x3dh · double ratchet · agplv3 · no phone number
HollowChat is a real end-to-end encrypted messenger built for people who game together — servers, voice, rich presence, the whole shape of Discord, minus the part where a company reads your messages.
what you type
what our server sees
This box is just a visual, not real crypto. In the app, your message is sealed on your device with a Double Ratchet session before it ever reaches us — we couldn't read it if we wanted to.
why it's actually private
[ no account trail ]
Pick a username, we hand you a random generated password once. Nothing to link back to your identity — but that also means nobody can reset it for you, so write it down.
[ real cryptography ]
The same key-exchange and forward-secrecy design Signal popularized. Every message gets its own key. A compromised key today doesn't unlock yesterday's conversation.
[ nothing to leak ]
Not hashed, not anonymized — just never collected. A stolen database or a subpoena has nothing to hand over, because we never had it in the first place.
built for people who play together
Servers and channels, voice and video, rich presence that shows what you're playing — HollowChat doesn't ask you to give up the parts that make a gaming server feel alive.
get the app
Want to run your own server instead? It's the same code we run — Docker Compose gets you there in a few minutes.
Self-hosting guidefrequently asked
There's no recovery flow, on purpose — we'd need an email or phone number to offer one, and we deliberately don't collect either. Your password is generated for you once at signup; save it somewhere safe (a password manager, not a sticky note).
No. Messages are encrypted on your device before they're sent, using X3DH for the initial key exchange and a Double Ratchet session for every message after. Our server stores and relays ciphertext it can't decrypt — that's the whole point of the design, not a policy we could quietly change.
No. Sessions used to keep IP and user-agent for basic diagnostics; we removed both columns entirely rather than anonymize them, because a low-entropy value like an IP is trivially recoverable even hashed. Nothing to store means nothing to leak.
The app and the server are both free and open source under AGPLv3. You can read every line, self-host it, or fork it.
Yes — link a second device from Settings → Account, and confirm a short code shown on both screens. That transfers your encryption keys directly between your devices; we never see them.
It's the exact same server we run, packaged with Docker Compose — see the self-hosting guide. Point your client at your own domain and it's yours end to end.