Privacy is not a policy. It is mathematics.
A zero-trust messaging protocol where the server is mathematically incapable of accessing message content. Strategically hosted in Hong Kong to ensure data sovereignty.
Alice: Are you still okay to look over the contract tonight?
You: Yes, send it over whenever you’re ready.
Alice: Here it is. Page four is the part I’m unsure about.
You: Reading it now. I’ll call you after nine.
- X3DH + Double Ratchet Key agreement
- XChaCha20-Poly1305 AEAD encryption
- TLS 1.3 only Transport — no TLS 1.2, no plaintext fallback
- No logs Blind relay — logs nothing that identifies who talks to whom
The server is a blind relay.
Traditional “secure” messengers act as trusted intermediaries. rChat removes trust from the equation entirely. The server sees nothing but opaque, encrypted bytes.
ciphertext = XChaCha20Poly1305(key=k_ratchet, msg=plaintext) Strictly on-device.
Private keys are generated on user hardware and never transmitted. The server possesses no cryptographic capability to decrypt payloads.
Zero retention.
rChat utilizes opaque circuit identifiers to route packets. We do not maintain social graphs, timestamps, or sender-receiver logs.
TLS 1.3 tunneling.
All protocol traffic is encapsulated within standard HTTPS (TLS 1.3) frames, rendering it indistinguishable from standard web browsing.
Strategic independence. Hong Kong hosting.
Cryptography is only as strong as the legal jurisdiction holding the hardware. rChat infrastructure is legally domiciled and physically hosted in Hong Kong, placing it strictly outside the jurisdiction of Western intelligence sharing agreements.
- 5 Eyes US, UK, CAN, AUS, NZavoided
- 9 Eyes + FR, NL, DK, NOavoided
- 14 Eyes + DE, BE, IT, SE, ESavoided
- Hong Kong Offshoreactive
Verify the difference.
| Feature | rChat | Signal | Telegram |
|---|---|---|---|
| Server blind relay | Yes | No | No |
| Jurisdiction | Hong Kong | USA (5 Eyes) | UAE |
| Self-hostable | Yes | Difficult | No |
Don’t trust us. Run your own node.
True security requires the ability to verify the infrastructure. rChat is 100% open source. You can audit the code, build the relay and run it on your own host.
The relay obtains and renews its own TLS certificate over TLS-ALPN-01 on port 443. No port 80, no reverse proxy.
View GitHub repository →cargo build --release --bin rchat-server
# point an A/AAAA record for relay.example.com at this host
sudo install -m 0755 target/release/rchat-server /usr/local/bin/
# /etc/rchat/server.toml
[server]
bind_addr = "0.0.0.0:443"
[server.acme]
enabled = true
domains = ["relay.example.com"]
contacts = ["mailto:ops@example.com"]
cache_dir = "/var/lib/rchat/acme"
sudo systemctl enable --now rchat-serverAbstract
rChat is a secure messaging platform designed from the ground up for true end-to-end encryption (E2EE). Unlike existing solutions where service providers control key distribution, rChat employs a zero-trust architecture where the server is mathematically incapable of accessing message content.