XChaCha20-Poly1305 — and nothing else
One mandated cipher for all confidentiality. No negotiation, no downgrade path. Symmetric crypto faces only Grover, not Shor — 128-bit effective strength that quantum computers do not break.
Quantum-resistant · metadata-blind · self-hosted
Messaging the server won’t can’t spy on.
Cutout’s server is a dumb mailbox. It is architecturally incapable of learning who its users are, who talks to whom, when anything is sent — or whether a given blob is a message at all. Not restricted by policy — denied by construction.
Built for a threat model of “aliens with infinite resources” — quantum computers, full server compromise, global passive network observation.
what the server sees
tick 58 214 402
1024 buckets · rotating every tick
every packet: 4096 B
Message, vouch, or decoy? From whom, to whom? A message at all? The server has no way to know.
0recipient fields in the protocol
4096 Bevery packet, real or decoy
30 stick granularity
≤ 24 hserver retention, then gone
192-bitrandom nonces, no counter state
0pre-quantum primitives, anywhere
The boundary
This line is the whole point.
A compromised server, a malicious operator, or a state adversary holding the database learns almost nothing. Here is the complete list — both sides of it.
The server sees
- An opaque tag — a rotating HMAC it cannot compute or verify
- Tick + bucket — coarse time and a slot that rotates every 30 seconds
- A fixed-size encrypted blob — 4096 bytes, whatever it carries
- Sender IP + arrival time, quantized to the tick (removable — see the tunnel)
The server never sees
- Message content
- A recipient — there is no recipient field anywhere in the protocol
- Sender identity — no accounts, no registration, no user concept
- Group membership, or that a group exists at all
- Message type, conversation or session id
- Whether a blob is a message at all — a text, a group invite, a vouch, an introduction, a decoy: byte-identical shapes, every one
A message is never addressed “to Bob.” It lands in a bucket only the sender and the intended reader can derive from a shared secret. The server sees “a blob with tag X in bucket 42, tick 12345” — and cannot tell that it is a message, let alone that Bob exists.
Why now
Chat control is coming. Backdoor orders need someone to serve them to.
The EU’s chat-control push — and every law like it — works by compelling providers to scan or weaken end-to-end encrypted services. Once that is the game, the real question is no longer “is the crypto sound?” It’s “who can be forced, and would you ever find out?”
Someone else’s messenger
- The operator can be compelled — secretly, with a gag order attached
- You can’t inspect the servers of WhatsApp, Telegram, or Signal — you trust, you can’t check
- A scanning mandate arrives as a silent update you have no way to notice
- One order covers every user at once
Your Cutout
- You are the provider. Your server, your employer’s, your friend group’s — you know exactly who runs it, because it’s you
- The full source is public and auditable — what you deploy is what you read
- Even a compelled server has nothing to hand over: no contents, no contacts, no metadata — see the boundary above
- An order would have to be served on every little server separately — and the one running yours is you
You cannot know what WhatsApp, Telegram or even Signal were quietly ordered to add. You can know nobody backdoored the server your own crew runs — because you deployed it, from source you can read.
How it works
Four moves that keep the server blind.
-
01
Keys change hands in person, via QR.
The trust anchor is a face-to-face QR scan: those secrets never travel over the network — no key exchange to intercept, no MITM window, nothing on the wire to harvest now and decrypt later. Friends can also introduce friends without a meeting: the new channel's secrets cross the wire exactly once, sealed to the recipient with post-quantum ML-KEM-768 — the introducer relays but can never read them — and the contact is colour-marked until you verify in person, which rotates the secrets back off the wire entirely.
-
02
Messages land in rotating buckets, under unverifiable tags.
Sender and reader derive the bucket and tag for each 30-second tick from their shared secret, using keyed hashes. The server stores what arrives but lacks the secret to verify, correlate, or even recognise any of it. Next tick, everything rotates.
-
03
Everyone fetches everything. Filtering happens on your device.
There is no “give me my messages” request — that would reveal which messages are yours. Clients blind-fetch the entire tick and match tags locally. The server never learns which blobs anyone actually wanted.
-
04
Constant-rate cover traffic drowns the signal.
Every client emits a fixed number of packets per tick, whether or not you’re talking. Real messages silently displace decoys inside that fixed schedule — and since real and decoy are byte-identical, an observer watching your line sees a flat, unchanging rate. Silence looks like conversation. Conversation looks like silence.
Cryptography
Quantum-safe by construction, not by patchwork.
Most “post-quantum messengers” bolt new math onto an old design. Cutout removes the vulnerable step from conversations entirely — no network key agreement to attack — and the one place keys do cross the wire (introductions) is wrapped in NIST post-quantum crypto.
192-bit nonces, zero stored state
Every message gets a fresh random nonce wide enough that collisions are infeasible — no counters to corrupt. Restore a backup, reinstall the app, roll back the clock: nonce reuse stays impossible by design.
Post-quantum asymmetric crypto only
Two NIST-standardized primitives, each with one job: ML-DSA-44 (Dilithium) signs —
group authorship, vouches, name changes — via Cloudflare’s independently audited circl,
the same code on server and client. ML-KEM-768 (Kyber) wraps keys for one thing only:
introductions, inside end-to-end payloads the server never even recognises.
No RSA, no elliptic curves, nowhere.
Forward secrecy, rotated daily
Message keys are re-derived every UTC day from the pair root via HKDF-SHA-256, and old daily keys are deleted after seven days. A leaked daily key exposes at most ~24 hours; your history stays dark — the server deleted its copy within a day anyway.
Identity & trust
Trust is something you establish. Never the server.
Every contact carries a trust color derived only from local evidence — QR scans you performed and signed vouches from people you verified. Nothing a server says can change it.
Green — verified by you
You scanned this person’s QR code in person. Their keys are pinned on your device. This is the strongest identity claim that exists in Cutout.
Blue — vouched by a green contact
Someone you verified in person has cryptographically vouched for this person’s key with a post-quantum signature. One hop, no further — a blue contact’s vouch promotes no one.
Red — unverified
Neither of the above. You can still message them, but the app tells you plainly: this identity is unproven. No false comfort, no hidden defaults.
Lose trust in a green contact? Every contact who was blue solely on their word is instantly recolored red — stale trust never lingers.
Introductions, without a middleman who can read
A contact can connect two people who never met: fresh channel secrets are sealed with post-quantum ML-KEM-768 so only the recipient can open them — the introducer relays a package it cannot read. In a group, the offer is even blind to everyone else: no recipient is named; only the addressee’s device can unwrap it. Colours tell the truth about what happened — an introduced contact is never green until you scan their QR, and if the QR doesn’t match the identity you were introduced to, the app says so loudly.
A tamper-evident identity history
Every contact carries a local, hash-chained audit log: how they reached your device, every name they have presented, every vouch, every verification. Renames they announce are post-quantum-signed and recorded — your own label always wins — and any local tampering with the log breaks its chain visibly. Stored on your device, never synced.
Nothing to leak
The features we didn’t build are the point.
Every “modern” messenger convenience below leaks exactly the metadata Cutout exists to remove. They aren’t off by default. They don’t exist.
- No read receipts
- No typing indicators
- No presence or “last seen”
- No cloud history or backups
- No link previews
- No contact-book upload
- No analytics or telemetry
- No push relay
- No accounts. At all.
One rule decided all of it: if a feature feels modern by moving your activity, timing, content, or contacts off your device — it’s forbidden. Polish comes from craft, not leaky conveniences.
The last residue
Even your IP address is optional.
The one thing the server still sees is the sender’s IP. A built-in, app-scoped outbound tunnel removes it — and if the tunnel drops, the app fails closed and sends nothing. Never a silent fallback to your real connection.
Direct
Straight to your server over TLS. The default: simple, fast, and honest about what it shows — the server sees your IP, your ISP sees a generic HTTPS connection.
WireGuard In development
An embedded, userspace WireGuard tunnel — bring any provider or your own endpoint. Routes only this app’s traffic, needs no OS VPN profile, and leaves every other app untouched. Even DNS resolves inside the tunnel.
Tor In development
Route through a local Tor client for the no-trust path: no single relay sees both ends. Slower — and Cutout’s tick-based design is built to tolerate exactly that.
Honest limits
What we will never claim.
A security tool that oversells is a security hole. These limits are documented in the spec, surfaced in the app, and stated here — plainly.
Forward secrecy is not self-healing
If a device’s master secret leaks, daily rotation protects your past — but the system cannot cryptographically recover on its own. Recovery means meeting again and re-scanning QR codes. There is no asymmetric ratchet, because conversations involve no network key agreement — that trade is deliberate.
Introduced channels touched the network once
A channel you got through an introduction had its secrets cross the wire one time, sealed with post-quantum ML-KEM-768. If that cipher ever falls decades from now, a recording of that one message could expose that channel — QR-scanned channels have no such recording, anywhere. Verifying an introduced contact in person rotates their secrets back into the QR class. The trust colours double as exactly this hierarchy.
A single-hop VPN is trust displacement, not anonymity
In WireGuard mode, the tunnel provider sees your real IP and that you reach a Cutout server. That helps only if you trust the provider more than the server’s network path. For no-trust routing, use Tor.
Aggregate volume and timing are visible at tick granularity
The server knows some traffic exists and how much per 30-second tick. Constant-rate cover traffic flattens what that reveals about you; it cannot make the server unaware traffic exists.
Phones sleep — and cover traffic sleeps with them
iOS suspends backgrounded apps, so the fixed emission rate can’t be guaranteed while suspended. An adversary watching both your link and the server could infer activity from those gaps. The browser client is weaker still: its protections run only while the tab is open, and it tells you so with a persistent, non-dismissible notice.
QR codes carry live secrets
A photo or shoulder-surf of a displayed QR compromises what it carries, until rotated. The exchange is physical precisely so that you control the room it happens in — the app warns you at every display.
Breaking Cutout →
The complete adversary’s manual: every known way to break, degrade, or fool Cutout — so you can judge your own exposure.
Clients
Two tiers. One protocol. Zero pretending.
Reference tier In development
Native appiOS & Android
- Full threat model: background polling, blind fetch every tick
- Constant-rate cover traffic, maximized within OS limits
- All tunnel modes — direct, embedded WireGuard, Tor
- Reproducible, signed builds from a pinned toolchain
Convenience tier
Web appPWA, installable, self-hostable
- The identical protocol and crypto — messages interoperate fully
- Runs anywhere a browser runs; host it yourself as static files
- Protections active only while open — and it tells you so, permanently
- Direct connection only; browsers can’t open tunnels
Self-host
Your server. Your rules. One command.
A single static Go binary with an embedded SQLite store. Point a domain at a fresh VPS and it obtains and renews its own TLS certificates — or slot it behind the reverse proxy you already run.
- Closed by default — admission is gated by a secret shared only via the server’s QR code, at a physical meeting
- Nothing to administer — no accounts to manage, no data to moderate, messages self-delete within a day
- Nothing worth stealing — the database holds opaque, expiring blobs the server itself cannot interpret
- Clients switch servers with a QR scan — no reinstall, no recompile
Full source of server and clients is on GitHub — auditable by anyone. Free for individuals and any organization under $10M revenue.
fresh-vps ~ %
# 0 — get the code
$ git clone https://github.com/etragardh/cutout
$ cd cutout/deploy
# 1 — say who you are
$ cp cutout.env.example .env
$ $EDITOR .env # SERVER_URL=https://chat.example.com
# 2 — bring it up (TLS is automatic)
$ docker compose up -d
✓ cutout listening — cert obtained via Let’s Encrypt
# 3 — invite people, in person
$ cutout --qr
rendering server QR… hand your phone to a friend, not the network
Some conversations deserve a cutout.
No accounts. No recipients. No metadata. A server that couldn’t betray you if it tried.