Feature status

Last updated: September 12, 2026. This page says what Channel Messenger can actually do right now, feature by feature, including the parts that do not work. It exists because the usual version of this page is written in the future tense, which leaves you to work out for yourself which sentences describe the app and which describe somebody's intentions.

Every line below was checked against the app's own source and against the help pages that ship inside it. Nothing here carries a date. We do not know when the unfinished things will be finished, and a date invented for this page would be exactly the sort of claim the page exists to avoid.

Where the apps are

Neither app is released. The iPhone build is in TestFlight and the Android build is in Google Play's internal testing track, each with a handful of testers. You cannot buy Channel today.

Channel will be a paid app. There is no free tier, no advertising and no analytics, because the way most messengers are paid for is the thing this product is arguing against.

The wire protocol is implemented once, in Rust, and both apps call into that same code rather than each having their own copy. That is why the two apps agree about the format of a message even where they still disagree about how a screen looks.

The four states

• Working. Built in both apps and used.
• Working, with a limit worth stating. It does what it says, and there is something about it you should know before you rely on it.
• Not yet. Designed, sometimes built, but no user can reach it.
• Not planned. Not being built. Listed so that its absence is not read as “coming soon”.

Working

Messages

• Sealed messages. Every message is encrypted on your phone to the other person's key and opened on theirs. Nothing in between can read it. See How encryption is used.
• Four ways a message travels. Bluetooth, direct Wi-Fi, the local network, then our internet mailbox. Channel takes the first that works, small lights beside a contact show which paths are open, and each message carries a letter saying which one actually carried it.
• The internet is a fallback, not a copy. If a radio can reach the other phone, the message goes that way and our server never sees it. You can switch the internet path off for a profile entirely.
• Photos, sealed like any other message, with a setting that keeps pictures off the internet altogether.
• Voice messages, recorded in the composer, up to four minutes. A voice message waits on your phone if nothing can carry it and goes on its own when a path returns.
• Location. One fix taken at the moment you tap, or a live share for 15 minutes, an hour or 8 hours that ends by itself. There is a map inside the app showing both phones, the distance and an arrow, and it hands off to whichever map app you prefer.
• Disappearing messages on a timer both sides can see, and view once for a picture, which is shielded from screenshots while it is on screen. A voice message can be sent the same way, where it means played once.
• Enhanced chat privacy, a switch on one conversation that stops anything in it being saved, shared, forwarded or read by an AI feature, on both phones.
• Reactions, one of six, one per person per message, and nobody is notified.
• Read receipts, both ways or neither, with sent, delivered and read times under a long press.
• Forward, copy, share, delete, and a wallpaper you can set behind one conversation.

Getting connected to somebody

• Pairing in person. One phone shows a code and the other types it in. There is no camera in pairing: a scan and a typed code produce exactly the same result, and a photograph of a screen cannot tell you who was standing behind it. The camera is still used for one job, linking a second device of your own.
• Being found at a number or an email address you have proved is yours. Somebody who knows the value can simply write to you; their first message is the invitation, and you accept, decline or block it. Proving a value and publishing it are two separate switches, so a verified number can stay private.
• Handles. A name people can reach you at without knowing your number or your address. One per profile, ten per phone, and it needs a proved number or address behind it, which is never published.
• Your own address book, without uploading it. Channel can show you your contacts so you do not have to retype a name. That list is read while the screen is open, never saved, never hashed and never sent anywhere. Only the person you choose becomes a Channel contact.

The phone

• Profiles. Separate identities on one phone, each with its own keys, contacts and conversations, sharing nothing. Nobody you talk to can tell that two of them are on one phone.
• Setup. A ten step interview on first run covering your name, how your phone is woken, which paths you allow, the lock, how you can be found, calls, AI and maps. You can skip most of it, finish it later, and run it again from Settings.
• The lock. Your phone's own unlock, or a PIN of your own that works on a phone with no lock at all, plus a separate PIN for one profile. A distress code destroys everything Channel holds on the phone, and neither code is stored, so nobody can reset one, ourselves included.
• Encrypted on disk under a key held in the phone's secure hardware, and deliberately left out of iCloud Backup and the Android equivalent.
• Erase, either everything, or your conversations and keys while keeping the names and numbers on your cards.
• Backup and restore. One encrypted file under a passphrase you choose, handed to your phone's own file picker. We never hold the passphrase, never receive the file, and cannot recover either.
• Linked devices. Up to four, each carrying one profile, each sealed to its own keys. Removing one stops people writing to it at once.
• Push, Fetch or On Demand for waking the phone to collect waiting mail, with quiet hours. On Demand registers nothing with Apple or Google at all.
• AI on your own account, or none. OpenAI, Anthropic, xAI, or a server you run yourself; on an iPhone that supports Apple Intelligence, answers come from the phone with no account and nothing leaving it. Nothing is ever sent on its own, and every use shows you exactly what will leave before it goes.
• Help inside the app. Eleven pages, in English, Spanish, Portuguese, German and Italian, which work with no network and report nothing to anyone. The app follows your phone's own language in those same five.

Working, with a limit worth stating

Bluetooth is the least reliable of the four paths

On one tester's phone, of 211 attempted Bluetooth sends, 41 arrived. The rest failed to connect, failed on the write, or found the other phone gone by the time we dialled. Because Bluetooth is the first path Channel tries, a failing attempt can also delay a message by several seconds before it gives up and goes another way.

We have found one cause of this and fixed it, but that fix is not yet in a build anybody has tested, so we are not going to tell you the problem is behind us. Messages do still arrive: a send that Bluetooth cannot complete falls through to Wi-Fi, the local network or the internet.

Direct Wi-Fi cannot cross between an iPhone and an Android phone

This is a platform limit rather than ours. Apple's peer-to-peer Wi-Fi and Android's Wi-Fi Direct are different, incompatible things, so the W path works between two iPhones or between two Android phones, and not between one of each. Those two can still reach each other by Bluetooth, by the local network, or by the internet.

Bluetooth between an iPhone and an Android phone has not been retested

It is built on both sides. It has not recently been confirmed by somebody holding one of each in the same room, so we are not claiming it.

The local network path tells the network you are running Channel

To find another phone on the same Wi-Fi, Channel has to announce itself, and the announcement carries your phone's own name, because neither platform will let an app leave that out. On your own Wi-Fi that tells nobody anything. On a café, hotel or office network it can tie the app to a named person. Nothing is said about who you talk to and no message is readable, but the fact is visible, and you can switch that one path off in Settings without affecting the other three.

A code by text message cannot yet reach a phone in the United States

Proving that a number is yours needs a six-digit code, and there are three routes for it. Email works. A code read aloud down the phone is built but has not been confirmed against a real handset. A code by text message cannot be delivered at all yet: US carriers require the sending number to be attached to a registered campaign, ours was submitted and is still under review, and until it is approved nothing goes out that way. Everything behind it is built and waiting.

Read aloud is on the iPhone only

Long press a message on an iPhone and Channel can speak it, on the phone, offline. Android has none of this yet.

The two apps do not yet look identical

They are meant to. Today the conversation list, the chat screen, the delivery ticks and several smaller controls are drawn differently on iPhone and on Android. Everything works on both; they do not match yet, and we are fixing it screen by screen.

A message could be filed under the wrong contact

In the builds testers are holding, a message could be attached to the wrong conversation where a contact's card carries the keys from more than one pairing. The cause was found and fixed on 12 September, and the fix is not yet in a tested build. A card made before that fix can still file wrongly until the two of you pair again.

Waking your phone has a cost, and you choose it

If you let our server wake your phone the moment mail lands, Apple or Google learn roughly when your device is woken, though not by whom or about what. Fetch wakes on a clock instead, which says nothing about any message, and On Demand registers nothing anywhere. The privacy policy sets out exactly what each one costs.

There is a server, and it is in the path when a radio cannot be

It cannot read anything it holds and it has no account to attach you to, but it exists and your message does pass through it when direct delivery is not possible. We would rather say that plainly than let “end-to-end encrypted” do the work of hiding it.

Not yet

• Writing to somebody who does not use Channel, as an ordinary text message. The feature is built, and it is waiting on the same carrier registration described above. Nothing can go out this way until that is approved. It is also the one thing in the app that would not be sealed: our server and the phone network can both read a text, and the app says so before you turn it on, and on every message that went that way.
• Video. You cannot send a video. The attachment format deliberately has no video type yet, because carrying video properly needs decisions about size and quality that have not been made.
• A desktop app, for macOS or Windows. Not started. Linking a second device works between phones today; a computer is the piece that does not exist.
• Buying AI from us. If you want AI features today you bring your own account. Credits you could buy from us instead are designed and priced and not built.
• A warning when a contact's key changes. Channel does not currently notice that the key behind a contact is no longer the one it was, and tell you. That is the moment you would most want to be told, and the app is silent. It is the next security gap on the list.

Not planned

Voice and video calls inside Channel

The phone and video buttons in a conversation hand the call to an app you already have: your dialer, FaceTime, WhatsApp, Signal or Telegram. Channel does not place the call itself, and that is not what is being built. Carrying a call means relaying a continuous stream of audio, which is the one workload that would make this service genuinely expensive, and a call also defeats most of what the rest of the design is doing to keep your traffic shapeless. If it is ever built, the honest shape is calls between two phones already near each other, with no relay at all.

Multi-hop mesh, as a promise

Channel is a direct phone-to-phone messenger. The protocol can carry a message through intermediate phones, that code exists, and Settings has a Relay for Others switch which lets your phone carry sealed mail it cannot read and hand it on later. We are not going to oversell it. Carrying only pays off when enough phones are running Channel in one place, and that has not been measured on real hardware at real density. It is in the product. It is not a promise, and you should not buy the app for it.

Things that are decisions, not gaps

No account, no phone number required, no contact upload, no analytics, no advertising code, and no message history on our server once delivery is confirmed. These are not features waiting to be built. They are the design, and each of them is written down with its reasoning in the published documentation.

If you think something here is wrong

We would rather be corrected than believed. The design notes, the wire protocol, the threat walkthrough and the help pages exactly as they ship in the app are all published at channelmessenger.net/docs, so you can check this page against them. Anything that looks wrong, including a claim on this page that overstates what the app does, can be sent to de57@me.com.

Home · Privacy policy · How encryption is used · Documentation