Pack

Open Source Protocol

Built on proven cryptography

pack-protocol is a complete end-to-end encryption library written in Rust. The protocol is open source and available for anyone to audit, use, or contribute to.

X3DH Key Agreement Asynchronous key exchange so you can start a conversation even when the other person is offline.

Double Ratchet Every message gets a unique encryption key. Compromising one message doesn't compromise any others.

Sender Keys Efficient group encryption where each member maintains a single ratcheting key for the group.

Sealed Sender The server cannot see who sent a message. Sender identity is encrypted end-to-end.

Safety Numbers Verify your contact's identity out-of-band with numeric codes or QR scanning.

Zero Unsafe Code The core library enforces #![forbid(unsafe_code)]. All cryptographic logic is memory-safe Rust.

Security

The server knows nothing

Pack's server architecture is designed so that it never has access to message content, sender identity, or encryption keys. It routes encrypted blobs and nothing more.

🔒

Forward Secrecy

Compromising long-term keys does not reveal past messages. Each session constantly rotates encryption keys.

🛡

Break-in Recovery

Sessions self-heal after a compromise. The ratchet advances and locks out any attacker who had temporary access.

👁

Sender Anonymity

Sealed sender hides who sent a message from the server. Only the recipient can see the sender's identity.

📷

Deniability

No cryptographic proof that a specific person sent a message. Conversations stay between the participants.

🔐

Key Zeroization

Private keys and session secrets are wiped from memory as soon as they're no longer needed.

🛠

Constant-Time Operations

Key comparisons and HMAC verification use constant-time primitives to prevent timing attacks.

Architecture

How it works

Messages are encrypted on your device before they leave. The server is a relay — it stores and forwards encrypted data without any ability to read it.

Client (iOS / Android / Desktop)
  └─ pack-protocol (Rust core, native bindings)
  └─ Encrypt message with recipient's session key
  └─ Wrap in sealed sender envelope
  └─ Send encrypted blob to server

Server (Relay)
  └─ Receives opaque encrypted blobs
  └─ Cannot read content, sender, or metadata
  └─ Routes blob to recipient device

Recipient
  └─ Opens sealed sender envelope
  └─ Decrypts message with session key
  └─ Verifies sender identity

About

Built by Frederick Finn

Founder of Finn Devs, building secure-by-default software. Pack started 15 years ago as an experiment and has grown into a full suite of encrypted messaging clients and an open-source protocol.

Connect on LinkedIn Buy Me a Coffee Sponsor on GitHub