Private messaging without a central server

1. Open Khandaq on Google Play.
2. Tap Install. Updates arrive automatically through Google Play.
3. Coming from an old sideloaded/debug build? Export your Tox profile → uninstall the old app → install from Google Play → import the profile (the signing key is different).

Every desktop file is signed with a key published in the source repository — a different place from this website. A checksum alone cannot help you here: whoever could replace the download could replace the checksum beside it. A signature made with a key we do not serve from this server can.

1. Get the signing key and the signer list from the repository (not from this page):
   curl -O https://raw.githubusercontent.com/ummalife/khandaq/master/web/downloads/allowed_signers
2. Download the file and its .sig, then check them:
   ssh-keygen -Y verify -f allowed_signers -I releases@khandaq.org -n khandaq-release -s khandaq-messenger_amd64.deb.sig < khandaq-messenger_amd64.deb
3. Good "khandaq-release" signature means the file is the one we built. Anything else means do not run it, and please tell us.

ssh-keygen is already on macOS and Linux, and comes with Git for Windows. SHA256SUMS.txt is still published for convenience, but it is an integrity check, not a trust anchor.

1. Verify the signature as above, then unzip the archive and run Khandaq.exe.
2. Windows will warn that the publisher is unknown: the desktop build is not yet Authenticode-signed, and we are not going to pretend that is fine. Verifying the signature above is what tells you the file is genuine; the Windows warning is telling you something true, which is that it cannot check that for you.
3. We are not asking you to add antivirus exceptions. If your antivirus objects to a file whose signature verifies, please report it to us — that is a false positive worth chasing, not something to switch off.

1. Verify the signature as above, then unzip and move khandaq.app to Applications.
2. The build is not yet notarized by Apple, so Gatekeeper will not open it on a first double-click. Right-click the app → Open → confirm: that is the documented way to run an app Gatekeeper cannot vouch for, and it keeps the rest of Gatekeeper working.
3. Previous versions of this page suggested xattr -cr. It is no longer recommended: it strips the quarantine flag from everything in the bundle and turns off exactly the check you would want on the day a download is not genuine.

1. Download khandaq-messenger_amd64.deb and verify SHA-256.
2. sudo apt install ./khandaq-messenger_amd64.deb
3. Launch Khandaq from the app menu or run khandaq.

1. tar -xzf khandaq-linux-x86_64-portable.tar.gz
2. Keep khandaq, khandaq.bin, and lib/ together — see INSTALL.txt in the archive.
3. Recommended: install under ~/.local/share/khandaq/ and symlink ~/.local/bin/khandaq.

1. Install TestFlight from the App Store.
2. Open the public TestFlight link on your iPhone or iPad.
3. Accept the invite and install Khandaq. Updates arrive through TestFlight.

No. Khandaq uses the Tox protocol (peer-to-peer, no homeserver). This website now hosts the Khandaq Messenger download page.

No. Message content stays on your devices. The only Khandaq-operated service is the push wake relay — documented in the repository and in the privacy policy. Bootstrap discovery runs on the public Tox DHT, which we do not operate.

Open an issue on GitHub Issues or use the security advisory flow for vulnerabilities (private report).

Android: the official Google Play listing (install and auto-update from there). iPhone/iPad: via TestFlight while iOS is in beta. Windows, macOS, Linux: from the Download section above.

No. There is no account and no sign-up. You create a local profile and get a Tox ID — share it with people you trust to connect. No phone number, email or any personal detail is required or collected.

Because Khandaq is peer-to-peer, a closed app has no live connection. A lightweight push wake service nudges your device to reconnect and fetch the message — it never carries the message content, only a wake signal. Make sure notifications are allowed for Khandaq in system settings and that the app isn't force-stopped or battery-restricted. On Android, Google Play builds get these wakes automatically.

There is no central server holding your messages. A message is delivered when your contact's device is reachable. If they're offline it is queued and sent automatically once either of you reconnects — so a message can take a while if the other person hasn't opened the app. Keeping the app open (or allowing background/push) makes delivery near-instant.

No — and no one can. Your profile's encryption keys are derived from that password, and there is no server that stores it, so there is no reset. If it's lost you'll need to create a new profile (and a new Tox ID). Write your password down somewhere safe when you create the profile.

Export your Tox profile from the old device (Profile → export) and import it on the new one, so you keep the same Tox ID and contacts. A profile is meant for one active device at a time — running the same one on two devices simultaneously isn't supported by the Tox protocol.

Yes. 1:1 audio and video calls work across Android and iOS — both sides see each other's camera, upright and full-screen. Calls are peer-to-peer and end-to-end encrypted like messages.

Yes. Every message, file and call is end-to-end encrypted by the Tox protocol (NaCl cryptography), directly between devices. No one in the middle — including us — can read your messages or see your contacts.