§ · VEGA

Download

Vega

An encrypted messenger with no server.

Peers find each other, carry each other's ciphertext, and hold each other's mail. No node can read a message, and no node's disappearance kills the network.

Download for Linux AppImage · runs on any distribution

§ 01

Downloads

~/releases/latest [6]
Every download Android 7 and later Vega-android-universal.apk Linux — any distribution Vega-linux-x86_64.AppImage Debian, Ubuntu Vega-linux-amd64.deb macOS — Intel and Apple silicon Vega-macos-universal.dmg Windows Vega-windows-x86_64-setup.exe Checksums SHA256SUMS.txt

Unaudited

Nothing here has been audited. vodozemac, which implements the ratchet, has been audited by Least Authority. The code around it has not been audited by anyone. Read SECURITY.md before trusting it with anything that matters.

§ 02

Android

Android is a sideload, not a store listing

There is no Play Store entry and there is not going to be one. A store listing means a review queue, a developer account, and a company whose rules can change under a messenger whose entire point is that no third party sits in the middle. The .apk above is the same build, handed to you directly.

Open it on the phone and allow installing from this source when Android asks. One file carries all three phone architectures, so there is no wrong choice to make.

Note

Delivery on Android currently happens only while the app is open. The foreground service that would keep the socket alive in the background is not written yet, so a message sent to a phone with Vega closed arrives the next time it is opened rather than immediately. Everything else — encryption, contacts, files — works as it does on the desktop. Once that service exists, delivery with the screen off will arrive in bursts rather than instantly: Android suspends network access for sleeping apps, and the usual way around that is a push server this project will not have.

§ 03

Signing

The first open will warn you

None of these builds is code-signed. macOS will say it cannot verify the developer, Windows SmartScreen will say it protected your PC, and Android will ask whether you trust this source. Signing certificates cost money and identify a legal person; neither is a thing this project has. What it has instead is SHA256SUMS.txt on every release and the whole source tree in the open.

§ 04

Contacts

Adding somebody

There is no directory to search and no server to ask, so you add each other by hand: send them your invite, and paste theirs. Both ends, or neither — an invite is not a request the other side can accept.

Vega shows your identity as ten words. Read them out while you hand the invite over; if the words on their screen match yours, it arrived as you sent it. That comparison is the only thing that rules out somebody having swapped it in transit.

§ 05

Devices

A second device is a second account

Install Vega on a laptop and on a phone and you have two accounts, not one. The first launch generates an identity on the device and nothing imports an existing one, so there is no way to sign the second install into the first. That is where the project is today rather than a decision to keep it that way — the cryptography for linking devices is already in the code, the pairing flow that would drive it is not.

Until it is, add yourself as a contact: paste the laptop's invite into the phone and the phone's into the laptop. Messages and files then move between your own machines exactly as they move to anybody else, and are encrypted the same way. What you do not get is one identity — a conversation opened on the laptop stays on the laptop, each device shows its own ten words, and somebody who wants to reach you on both has to hold both invites.

§ 06

Source

MIT licensed · Source on GitHub · All releases · Security notes

Built by peers, for peers. Run a seed node if you would like to make the network easier to join.