Messaging that hides who you are, not just what you say.
Etoki is a metadata-private messaging protocol suite. 2-hop onion routing, post-quantum hybrid encryption, and cover traffic keep your metadata private — and you can host all of it yourself.
No phone number. No email. No account. Open protocol, etoki://.
Why Etoki
Privacy the network can't undo
Most apps encrypt the message and leak everything around it. Etoki minimizes metadata at every layer of the stack.
Metadata-private by design
2-hop onion routing means no single router links sender to recipient. Fixed 16 KiB blocks and scheduled cover traffic hide who is talking, when, and how much.
Post-quantum from day one
X25519 + ML-KEM-768 hybrid crypto across transport, queue setup, and the double ratchet — the ratchet mixes a fresh ML-KEM step into every DH, so security self-heals against harvest-now-decrypt-later.
Self-host everything
Run every relay yourself with a tamper-evident audit log, policy-driven retention, and a port-separated admin API — no vendor lock-in.
How it works
Two hops, zero linkability
Your traffic passes through an entry and a destination router. Neither can connect both ends of the conversation.
Connect privately
Share a one-time invitation. A PQ-hybrid handshake establishes a duplex, end-to-end encrypted channel — no phone number, no email, no account.
Route through 2 hops
Messages travel via an entry router and a destination router. Neither sees both ends, so your IP is never linked to your contact's.
Stay unobservable
Uniform block sizes, cover traffic, and send-jitter keep traffic analysis blind. Transports can hide as ordinary HTTPS or ride over Tor.
Everything you'd expect
A full messenger, privately
Chats, groups, files, and voice & video calls — all end-to-end encrypted and metadata-minimized.
End-to-end encrypted messaging
Duplex connections with an automatically rekeying double ratchet. Forward secrecy and post-compromise security on every message.
Groups over MLS
Group E2EE built on MLS (RFC 9420) with admin-gated membership and an out-of-band verification code, carried over your pairwise channels.
Padded file transfer
A chunked file relay pads uploads to size buckets and splits chunks across relays. Descriptions are e2e-encrypted; relays never see content.
No Google or Apple push
The app keeps a persistent, battery-aware connection to its queues for real-time delivery — message alerts never pass through FCM or APNs. A content-free push relay is an optional add-on for deployments that want it.
Own your messaging infrastructure
Run every relay yourself, with a tamper-evident audit log, policy-driven retention, and a port-separated admin API — on your servers, with no vendor lock-in.