DigitalValut Logos

Talk to anyone, wherever they are. No sign-up, no phone number, free forever.

Web app: https://digitalvalut.github.io/logos-protocol/ Source code: https://github.com/digitalvalut/logos-protocol · Apache 2.0 license

Examining the code? FAQ-TECNICA.md answers, with numbers measured rather than guessed, the questions a careful reader tends to ask first — test coverage, what the relay does and doesn't see, why the app is one file.

A peer-to-peer encrypted chat that runs entirely in the browser. There is no account to create, no phone number to give up, no company sitting between you and the person you're talking to. Two browsers connect directly to each other over WebRTC; once that connection exists, every message, call, photo and file travels straight from one device to the other. A small relay helps the two sides find each other at the start — see Architecture below for exactly what it does and doesn't see — but it never holds a key and never sees a plaintext message: there is no server in the middle that could read your conversation, log it, or hand it over to anyone.

• Direct connection, not a relay. The two browsers negotiate a private WebRTC channel and talk to each other directly. A single Cloudflare Worker helps the two sides find each other at the start and, when a very restrictive network requires it, relays the encrypted traffic — it never has a key and never sees a plaintext message.
• Permanent and throwaway identity, built on ECIES over ECDH (P-256). A device holds an ECDH key pair on the P-256 curve, generated on-device with a private half that has no byte form this code — or any code — can read back out. A shareable address (DV-XXXX-XXXX-XXXX) is the SHA-256 hash of the public half, so the address is self-certifying: whoever dials it fetches the published key, checks it actually hashes back to the address dialled, and only then trusts it. A substituted key produces a different address and is rejected. Each call seals its offer under a fresh one-time key pair of its own, so two calls to the same address share no secret with each other. A device can hold up to eight independent addresses at once, each revocable on its own.
• Encrypted from the first handshake. An invite is a link or a QR code carrying a 128-bit secret; the envelope is sealed with it (HKDF over a PBKDF2-stretched code + AES-256-GCM), so the six digits that name the slot open nothing by themselves. Address-based calls use the ECIES scheme above. Either way, the offer is useless to anyone who intercepts it without the matching device.
• You verify who you're really talking to. The first time you connect to someone, both sides see the same three-word security code, generated from the actual cryptographic connection (the same principle used by ZRTP-based secure calling). Read them out loud to each other once; if they match, nobody is sitting in the middle of your connection. That check is then bound to the other person's cryptographic fingerprint, not their name, so the app always knows if a "contact" is suddenly using different keys. Two devices in physical proximity can also connect by scanning a QR code carrying that fingerprint directly — a channel nobody can get into the middle of, so it verifies itself outright.
• Nothing is stored anywhere but your own device. Conversation history lives only in your browser's local storage, tied to who you were talking to. Close the tab, and unless you chose to keep it, it's gone. There is no database, anywhere, holding your messages.
• Zero runtime dependencies. Every cryptographic primitive comes from the browser's own Web Crypto API — no cryptography is hand-written, and no third-party script, library, or CDN resource is loaded at any point. To be exact: the web app has none; the Android wrapper declares one, androidx.webkit (what lets the bundled page run inside the system WebView), which brings Google's AndroidX compatibility libraries with it (core, annotation, lifecycle, collection, arch.core, versionedparcelable) — the full list, as found in the APK, is in prova-formale/PP-APP.md. No native code. Build tools (Gradle, the Android SDK, a JDK) produce the APK and are not part of what runs on the phone.

• Text messages, emoji, voice messages, photos, video and file sharing — files up to 512 MB, sent uncompressed at original quality, several at once by picking or dragging them in, each with its own progress bar.
• A photo leaves its GPS location and camera model behind, not carries it along. JPEGs and PNGs have their embedded location, device and software metadata stripped on-device before sending — not by re-compressing the picture, which stays pixel-for-pixel the same, just by cutting out the wrapper data that had nothing to do with the image itself.
• Audio and video calls, direct between the two browsers, with screen sharing — swaps the camera track for the screen mid-call, on any browser that supports it, no new server and no extra cost involved.
• Hide where you are (a switch in the settings, off by default): every new conversation and call goes only through the encrypted TURN bridge, so the other person never sees your internet address — the same idea as Signal's "always relay calls". A little slower, and if the bridge cannot be reached it does not connect, rather than fall back to showing where you are.
• Share straight into it from any other app (Android): pick "DigitalValut Logos" from the system Share menu in Photos, Gmail, anywhere — the file arrives waiting to be sent, even before you've connected to anyone.
• A permanent address (DV-XXXX-XXXX-XXXX) to hand out instead of a phone number, plus up to 8 throwaway addresses for a listing or a stranger — delete one and that person can no longer reach you, without touching anything else.
• Connect by short 6-digit code, by a tappable invite link, by dialling an address, or by scanning a QR code in person — whichever is easiest for the two of you.
• An invite that waits. Send one and close the app. Whoever opens it — an hour later, a day later — makes your phone ring; you open the app and you're connected. Neither of you has to be sitting there waiting.
• A contacts list that remembers a real address, not just a name. Once a call to someone's permanent address has connected, calling them again is one tap — no invite to redo, even if you never actually chatted before that first call.
• A letter for someone who doesn't answer. Call an address and nobody's there? Leave a message, held for up to 7 days, sealed so only the address's owner can open it.
• A simple mode: two very large buttons and nothing else on screen, with the instructions read out loud in your own language. Both off unless you switch them on.
• A self-destruct timer for messages, when you want a conversation to leave no trace at all.
• Automatic cleanup, entirely opt-in and off by default: turn it on and the app quietly deletes conversations older than the number of days you choose (7, 30, 90 or 365), so history never has to be managed by hand.
• An optional "knock" — a push notification with no name and no message inside it, only "someone wants to talk" — so you can hear from someone without keeping the app open, and without any server ever learning who your contacts are.
• Works as an installable app on iPhone, Android, and desktop, and keeps working offline once installed for everything except reaching another person (that part always needs both of you online, since there is no server to hold a connection open on your behalf).
• The full interface in 13 languages — Arabic, Bengali, Chinese, English, French, German, Hindi, Indonesian, Italian, Portuguese, Russian, Spanish and Urdu — detected automatically from your device, with proper right-to-left layout for Arabic and Urdu.

Logos works over a VPN, and — on Android, through the Orbot app — over Tor: tried on real phones on 15 Sep 2026, calls connect and work, just a few seconds slower to start. Nothing to configure: turn the VPN on, open Logos. If you would rather that the person you call, or the network you are on, did not see where you connect from, that is the way to do it — Logos itself never asks for, stores or shows anybody's location.

• iPhone / iPad — open the page in Safari, tap Share, then Add to Home Screen.
• Android — open it in Chrome and tap Install, or menu → Add to Home screen.
• Windows / Mac / Linux — click the install icon in the address bar of Chrome or Edge, or just keep it open as a normal browser tab — no installation is required to use it.

No app store, no account, nothing to buy.

There is also a signed Android package, if you would rather have a real app icon than a web-app shortcut: download the latest APK.

To get updates automatically without any app store, use Obtainium — it installs and updates apps straight from their source releases. Add this URL as the app source:

https://github.com/digitalvalut/logos-protocol

Obtainium will find each new android-* release on its own from then on.

Every published APK is signed with the same key, whose SHA-256 fingerprint is:

423e3094890bd7ee31e4438b687bf0ccdc41dba44a2f512eba27d7e533fee190

You can check any downloaded file against it with apksigner verify --print-certs <file>.apk — if the fingerprint differs, the file did not come from us, whatever it claims.

Reproducible, and attested. After every release a GitHub workflow (.github/workflows/riproducibile.yml) rebuilds the package twice from the tagged source, checks the two builds are identical, and compares the result entry by entry with the published APK (signature aside). When that passes it deposits a signed build-provenance attestation (Sigstore, via GitHub) for the rebuilt package, naming the commit and the workflow that produced it. Anyone can check it: rebuild the unsigned package as described in android/RILASCIO.md, then

gh attestation verify app-release-unsigned.apk -R digitalvalut/logos-protocol

What the package contains, measured rather than declared, is in SBOM.md: zero runtime dependencies for the web app and the relay; for the Android wrapper, one declared library (androidx.webkit) and its seven AndroidX transitives. A public status page — stato.html — shows whether the relay, the site and the download link were answering at the last automatic check, which runs every 30 minutes, read-only, with no credentials.

What is inside the package: the whole application. It is not a wrapper that opens the website — assets/logos.html is the single-file build in this repository, served to the app's own WebView from https://appassets.androidplatform.net, an address Android reserves for an app's own bundled files and which nothing outside the app can reach. So the app opens and works with the website unreachable, which where the web is filtered is the difference between having the tool and not having it.

It is served over https rather than opened as a file:// path for a reason worth stating plainly: a file:// page is not a secure context, and a browser withholds Web Crypto and WebRTC from one — an app with neither encryption nor calls, which is to say nothing at all.

python3 build-single-file.py

That produces digitalvalut-logos.html — the whole application, stylesheet and logic folded into one self-contained file. Put it on any web host and the app is running again; keep it on a USB stick and you are carrying it. It is the real thing, not a reduced copy.

The page refuses to run any code that is not its own, so the build names its two inlined blocks by their SHA-256: change a single character anywhere in that file and the browser itself will refuse to run it.

575 automated tests (measured 29 Sep 2026), each verified by deliberately reintroducing the bug it guards against and confirming it fails red before the fix — not just written to pass. They run in a ~150-line hand-written browser sandbox, not a framework, in keeping with the zero-runtime-dependency rule. node --test from the repository root (Node 22).

Line coverage: 85.7% of the app's code lines are executed by the suite — 6,772 of 7,901, blank lines and comments excluded (measured 28 Sep 2026). The number is taken from V8's own coverage data (NODE_V8_COVERAGE), because the tests load modifica.js into a sandbox where Node's built-in coverage report cannot see it; the script that turns the raw data into lines is tools/copertura-righe.js. The 1,129 lines the suite does not reach are spread across the app; the largest groups are the health report shown to the user, invite creation, and local history. Closing those gaps is ongoing work, and this number will be re-measured, not rounded up.

Formal analysis. The signalling protocol — how two devices find each other through the relay — is written out in full and modelled in Tamarin and ProVerif, the tools used to analyse Signal, TLS 1.3 and 5G. The models, the results, and a manual GitHub Actions workflow to re-run them are in prova-formale/. The address handshake is proven secret and authenticated against a relay adversary; the analysis also found the defects fixed in 4.38 (see the folder). The models were written by the project and have not been independently reviewed — that is the next step, and the reason they are published. Since 28 Sep 2026 a TLA+ model covers what those tools cannot see — timing: how a live call renews its TURN credentials and recovers from a dropped network, together. It found two defects in 4.61, fixed in 4.62 (prova-formale/tla/). If you are that reviewer, start from prova-formale/PER-IL-REVISORE.md: every promise Logos makes, mapped to the code, the lemma, the test, and how to check it yourself.

Logos is developed by the DigitalValut team, under the direction of Dr. Giuseppe Falsone, also with the help of an AI coding assistant (Claude, by Anthropic). The rules the assistant works by are published with the code, in CLAUDE.md.

That is exactly why nothing here asks to be taken on trust: every test is kept only after it has been made to fail against the defect it guards, the signalling protocol is modelled in Tamarin and ProVerif, the Android package can be rebuilt byte for byte by anyone, and the whole app is one file a single reader can follow (how to read it).

DigitalValut Logos is released under the Apache License, Version 2.0 — see LICENSE for the full text. You may use, modify, and redistribute this software, including in closed-source or commercial products, under its terms.

For arrangements outside the terms of the Apache License 2.0 — custom support, warranty commitments, or other terms not covered by the license as published — contact DigitalValut via www.digitalvalut.it.

"DigitalValut", "DigitalValut Logos" and their logos are the names and signs of the Associazione di Promozione Sociale DigitalValut. As Section 6 of the Apache License 2.0 states, the license covers the source code and does not grant permission to use these names or logos, except as reasonably needed to describe where the work comes from. A modified version must not present itself as DigitalValut Logos or suggest that DigitalValut endorses it without written permission.

Conceived by Dr. Giuseppe Falsone, President of DigitalValut, built with the DigitalValut Team.

© 2026 Associazione di Promozione Sociale DigitalValut (Ente del Terzo Settore), a registered Italian nonprofit.

www.digitalvalut.it

Parla con chi vuoi, ovunque sia. Senza registrarsi, senza numero di telefono, gratis per sempre.

DigitalValut Logos è una chat criptata da persona a persona (peer-to-peer), che funziona interamente nel browser: nessun account, nessun numero di telefono, nessuna azienda in mezzo tra te e chi parli con te. I due browser si collegano direttamente tramite WebRTC: una volta stabilita la connessione, messaggi, chiamate, foto e file viaggiano direttamente da un dispositivo all'altro, e nessun server può leggerli.

L'indirizzo permanente (DV-XXXX-XXXX-XXXX) è l'impronta di una coppia di chiavi ECDH su curva P-256, generata sul dispositivo: chi chiama verifica che la chiave ricevuta corrisponda davvero all'indirizzo composto, e cifra la busta con ECIES verso quella chiave — solo il dispositivo che possiede la chiave privata può aprirla. Il codice d'invito e i dati di riconnessione sono cifrati prima ancora di lasciare il dispositivo; alla prima connessione con qualcuno, entrambi vedete lo stesso codice di sicurezza a tre parole, generato dalla connessione crittografica reale — dette a voce una volta, confermano che nessuno si è messo in mezzo. La cronologia resta solo sul tuo dispositivo: nessun database, da nessuna parte, la conserva al posto tuo.

Messaggi, foto, video, chiamate — con condivisione dello schermo durante le videochiamate — file fino a 512 MB nella qualità originale, mandabili più alla volta trascinandoli dentro, e su Android condivisibili direttamente da un'altra app (Foto, Gmail, ecc.) senza nemmeno aprire prima Logos. Le foto lasciano indietro la posizione GPS e il modello del telefono prima di partire, senza perdere un pixel di qualità. Un indirizzo permanente più fino a 8 indirizzi usa e getta, una rubrica che richiama un indirizzo salvato con un tocco solo, autodistruzione dei messaggi, pulizia automatica opzionale (spenta di base), un "colpetto" push discreto per farsi sentire senza tenere l'app aperta, codice QR o link per collegarsi, l'interruttore «Nascondi dove sei» (l'altra persona non vede il tuo indirizzo internet: tutto passa dal ponte cifrato), e tutta l'interfaccia in 13 lingue. Si installa su iPhone, Android, Windows, Mac e Linux senza alcun account né pagamento. Su Android c'è anche un pacchetto APK firmato (ultima versione), aggiornabile in automatico con Obtainium senza passare da nessuno store. Quel pacchetto contiene l'applicazione intera: non apre il sito, lo porta dentro di sé — quindi funziona anche dove il sito è bloccato.

L'invito aspetta: mandalo e chiudi pure l'app — chi lo apre, anche il giorno dopo, ti fa squillare il telefono, e appena riapri siete connessi. Il QR si verifica da solo: inquadrare il codice sullo schermo di chi hai davanti è un canale che nessuno può intercettare, e l'app lo riconosce senza chiedervi altro. C'è una modalità semplice con due soli pulsanti giganti e le istruzioni lette ad alta voce, per chi non vede bene o non legge. E tutta l'app sta in un unico file che chiunque può caricare ovunque.

Come è scritto il codice. Logos è sviluppato dal team DigitalValut, sotto la direzione del Dott. Giuseppe Falsone, anche con l'aiuto di un assistente di programmazione AI (Claude, di Anthropic). Per questo nulla va preso sulla fiducia: ogni test deve aver fallito prima di essere accettato, il protocollo è verificato con modelli formali, e il pacchetto Android è ricostruibile identico da chiunque. I test fanno girare l'85,7% delle righe di codice dell'app (misurato il 28 set 2026). Per orientarsi nel codice: READING-THE-CODE.md.

Ideato dal Dott. Giuseppe Falsone, Presidente di DigitalValut, realizzato con il Team DigitalValut. © 2026 Associazione di Promozione Sociale DigitalValut (Ente del Terzo Settore) — software libero e open source, licenza Apache 2.0.

www.digitalvalut.it