CHANNELIn testing Notify me

Status

What works today, and what does not

Status as of 27 September 2026.

A page like this is usually written in the future tense. Here is the present one instead. Every item below carries a label saying which of four states it is in, and the label is spelled out rather than implied by a colour or a typeface.

  • WorkingBuilt in both apps and used on real phones.
  • Working, with a limit worth statingIt does what it says, and there is something about it you should know before you rely on it.
  • Not yetDesigned, sometimes built, but no user can reach it.
  • Not plannedNot being built. Listed so that its absence is not read as “coming soon”.

Working

  • WorkingSealed messages between two phones, opened only on the phone they were sent to.
  • WorkingDelivery through the Internet mailbox, with the mark on each message saying which path carried it.
  • WorkingDelivery over the local network, when both phones are on the same Wi-Fi. On one tester's two phones it has carried every message it was given, in both directions.
  • WorkingBluetooth between an iPhone and an Android phone. Measured on one tester's two phones: 94 of 131 attempts delivered from the iPhone and 76 of 222 from the Android phone. The rest fall through to another path, so the message still arrives.
  • WorkingVoice calls between an iPhone and an Android phone, sealed between the two. They ring and carry sound in both directions, confirmed on real phones on 26 September 2026. Calls from iPhone to iPhone and from Android to Android are untested on real phones.
  • WorkingWaking the phone by a push the moment an envelope lands for it.
  • WorkingPairing by code: show yours or type theirs, and each phone says afterwards how it was paired.
  • WorkingProfiles: separate keys, contacts and conversations, and settings-only copying when you make a new one.
  • WorkingDisappearing messages and view once, with the view-once picture shielded from screenshots while it is on screen.
  • WorkingPhotos, in both directions, sealed like any other message.
  • WorkingSending your location, and sharing it live for a fixed time or until you stop it.
  • WorkingVerification by text message in the United States. The carrier in Brazil refuses it.
  • WorkingAI, on your own account or, on an iPhone that supports Apple Intelligence, on the phone itself with no key and nothing sent anywhere. Seen answering on a real phone.
  • WorkingEverything the app writes to disk encrypted under a key held in the phone's secure hardware.
  • WorkingThe help pages inside the app, and the settings that choose how often the phone looks for mail.
  • WorkingOn a Mac with Apple silicon, CHANNEL runs as the iPhone app, and Return sends.

Working, with a limit worth stating

Each of these says what its limit is. For most of them the limit is the same one, and it gets a list of its own.

Not confirmed between two people’s phones

These are in the current test builds and do what they say there. Nobody holding two phones has confirmed them end to end, so we are not telling you they work.

  • Working, with a limit worth statingVideo calls. The sound is confirmed between real phones; the picture is unconfirmed.
  • Working, with a limit worth statingGroup conversations: add somebody from a conversation's menu and it becomes a group of up to 8 people, each message sealed separately to each of them.
  • Working, with a limit worth statingRelay for Others: a phone carries sealed mail it cannot read for other people and hands it on. Seen carrying on a real phone.
  • Working, with a limit worth statingVoice messages, with no length limit: a long one goes in four-minute parts while you are still talking.
  • Working, with a limit worth statingVideo, up to 2 GB sent and up to 3 GB received, and files of any kind, sealed like any message.
  • Working, with a limit worth statingForward secrecy: the message key changes as you go, so a key taken from a phone opens little of what came before. It is our own implementation of Signal's published Double Ratchet, in the core both apps share. It has run between two test devices; no outside cryptographer has reviewed it.
  • Working, with a limit worth statingAI pictures: Make a Picture draws one from a description on your own OpenAI or xAI account, and it is sent like any photo.
  • Working, with a limit worth statingRead aloud, and enhanced chat privacy: a switch on one conversation that stops anything in it being saved, shared, forwarded or read by an AI feature.
  • Working, with a limit worth statingWaking the phone on a clock instead of by a push.
  • Working, with a limit worth statingVerification by phone call, which reads the code aloud twice.
  • Working, with a limit worth statingWriting to somebody who has not paired with you yet, so that the first message is the invitation.
  • Working, with a limit worth statingThe map drawn inside the app, with the distance and the compass arrow.
  • Working, with a limit worth statingBackup and restore, including moving to a different phone.
  • Working, with a limit worth statingThe app PIN and the distress code, and a separate PIN for one profile.
  • Working, with a limit worth statingLinked devices: linking a second device, choosing which profile it carries, the app PIN standing in front of linking, and removing a device taking effect at once.
  • Working, with a limit worth statingHandles: claiming a name, and being reached at it by somebody who knows neither your number nor your address. One per profile, registered so the server never holds a readable list.
  • Working, with a limit worth statingErasing your data: everything, or everything except your contact cards, which come back unpaired. And erasing a linked device from the phone that linked it.
  • Working, with a limit worth statingReactions: one of six, one per person per message, and nobody is notified of one.
  • Working, with a limit worth statingArchiving a conversation, by swiping the row or by holding it, and putting it back the same two ways.
  • Working, with a limit worth statingThe app and its help pages in Spanish, Portuguese, German and Italian, following the phone's own language. English remains the reference text.
  • Working, with a limit worth statingTwo columns on a wide screen: the list beside the conversation, the contacts beside the card.
  • Working, with a limit worth statingThe date above each day's first message, and a message that gets sent twice being recognised rather than shown twice.
  • Working, with a limit worth statingHelp pages that can update themselves without a new version of the app, and only when you press the button that fetches them.
  • Working, with a limit worth statingDirect Wi-Fi, phone to phone with no network at all. It works between two iPhones or between two Android phones. It does not work between one of each, because the two systems use different radios for it; Apple added the shared standard in iOS 26 and it still does not reach Android. A mixed pair in the same room uses Bluetooth, or the local network if they share Wi-Fi.
  • Working, with a limit worth statingThe setup interview: two questions on first run, your name and how you can be found. It can be closed and resumed, and run again later from Settings.
  • Working, with a limit worth statingPointing AI at your own server instead of a company's, by address, so a machine on your own private network can answer.
  • Working, with a limit worth statingFormal groups: an admin, joining by invitation or by a request the admin accepts, and a choice of who may post. Members’ posts pass through the admin’s phone, so they reach the others when that phone next connects.
  • Working, with a limit worth statingUpdates: a line of text, a photo, a video of up to a minute or a voice note of up to half a minute, seen for 24 hours by the contacts you choose. A video or voice note is sealed once and kept on our server for a day; the server learns its size and nothing of what is in it.
  • Working, with a limit worth statingOn Android, CHANNEL in the Share menu of other apps: a photo, video, file, link or text opens in the conversation you choose and waits there until you press Send.

Limits of the design, or of the phones

  • Working, with a limit worth statingThe local network path tells the network you are running CHANNEL. To find another phone on the same Wi-Fi it announces itself, and the announcement carries the phone’s own name, because neither platform lets an app leave that out. On a café, hotel or office network that can tie the app to a named person. Settings turns that one path off without affecting the other three.
  • Working, with a limit worth statingA text message to somebody who does not use CHANNEL is not sealed. It is the one thing in CHANNEL that is not end-to-end encrypted: our server and the phone network can both read it. The app says so before you turn it on, and on every message that goes that way.
  • Working, with a limit worth statingWaking your phone has a cost, and you choose it. With Push, Apple or Google learn roughly when your phone is woken, though not by whom or about what. Fetch wakes on a clock instead, and On Demand registers nothing anywhere.
  • Working, with a limit worth statingThere is a server, and a message passes through it when no radio can reach the other phone. It cannot read what it holds, and it has no account to attach you to.
  • Working, with a limit worth statingThe two apps are drawn differently in places: the conversation list, the chat screen, the delivery ticks and several smaller controls. Everything on this page works on both.

Not yet

Designed, and one of them partly built, but no user can reach any of them. Nothing here carries a date, and nothing here should be read as a promise.

  • Not yetCollecting replies for a phone with no internet of its own, through a nearby phone that has it. The nearby phone passes the sealed request along unread, so it learns that traffic passed and nothing else.
  • Not yetCHANNEL AI credits. For people who would rather not open an account with a provider, the option to buy credits and use ours, priced at double what it costs us and said plainly, with the honest note that anyone who uses AI a lot is better off with their own key.
  • Not yetA bridge to Telegram, where the network genuinely allows a real client. A bridged conversation would be marked as not sealed end to end through CHANNEL, because only one end would be ours. Writing to somebody by ordinary text message works today, marked the same way.
  • Not yetA Windows app.

Not planned

  • Not plannedMulti-hop mesh, as a promise. CHANNEL is a direct phone-to-phone messenger. The protocol can carry a message through other phones, and Relay for Others does, but that pays off only where many phones run CHANNEL in one place, and that has not been measured. It is in the product. It is not a promise, and nobody should buy the app for it.
  • Not plannedContact upload, analytics, advertising code, and message history on our server once delivery is confirmed. These are decisions, not gaps, and each is written down with its reasoning in the published documentation.

Next: Compare →