A private messenger I built for a handful of friends, and run myself.
It uses Signal's own protocol library on iPhone and Mac, talks through a relay I host, and won't let you send to anyone until you've checked their safety number in person or over another channel. When the cell network is down, it can still get short text messages through over LoRa radio.
I wanted something for a small circle (at most around ten people) that I control end to end and that still works when the network doesn't. Most of the people using it aren't technical, so it has to be easy. It also has to be honest about what it protects and what it doesn't.
So I didn't write my own crypto. Blackglass pins Signal's libsignal library for the post-quantum key exchange and the Double Ratchet. My work is everything around it: enrollment, trust, storage, delivery, recovery, and a relay that only ever handles ciphertext.
The phone encrypts, saves the exact ciphertext, and only then sends it. If the connection drops mid-send, it retries the same bytes instead of advancing the encryption again. The relay checks who's sending, queues the envelope, and deletes it once the other phone confirms it has it.
scroll →
Every feature had to have a clear story for what the relay learns and what happens if the app dies halfway through. Anything that couldn't meet that bar stayed out.
Joining takes a one-time invite that expires. Each device makes its own keys, and you can't message someone until you've compared safety numbers by QR code or by reading them aloud. If their key changes, sending stops until you check again.
Text, one encrypted photo or file per message, typing indicators that vanish within eight seconds, and link cards that never fetch anything. Groups are 3 to 8 verified devices and can't be edited. Changing who's in means starting a new group, so nobody's falsely shown as removed.
Pair a Meshtastic radio over Bluetooth and the same encrypted messages can travel by radio to anyone you've verified, including small groups. Sends are paced so the radio's queue doesn't overflow, wait in a durable outbox, keep retrying for a day, and only show as delivered once the other app confirms it.
A native Mac app, still in alpha, links as a separate device under the same person. Keys are never copied between devices or synced through iCloud, and an Apple account can't add a device. Losing one device means revoking that one and nothing else.
Being clear about this mattered more to me than any feature. I run the relay, so I'm the one these limits apply to.
Most of the hard problems weren't cryptography. They were what happens when a phone dies at the wrong moment, a radio drops a packet, or two retries cross in the network.
Encryption state and the exact ciphertext are saved together before anything goes on the wire. A small write journal restores half-finished changes on the next launch without touching unrelated data.
Stable envelope IDs, exact-duplicate acceptance, and rejection of any ID reused with different bytes. Delivery is saved before acknowledgment, and acknowledgment before the cursor moves.
A pinned, reviewed dependency instead of homegrown crypto, tests for tampering, wrong recipients, swapped keys, and replays, and a written list of what the system doesn't protect.
Fragmenting, pacing, and reassembling messages over a slow, lossy LoRa link, with receipts that only say "delivered" when the other app actually accepted the message.
Frozen contracts per build, independent review of each candidate, and private TestFlight releases to a small group of friends who rely on it.
I'm looking at hands-on principal and staff applied AI and systems roles, remote from Southeast Georgia. I'm happy to walk through the threat model and the delivery code live.
Email about a role →