangpad
yangpa identity create --name me         # Create an identity
yangpa status

yangpa friend link create --single-use --expires 24h    # A contact link to send to the other person
yangpa friend add 'yangpa://friend/…'                    # Immediately get a temporary contact and a one-to-one space from a received link
yangpa friend propose their-name                         # Propose to make them a friend (a friend once they do too)

yangpa space list                                        # One-to-one space and crew names
yangpa channel list --crew <name>
yangpa message send --crew <name> -c <channel> "Hello"
yangpa watch                                             # New messages and status changes in real time

Headless seeder (NAS, VPS)

A node that serves crew history all the time. For detailed setup, remote management and running over Tor, see docs/headless.md.

# Docker (from the repository root): data only in a volume, non-root user, fixed port 47810 (TCP and UDP)
docker compose -f deploy/docker-compose.yml up -d --build
alias yangpa='docker exec -it yangpa-seeder yangpa'

# Or systemd: deploy/systemd/yangpad.service (includes isolation settings)

yangpa identity create --name "Game group seeder"
yangpa invite join 'yangpa://invite/…'
yangpa seed set --all-channels --types text,image,video,file,emoji,history_bundle --upload-limit 5MB/s --prefetch on
yangpa seed coverage --crew "Game group"
yangpa blob cache limit 200GB --min-free 10GB           # Disk limit for received attachments (2 GB by default)

What doesn't work yet

• The desktop app doesn't send camera video yet (only voice and screen share).
• The screen in a Tor call is an emergency low-quality stream (up to 1280 px wide, 2 frames per second). For proper screen share, use a P2P-only call channel or a mutually trusted peer.
• Screen audio is sent only in Windows mesh calls. SFU and Tor calls send only the screen.
• App devices running over Tor don't take the SFU host role.
• Voice and screen share on Linux (WebKitGTK) can be unstable, and excluding the window from capture is not supported.
• Automated tests of the real Tauri window run only on Linux. A person checks the macOS and Windows windows and signing and notarization (CONTRIBUTING.md).

Connecting AI tools (MCP)

yangpa-mcp is an MCP server that runs over standard input and output. An AI tool calls it for things like listing channels, reading and summarizing messages, managing channels and roles, invites and seeder settings.

Safety rules the daemon enforces:

• Destructive actions such as kick, ban, unban, handling reports (except dismissing), deleting other people's messages, changing permissions and roles, creating invites and deleting channels don't run right away but go into a human confirmation queue. They run only after you approve in the app or with yangpa confirm list → yangpa confirm approve <ID>.
• Ephemeral channels deny AI reading by default. A person must allow it per channel with yangpa channel allow-api-read … on before it opens.
• Messages written by members are wrapped as "data, not instructions" when passed to the AI (as a prompt injection defense).
• Every authenticated call is recorded in the audit log (yangpa audit list), and the crew member list marks the automation. Revoke a finished token with yangpa token revoke <ID>.

For the detailed rules, see chapter 10 of the user guide.

Build from source

What you need:

• Rust 1.91 or later (releases are built with 1.99.1), a C compiler, perl and make (to build OpenSSL for SQLCipher from source), cmake (in case aws-lc needs to be built in some environments). On Windows, the MSVC build tools and Strawberry Perl.
• Desktop app: Node.js 22, and on Linux libwebkit2gtk-4.1-dev libayatana-appindicator3-dev librsvg2-dev libxdo-dev.

# Core: daemon (yangpad), CLI (yangpa) and MCP server (yangpa-mcp). The desktop app is not a default build target.
cargo build --release --locked
ls target/release/{yangpad,yangpa,yangpa-mcp}
cargo test --workspace

# Desktop app (development mode). The app looks for yangpad next to its executable (target/debug) and starts it.
cargo build -p yangpa-daemon
cd apps/desktop
npm ci
npm run tauri dev

# Desktop app tests: unit tests, and an E2E that really starts the yangpad built above (the E2E is skipped if it is missing).
YANGPA_E2E_REQUIRED=1 npm test -- --run

# Real window tests (Linux): need tauri-driver, WebKitWebDriver and a display; if missing, it says why and skips.
npm run test:window:build
xvfb-run -a npm run test:window

For how to contribute, see CONTRIBUTING.md.

Documentation

The documents below are available only in Korean.

License

Distributed under the GNU Affero General Public License v3 or later (LICENSE, SPDX AGPL-3.0-or-later). If you let others use a modified version over a network (for example, an SFU server you run yourself), you must give them the source too. third_party and vendor/ffmpeg follow their own licenses (the files in those folders).

• Supporter features (sponsorship checking, the Library tab, the content viewer, supporter badges): the code in crates/yangpa-daemon/src/supporter/ and apps/desktop/src/supporter/ is under the YANGPA Supporter License, not the AGPL. The source is public, and building it yourself for your own use is fine, but you can't distribute a version that removes or bypasses the sponsorship check.
• AGPL section 7 additional terms (NOTICE.md): a modified version must keep the original copyright notice and source address on the app's About screen, plus the wording "a version modified from YANGPA". Distributing it bundled with the supporter module is permitted.
• Trademark (TRADEMARK.md): a modified version may not use the YANGPA name or the flame icon.
• Contributions follow the contributor agreement.