The Arpokrat Protocol
Privacy by architecture.

Built on SimpleX

Arpokrat Messenger doesn’t invent its own secret cryptography — it’s built on SimpleX , the first messaging network with no user IDs.

SimpleX is an open messaging protocol whose specification and source code are public and independently reviewable. The architecture on this page — no user IDs, unidirectional queues, blind relays — is SimpleX’s design, and Arpokrat operates its own relays on top of it.

Security you can’t inspect isn’t security. Building on an open protocol means these privacy claims can be checked against a public specification, not taken on trust.

• Open specification — the protocol is documented publicly, not a proprietary black box.
• Independently reviewable — the source code is public on GitHub , so the guarantees on this page can be verified.
• Arpokrat-operated relays across independent jurisdictions — see the Infrastructure page .

You Are a Key, Not an Account

Most messengers identify you by a phone number or an account. Arpokrat doesn’t identify you at all.

In standard messengers, you have a static user ID — usually your phone number. Even when the content of a message is encrypted, the server still maps sender to recipient and quietly builds a social graph of who talks to whom.

Arpokrat removes the concept of a user ID entirely. There is no account and no permanent address — you exist only as a set of cryptographic keys held on your device. To reach you, someone needs a one-time invite link you chose to share.

• No phone number, email, or account — nothing that ties a conversation to your legal identity.
• No central directory of users to hand over, leak, or scrape.
• One-time invite links replace a permanent, spammable address.

Servers Built to Know Nothing

Traditional servers are “smart” — they know who you are and route by a database. Arpokrat’s relays are deliberately the opposite.

A blind relay is a dead-drop. It accepts an encrypted packet, holds it in a queue, and hands it over when the queue’s owner collects it. It does not know who deposited the packet, or who will pick it up.

• Zero knowledge of identities: a relay sees an encrypted payload arrive and be collected — nothing linking it to a person.
• No single relay can link sender to recipient: each relay carries only one leg of an intentionally split path, so no individual server ever holds both halves needed to connect the two parties.
• Ephemeral by design: messages are held in RAM and cleared once delivered — never written to disk, even temporarily.

Encryption With a Quantum Horizon

On top of SimpleX’s end-to-end encryption, the key exchange adds post-quantum protection.

Today’s public-key cryptography relies on math that a large enough quantum computer could eventually break. A post-quantum key exchange adds a second layer designed to resist that class of attack, working alongside the classical encryption already in use rather than replacing it. That key exchange uses Streamlined NTRU Prime — a deliberate choice over the NIST-standardized Kyber, which SimpleX’s engineers avoided due to specific cryptographic concerns raised during its standardization.

We’re deliberately measured about this: post-quantum cryptography is the current best-practice defense, not a permanent guarantee. It raises the bar significantly today, with a clear upgrade path as standards evolve.

• Hybrid approach — post-quantum key exchange layered on proven classical encryption, not a risky swap.
• Honest framing — a best-practice defense that raises the bar, never a claim of permanent unbreakability.
• Upgradeable — designed to adopt stronger primitives as post-quantum standards mature.

Why It Matters: Harvest Now, Decrypt Later

The post-quantum investment answers a concrete, present-day threat — not a hypothetical one.

A well-resourced adversary can record encrypted traffic today and simply store it, waiting for the day quantum computing can break the encryption. Anything intercepted now could be decrypted years later. Security researchers call this “Harvest Now, Decrypt Later.”

Metadata-minimal design helps here too: the less an intercepted stream reveals about who is talking, the less valuable a stored copy becomes — even before you consider the contents.

• Recorded today, cracked tomorrow — captured data has a long shelf life for a patient attacker.
• Post-quantum key exchange raises the cost of that bet against you.
• No user IDs, split paths — a harvested stream carries far less to correlate in the first place.