End-to-end encrypted messaging and calls, with no contact upload. When the other person is nearby, a message goes phone to phone over Bluetooth or Wi-Fi and touches no server at all.
Encrypting the message was never the hard part. Every mainstream messenger encrypts contents; what they keep is the record of who talked to whom, and when. CHANNEL is built so that record mostly does not exist: there is no account to attach it to, and the nearby case never reaches us.
What the product promises is the direct case (DECISIONS.md §J, 1 September 2026). Phone-to-phone is the product. Multi-hop carrying between strangers is implemented and specified, but it is unproven in the field and is not promised to anyone.
There is a server, and it is a mailbox. When the other person is not nearby, sealed mail waits on it until their phone collects it. It cannot read anything it holds, but it is in the path, and pretending otherwise would be the sort of claim this project exists not to make. THREAT-WALKTHROUGH.md says what it does learn.
The public site carries the same status in four states, item by item, at channelmessenger.net — that page carries the date, it is the one written for users, and it is more specific than this table. There is deliberately no date here: a second dated copy of the status is the one that goes stale.
Wire protocol (PROTOCOL.md, vectors/) | complete |
|---|---|
mesh-core-rs — the one implementation of the protocol | built; its test suite green |
| iPhone app | built; in TestFlight, not publicly released |
| Android app | built; in Play internal testing, not publicly released |
| Transports — Bluetooth, local Wi-Fi, a direct Internet link over IPv6, the server mailbox | built; the cross-platform Bluetooth case still needs a retest on two real phones |
| Languages | English, Spanish, Portuguese, German, Italian. English governs |
| Group messages and group calls | built in both apps, in testing |
| Forward secrecy (Double Ratchet) | built in both apps; used between two phones whose builds both carry it, in one-to-one conversations |
| Desktop | on a Mac with Apple silicon the iPhone app runs |
Neither app is released. CHANNEL is a paid app — it is sold by subscription, after a store-managed free trial, and an install whose subscription has lapsed keeps working with sending over the Internet withdrawn. Nothing in this repository should be written as though the app were free: consumer law applies either way, and the stores are the merchant of record.
Two platform implementations — iOS and Android — drift apart unless something pins them. vectors/ is that something: fixed inputs to expected bytes, generated by vectors/generate.py and never transcribed by hand. A second implementation can prove conformance without a radio.
Two examples of that paying off, both real:
CHANNELPROTOCOL.md §3.3 was hand-written and wrong twice. Computing it caught both errors.vectors/04-route-cost.json does not merely check the weakest-link rule, it discriminates: an implementation that picks the strongest first hop chooses the wrong route and fails.No accounts, no phone number required, no telemetry about you (the one exception is a daily count of AI calls from a Mac that lets an AI use a profile, linked to nobody), no address-book upload, no moderation capability, and no claim of anonymity against a global observer. Each of these is a decision with reasoning in DECISIONS.md, not an omission.
Two entries on that list used to read no server and no remote push, and both were wrong by September 2026. There is a server, and it is described above. There is remote push, because a phone that never wakes never collects its mail; docs/help/push.md says exactly what Apple and Google are told, which is that something is waiting — not who sent it, and not what it says.
English is the reference text; any translation is a convenience.