Security you can actually trust.
Most platforms ask you to trust them with your identity. Orbitr doesn't. Your identity is a file on your device, not an account on our server.
What a server operator sees
- •Your IP address during voice and video calls
- •Your handle and key fingerprint
- •Anything you post, send, or upload on their server
- •The times you're connected
What stays yours
- ✓Your IP, hidden from other members: voice and video route through the server, never peer-to-peer
- ✓Your identity file and private keys
- ✓Other Orbits you're in
- ✓Anything you do outside their server
- ✓Your real name, email, or phone: we don't ask for any of it
Join Orbits whose operators you'd trust with the first list.
Communication is personal. The messages you send your friends, the late-night voice calls, the photos you share: these are intimate parts of your life. We believe the platform carrying those conversations has a responsibility to protect them.
Most platforms treat security as a marketing checkbox. Orbitr treats it as the foundation everything else is built on. Your identity, your messages, and your privacy are protected by design, not by policy.
This page explains exactly how. No vague promises, no hand-waving. Where something isn't covered yet, we say so.
The Orbitr Security Model
A fundamentally different approach to identity and trust.
In traditional platforms, a company controls your account. They verify your email, store your password, and decide whether you're allowed to log in. If they get hacked, your account is compromised. If they ban you, your identity is gone.
Orbitr flips this completely. Your identity is a small encrypted file that lives on YOUR device. When you connect to a server, your app uses that file to prove who you are, without ever sharing the sensitive parts. No company holds the keys. No central server can lock you out.
Trust hierarchy
You
You hold the identity file. Ultimate authority.
Your Devices
Act on your behalf. New-device approval is coming soon.
Server
Verifies identity. Never holds your keys.
What We Can't Do
These aren't policies. They're technical impossibilities.
Can't read your messages
Your messages live on YOUR server or your friend's server, never on ours. We don't run a central message store. We literally don't have access.
Can't impersonate you
Only someone with your identity file and your password can prove they're you. We never see either. There is no "reset password" flow on our end because we don't hold your credentials.
Can't lock you out
Your identity file works without our permission. Even if our website went offline tomorrow, your file would still let you log into any Orbitr server.
Can't track you
No analytics, no telemetry, no tracking pixels. The app never phones home to us. Connections go directly between you and your server. We're not in the middle. The server reaches out for standard infrastructure tasks (Let's Encrypt certificate renewals, STUN for NAT traversal, optional update checks, Pulsar registration if you enable it, and any bug or crash report you choose to send). Nothing else.
What Your Server Operator Can't Do
Even the person running the server has limits. Here's the honest breakdown.
Can't read your identity file
Your identity file is encrypted with your password before it ever touches the server. The server only stores the encrypted blob. It can't open it or extract your keys.
Can't use your identity elsewhere
Your identity can only be used on devices that hold your encrypted private key, which never leaves your device and is never transmitted, so a server operator can't move your identity onto hardware you didn't set up. Multi-device approval, which adds sign-off from a quorum of your existing devices before a new one is enrolled, is coming soon.
A note on message privacy
On any chat platform, whoever operates the server infrastructure can access the messages stored on it. On traditional platforms, that's a company and its employees. On Orbitr, that's whoever you choose: yourself, a friend, or a community you trust.
We recommend hosting your own server for the most privacy, or joining servers run by people you personally know and trust.
The Encryption Stack
Strong defaults, proven algorithms, no shortcuts.
Well-established, peer-reviewed technologies at every layer. Nothing custom, nothing experimental, just battle-tested building blocks assembled correctly.
Identity file protection
Your signing key is encrypted using a key derived from your password through a memory-hard function, the same kind used by password managers. Even if someone gets the file, brute-forcing the password is extremely slow by design.
Encrypted transport
Every connection runs over TLS. Self-hosted servers provision real Let's Encrypt certificates automatically, so traffic between you and your server is always encrypted in transit. No self-signed warnings, no manual renewals.
Your signing keys
Your identity is an elliptic-curve key pair. The public half is how servers recognize you; the private half, which signs every login, never leaves your device. Nothing proprietary, nothing experimental.
Recovery & backup
A 12-word recovery phrase unlocks your identity even if you forget its password. The server can store an encrypted backup, encrypted before upload, so the server never sees the contents. The recovery phrase and recovery key files deserve the same secrecy as your identity file. Never share them.
How Authentication Works
What happens when you log into an Orbitr server, step by step.
You create your identity
Orbitr generates a unique signing key pair. The private key stays on your device, encrypted with your password. The public key is what servers use to recognize you.
The server sends a challenge
When you connect, the server creates a unique, one-time challenge: a random puzzle that can only be solved with your private key.
Your app signs the response
Your app decrypts your private key using your password, signs the challenge, and sends the signed response back. The private key itself is never transmitted.
The server verifies
The server checks the signed response against your public key. If it matches, you're authenticated. A session is created and you're in.
Session created
You're logged in. The server only ever saw your public key and one signed response. Never your password, never your private key.
Threat Model
What we protect against, what we don't, and what's coming next.
Protected
- ✓ Identity theft: Your private key is encrypted and never transmitted, so a stolen identity file is useless without your password.
- ✓ Server compromise (your identity): A breached server can't extract your identity; the encrypted file is useless without your password. Messages already stored on that server, however, are exposed in a breach. That's an honest limit, not a protection we can claim.
- ✓ Password brute-forcing: The memory-hard password protection makes automated guessing extremely slow and expensive.
- ✓ Replay attacks: Each authentication challenge is unique and time-limited. Old responses can't be reused.
- ✓ Man-in-the-middle: All connections use TLS encryption. The challenge-response flow adds an additional layer of verification.
The honest limits
- • Server-stored messages: Messages on a server are readable by the server operator. This is how every chat platform works. Traditional platforms all share this model. The difference is you choose who you trust to run a server.
- • Custom server code: Since servers are self-hosted, an operator could modify their code. This is true of any self-hosted software. Only join servers run by people you trust.
Audit the Source
Don't take our word for it. Read the code yourself.
Every line is public
Orbitr is source-available. The authentication system, the encryption logic, the server code, the client: all of it is on GitHub. Security researchers, developers, and curious users are welcome to audit every line.
No hidden telemetry. No obfuscated code. No proprietary black boxes. If we say something is secure, you can verify it.
View on GitHubBuild it yourself
Clone the repo and build from source. The whole pipeline is open, so you never have to trust a binary you didn't compile.
Verify what it sends
Point a proxy at the app and watch every request. There's no hidden telemetry to find. What leaves your device is exactly what the code shows.
Report a vulnerability
Found a flaw? Disclose it privately via GitHub Security Advisories. We aim to acknowledge within 48 hours.
Protect Your Identity File
The single most important security rule for every Orbitr user.
Never share your .orbitr-identity file
Your identity file contains your private signing key. Anyone who has this file and your password can fully impersonate you. No server operator, support agent, or friend will ever need this file. The only way to join a server is via invite links or Pulsar codes. The same rule covers your downloaded recovery phrase and recovery key files: they can unlock your identity without your password.
Learn why this mattersYour identity. Your rules.
Download Orbitr and take ownership of your digital life. No email, no sign-up, no account on our servers.