Housekey
Sidetext encrypts your messages with Housekey. What you send is locked on your own device and only opens again on the device of the person it is meant for. We cannot read it, not even if our servers were ever hacked.
How it works
Every conversation has its own key, like a house. Everyone in the conversation holds a copy.
We keep those copies for you, each in a locked box that only its owner can open. We store the boxes, but we hold no key that opens any of them.
The key to your box is your 24-word recovery code. A new phone, an extra iPad, your laptop: enter your recovery code or scan it from a device you are already signed in on, and all your conversations are back, including everything you ever sent.
Why this way
Many encrypted apps keep your messages only on your phone. Switching phones or losing yours means losing everything. Sidetext stores your messages encrypted on our own servers in Europe, so they follow you to every device, without us being able to read them.
What we can and cannot see
What we cannot read: the content of your messages and attachments, and the names of files you send.
What we do need to know to deliver messages: who talks with whom, when something is sent, how large it is, group names and who is a member. That is true of every messaging app; we keep no more of it than we need.
What Housekey does not do
We would rather be honest than impressive.
- A conversation’s key does not change, not even when someone leaves a group. If a key ever leaks, for example through a group member’s hacked phone, it also opens older messages in that conversation. Some apps refresh their keys constantly. We deliberately choose simplicity and your full history on every device.
- A hacked phone is always a problem: whoever holds your device reads what you read. That is true of every app.
For those who want the details
Housekey is not home-made cryptography. It is envelope encryption, a proven pattern, built on libsodium: the audited NaCl building blocks that Threema also uses.
- Each conversation has a symmetric key (XSalsa20-Poly1305).
- That key is encrypted to each participant’s own Curve25519 key. The copies sit on our server as an encrypted backup; the server never holds a usable key.
- For every message, the app checks that the sender is who they claim to be.
- Your recovery code is your backup key. We do not have it. On Apple devices your key also travels via your iCloud Keychain when it’s on; Apple encrypts that end to end.
- Creating a new security key without your recovery code requires a confirmation code by text message or email.