Whisper is designed for one job: getting a short secret from one person to another over channels that aren’t private, and proving who sent it.
Protected
| Threat | How |
|---|---|
| Email/SMS providers, chat platforms, backups | They only ever carry ciphertext. |
| A compromised inbox or chat account, now or years later | Old messages in it are unreadable without the recipient’s private key. |
| Link previews and web servers | The payload is in the URL fragment, never sent over HTTP. |
| Forged messages (“updated wire instructions”) | Messages are signed; a ✓ appears only when the signing key matches a contact. |
| Re-targeting a signed message | The signature covers the recipient’s key and the ciphertext’s key exchange. |
| Tampering in transit | ChaCha20-Poly1305 authenticates the whole envelope, header included. |
| Length analysis | Payloads are padded to 64-byte blocks. |
| Someone picking up an unlocked phone | Optional app lock; history encrypted at rest. |
Not protected
- A swapped invite. Someone who can intercept and replace an invite could hand you their own key. Compare the safety code, or connect in person with the QR code.
- A compromised device. Malware or someone with your unlocked phone and app can read what you can read.
- The recipient. Once they read your message, they can copy it or screenshot it. Whisper doesn’t pretend otherwise — there are no “disappearing” messages.
- Forward secrecy. Messages are encrypted to the recipient’s long-term key (with an ephemeral sender key per message). If a private key is later stolen together with old messages, those messages can be decrypted. Keep history off, and rotate your key, if that matters to you.
- Metadata of the channel. Your phone company still knows you texted someone a link, and when.
- Replay. A message can be opened again; the timestamp is signed and shown, but there is no one-time delivery.