How YGOOW compares
We will not tell you YGOOW is the only secure messenger — that claim is how you spot marketing. Several excellent projects solve overlapping problems, and some are more mature than we are today. Here is an honest map of where YGOOW sits, and where it does not.
At a glance
| YGOOW | Signal | Session | Briar | |
|---|---|---|---|---|
| No phone number or email | ✓ | ✗ (phone) | ✓ | ✓ |
| No server-side account | ✓ | ✗ | ~ (key ID) | ✓ |
| Tor / onion transport built in | ✓ (default) | ✗ | ~ (own network) | ✓ (default) |
| Works offline over local mesh | ✗ | ✗ | ✗ | ✓ |
| Key can be any file or password | ✓ | ✗ | ✗ | ✗ |
| A different key per message | ✓ | ✗ | ✗ | ✗ |
| Quorum (K-of-N) unlock | ✓ | ✗ | ✗ | ✗ |
| Hardware key (YubiKey) as a second factor | ✓ | ✗ | ✗ | ✗ |
| Choose protection per chat — no insecure default | ✓ | ✗ | ✗ | ✗ |
| Content key independent of the channel | ✓ | ✗ | ✗ | ✗ |
| Multiple identities in one install | ✓ | ✗ | ✗ | ✗ |
| Open-after / burn / lifetime conditions | ✓ | ✗ | ✗ | ✗ |
| Duress decoy — a hidden real profile | ✓ | ✗ | ✗ | ✗ |
| One-time note for someone without the app | ✓ | ✗ | ✗ | ✗ |
| Padded size + rotating relay address | ✓ | ~ | ~ | ~ |
| Forward secrecy | ~ | ✓ | ✗ | ✓ |
| Post-compromise security (DH ratchet) | ✗ | ✓ | ✗ | ~ |
| Post-quantum hybrid key exchange | ✗ | ✓ | ✗ | ✗ |
| Independent audit | planned | ✓ | ✓ | ✓ |
| Side-channel measurements of the shipped code, published | ✓ | ~ | ~ | ~ |
| Open source (license) | ✗ | ✓ | ✓ | ✓ |
| Reproducible / verifiable builds | ✗ | ✓ | ✓ | ~ |
| Platforms | Android | all | all | Android + desktop |
✓ yes · ✗ no · ~ partial or qualified. Where we wrote planned, we mean exactly that — and we say so again in the whitepaper and our security policy. Our forward secrecy is ~ because used message keys are erased, but a conversation’s starting key can still be re-derived from the two identities (whitepaper §5). Post-compromise security and the post-quantum hybrid are built and tested in our libraries but not yet in live conversations, so they are ✗ until they ship — the progress page tracks them. The side-channel row means timing measurements of the shipped code on its target hardware, with the unfixed findings published alongside the fixed ones. The others rely on cryptographic libraries built to be constant-time and on external audits — a stronger guarantee than a measurement, and we say so; ~ only because raw measurements of the shipped build are not published as such.
What is genuinely different about YGOOW
No single row is the point — the combination is:
- No identity, anywhere. Not a phone number, not even a public-key “address” that lives on a server. Your keypair is generated on-device and shared only when you choose, in person.
- Your key is anything. A password, a file you both have, a link, a random key in a QR, or a Shamir split — hashed locally, never transmitted. No other messenger here lets the shared secret itself be an arbitrary artifact.
- A different key per message. The same room is text to one person and a lock to another, with no error and no hint — the property we pulled apart in “no oracle”.
- A deaf relay. The server keeps sealed blocks, the address each was sent to and when, for 24 hours; seized, it gives up ciphertext and timing, never words, names or keys — and with no central store there is no single place to harvest everyone at once, which is the lesson EncroChat taught. (Briar drops the server entirely with peer-to-peer — a different answer to the same fear.)
- Quorum unlock. A message that only opens when K of N people combine their keys. One infiltrator with one share learns nothing.
- Many selves, one app. Work, family, a pseudonym — separate keys and contacts behind a single lock, each identity’s conversations riding their own Tor circuit, with no key, contact, or record on our side that ties them together. None of the others lets you carry several identities on one phone. What can still link them is timing at the relay — measured, named in the whitepaper, and under a design decision to close.
- A decoy for coercion. A second password opens a decoy profile while your real one stays hidden in the same store. We measured it over months of simulated use rather than on setup day: without the decoy password, one or two copies of storage and a stopwatch on the unlock don’t tell the two apart. With the decoy password, two copies still show that the real profile was used in between — we publish that edge too. None of the others here ships plausible deniability against a forced unlock — though deniability buys a credible denial, not invulnerability.
- A note for someone who doesn’t have the app. A Dead Drop is a one-time text note behind a link: sealed on your device or in the browser, opened once, then deleted by the relay. The key lives only in the part of the link that never reaches a server, so a chat app’s link preview can’t open or burn it — and the recipient needs nothing installed.
- A hardware key as a second factor. Optionally require a YubiKey (over NFC) on top of your secret to unlock — the challenge-response is computed on the key, never leaves it, and gates local access. It is deliberately not a per-message signature, so your deniability stays intact. None of the others here offers a hardware second factor for the lock.
- Metadata shaped, not just hidden — and measured. Beyond Tor, every block is padded to a size bucket (0.04 bit of length per frame, the same size whatever the mode), the conversation address rotates per-conversation, and a high-risk mode adds cover traffic the relay cannot tell from your frames. We also publish what our own relay can still infer from timing — because we measured it against the strongest adversary we could build, and it found more than our earlier text admitted. The whitepaper has the numbers on both sides.
Where the others are ahead — today
We would rather say this than have you discover it:
- Signal is the audited, reproducible-build, decade-hardened standard, on every platform. It also got to post-quantum first and at a scale we have not earned: PQXDH in 2023, then the post-quantum Triple Ratchet in 2025, reviewed by outside cryptographers and shipped to billions of devices. Ours is built and tested but not yet in live conversations, and unaudited. For most people, most of the time, Signal is the right answer.
- Briar works with no internet at all — over Bluetooth and local WiFi — which is exactly what you want in a blackout or a protest, and it has been independently audited (Cure53).
- Session runs on a decentralized network with no central operator to seize, and ships on every platform today.
YGOOW is younger than all three. We have no independent audit yet, and we are Android-only. Our live conversations have per-message forward secrecy but not yet post-compromise security or post-quantum protection; both are built and waiting to be wired in, and we don’t claim them until they are. When they ship, one edge stays: because there is no prekey server, the very first chain of a conversation is derived from the secret you already share, so it becomes post-compromise-fresh only after one full round-trip. Signal’s prekey server buys that freshness from the first message; we trade it for a relay that holds nothing. That is a real trade-off, not a free win. None of this is buried — it is in the whitepaper and on our security page.
How to choose
- Want a battle-tested everyday messenger your less-technical contacts will also use? Signal.
- Need to communicate with no infrastructure at all, offline, in a crisis? Briar.
- Want no central operator and cross-platform reach today? Session.
- Want no identity on the server, a key that can be any secret you already share, per-message deniability, quorum unlock, and Tor by choice — on Android? That is the gap YGOOW was built for.
Your key, your rules — everything else is redacted.