§ · VEGA
Download
Vega
An encrypted messenger with no server.
Peers find each other, carry each other's ciphertext, and hold each other's mail. No node can read a message, and no node's disappearance kills the network.
§ 01
Downloads
Every download
Android 7 and later Vega-android-universal.apk Linux — any distribution Vega-linux-x86_64.AppImage Debian, Ubuntu Vega-linux-amd64.deb macOS — Intel and Apple silicon Vega-macos-universal.dmg Windows Vega-windows-x86_64-setup.exe Checksums SHA256SUMS.txtUnaudited
Nothing here has been audited. vodozemac, which implements the ratchet, has been audited by Least Authority. The code around it has not been audited by anyone. Read SECURITY.md before trusting it with anything that matters.
§ 02
Android
Android is a sideload, not a store listing
There is no Play Store entry and there is not going to be one. A store
listing means a review queue, a developer account, and a company whose
rules can change under a messenger whose entire point is that no third
party sits in the middle. The .apk above is the same build,
handed to you directly.
Open it on the phone and allow installing from this source when Android asks. One file carries all three phone architectures, so there is no wrong choice to make.
Note
Delivery on Android currently happens only while the app is open. The foreground service that would keep the socket alive in the background is not written yet, so a message sent to a phone with Vega closed arrives the next time it is opened rather than immediately. Everything else — encryption, contacts, files — works as it does on the desktop. Once that service exists, delivery with the screen off will arrive in bursts rather than instantly: Android suspends network access for sleeping apps, and the usual way around that is a push server this project will not have.
§ 03
Signing
The first open will warn you
None of these builds is code-signed. macOS will say it cannot verify the
developer, Windows SmartScreen will say it protected your PC, and
Android will ask whether you trust this source. Signing certificates
cost money and identify a legal person; neither is a thing this project
has. What it has instead is
SHA256SUMS.txt on every release and the whole source tree in
the open.
§ 04
Contacts
Adding somebody
There is no directory to search and no server to ask, so you add each other by hand: send them your invite, and paste theirs. Both ends, or neither — an invite is not a request the other side can accept.
Vega shows your identity as ten words. Read them out while you hand the invite over; if the words on their screen match yours, it arrived as you sent it. That comparison is the only thing that rules out somebody having swapped it in transit.
§ 05
Devices
A second device is a second account
Install Vega on a laptop and on a phone and you have two accounts, not one. The first launch generates an identity on the device and nothing imports an existing one, so there is no way to sign the second install into the first. That is where the project is today rather than a decision to keep it that way — the cryptography for linking devices is already in the code, the pairing flow that would drive it is not.
Until it is, add yourself as a contact: paste the laptop's invite into the phone and the phone's into the laptop. Messages and files then move between your own machines exactly as they move to anybody else, and are encrypted the same way. What you do not get is one identity — a conversation opened on the laptop stays on the laptop, each device shows its own ten words, and somebody who wants to reach you on both has to hold both invites.
§ 06
Source
MIT licensed · Source on GitHub · All releases · Security notes
Built by peers, for peers. Run a seed node if you would like to make the network easier to join.