EION — a messenger that belongs to you
Chats, groups and channels, calls, an AI assistant and in-app coins. No ads, no tracking, no selling your data.
What already works:
• direct chats, groups, channels with a feed and comments, live streams
• audio and video calls, end-to-end encrypted
• text in direct chats is end-to-end encrypted — the key stays on your device, we do not have it and cannot recover it
• an AI assistant and auto-translation of incoming messages
• 21 interface languages
• in-app coins: premium, sticker packs, paid channels, transfers between users
Honest about the limits:
• this is a beta. Downloads are closed for now while we finish things off — when they open, you will read it here first
• groups and attachments are not yet end-to-end encrypted, only direct-chat text and calls. Our privacy policy says the same
• in-app coins are an internal accounting unit. They are not money, not securities and not cryptocurrency
• the EION token exists only on a test network for now: there it has no value and can be neither bought nor sold
This channel is about building the app without varnish: what got shipped, what broke, what we fixed. No price talk, no profit promises, no "buy before it goes up".
⚠️ Safety. EION admins never message you first, and never ask for your password or your wallet recovery phrase. Anyone who does is a scammer. The only official links are the ones published on eion.network.
Site: https://eion.network
Mail: support@eion.network
Chats, groups and channels, calls, an AI assistant and in-app coins. No ads, no tracking, no selling your data.
What already works:
• direct chats, groups, channels with a feed and comments, live streams
• audio and video calls, end-to-end encrypted
• text in direct chats is end-to-end encrypted — the key stays on your device, we do not have it and cannot recover it
• an AI assistant and auto-translation of incoming messages
• 21 interface languages
• in-app coins: premium, sticker packs, paid channels, transfers between users
Honest about the limits:
• this is a beta. Downloads are closed for now while we finish things off — when they open, you will read it here first
• groups and attachments are not yet end-to-end encrypted, only direct-chat text and calls. Our privacy policy says the same
• in-app coins are an internal accounting unit. They are not money, not securities and not cryptocurrency
• the EION token exists only on a test network for now: there it has no value and can be neither bought nor sold
This channel is about building the app without varnish: what got shipped, what broke, what we fixed. No price talk, no profit promises, no "buy before it goes up".
⚠️ Safety. EION admins never message you first, and never ask for your password or your wallet recovery phrase. Anyone who does is a scammer. The only official links are the ones published on eion.network.
Site: https://eion.network
Mail: support@eion.network
eion.network
EION — Messenger
Chats, groups and channels, end-to-end encrypted calls, an AI assistant and in-app coins. For Android and Linux.
How encryption works in EION — and where it stops
Most messengers say "end-to-end encrypted" and leave it at that. Here is exactly what that means in EION today.
What is encrypted end-to-end:
• calls, audio and video — the media never travels in the clear
• the text of direct chats, including replies and edits
How it works: your device generates a key pair and keeps the private key. It never leaves the phone or the desktop — we do not store it, cannot read your messages and cannot recover them for you. Every message gets its own one-time key derived from a fresh ephemeral pair, so the same text sent twice produces completely different ciphertext.
A real bug we hit while building it: on some Android phones the system keystore silently drops entries written just before the app is killed. Our encryption key disappeared on restart, and the app quietly generated a new one — making everything sent to the old key unreadable forever. The fix was a mirrored copy of the key, plus turning off cloud backup so it can never leave the device. We would rather tell you this than pretend nothing happened.
Where encryption stops, honestly:
• groups are not end-to-end encrypted yet
• attachments — photos, video, voice — are not either. They sit in private storage behind short-lived links, but that is not the same thing
• there is no forward secrecy yet: the key is long-lived, so a compromised device exposes what the server still holds
• there are no safety numbers yet, so you cannot verify that the key we hand you really belongs to your contact
All four are on the roadmap, and we will say when each one lands — not before.
eion.network
Most messengers say "end-to-end encrypted" and leave it at that. Here is exactly what that means in EION today.
What is encrypted end-to-end:
• calls, audio and video — the media never travels in the clear
• the text of direct chats, including replies and edits
How it works: your device generates a key pair and keeps the private key. It never leaves the phone or the desktop — we do not store it, cannot read your messages and cannot recover them for you. Every message gets its own one-time key derived from a fresh ephemeral pair, so the same text sent twice produces completely different ciphertext.
A real bug we hit while building it: on some Android phones the system keystore silently drops entries written just before the app is killed. Our encryption key disappeared on restart, and the app quietly generated a new one — making everything sent to the old key unreadable forever. The fix was a mirrored copy of the key, plus turning off cloud backup so it can never leave the device. We would rather tell you this than pretend nothing happened.
Where encryption stops, honestly:
• groups are not end-to-end encrypted yet
• attachments — photos, video, voice — are not either. They sit in private storage behind short-lived links, but that is not the same thing
• there is no forward secrecy yet: the key is long-lived, so a compromised device exposes what the server still holds
• there are no safety numbers yet, so you cannot verify that the key we hand you really belongs to your contact
All four are on the roadmap, and we will say when each one lands — not before.
eion.network
One of the four gaps is closed: attachments are now encrypted
Our post on encryption listed exactly where it stops in EION: groups, attachments, forward secrecy, safety numbers. Attachments are done.
In direct chats, photos, video, voice messages and documents are now sealed on your device before they are uploaded. The server stores ciphertext it cannot open. Captions travel inside the same envelope — a caption is often the whole point of the photo, and it used to go in the clear.
One design decision worth explaining. Each file gets a random key, and that key is wrapped twice: once for your contact, once for you. The second copy is not redundancy — the local copy of a file disappears when you reinstall, and without a slot of your own your own photo would become unreadable forever. That is the kind of thing you cannot fix later: the format is fixed the day the first file is sent.
Forwarding re-uploads the file under the new recipient's key, because the old envelope is not addressed to them.
Still visible to the server, honestly: the file name, its size, the length of a voice message and its waveform. They are separate fields that delivery, chat previews and cleanup rely on. So we do not know what is in the photo, but we do know a file of that name and size was sent — and, as always, who talked to whom and when.
Three gaps remain, unchanged: groups and channels are not end-to-end encrypted, there is no forward secrecy, and there are no safety numbers yet.
Also shipped
Camera on Linux desktop now records video with sound, not just photos. The WebRTC library we use for calls cannot record on desktop, and requiring ffmpeg was not an option — it is missing on plenty of machines, a lesson voice messages already taught us. EION now drives GStreamer directly; those libraries are already present wherever the app runs. The preview keeps running while recording, because a camera cannot be opened twice.
Two bugs found on the way, neither visible by reading the code. One element in the pipeline silently swallowed the end-of-stream signal, and without it the recorder never finalises the file — every video would have shipped broken. And MP4 writes its index at the very end, so an interrupted recording is unplayable; we switched to formats that write as they go.
The wallet is a full page now instead of a cramped dialog: withdrawals sit with your coins pointing down, top-ups sit with your token balance pointing up, so it is clear what moves where. Account creation asks for the password twice. Deleting an account now also wipes what stayed on the device.
Still a beta, downloads still closed. When they open, you will read it here first.
eion.network
Our post on encryption listed exactly where it stops in EION: groups, attachments, forward secrecy, safety numbers. Attachments are done.
In direct chats, photos, video, voice messages and documents are now sealed on your device before they are uploaded. The server stores ciphertext it cannot open. Captions travel inside the same envelope — a caption is often the whole point of the photo, and it used to go in the clear.
One design decision worth explaining. Each file gets a random key, and that key is wrapped twice: once for your contact, once for you. The second copy is not redundancy — the local copy of a file disappears when you reinstall, and without a slot of your own your own photo would become unreadable forever. That is the kind of thing you cannot fix later: the format is fixed the day the first file is sent.
Forwarding re-uploads the file under the new recipient's key, because the old envelope is not addressed to them.
Still visible to the server, honestly: the file name, its size, the length of a voice message and its waveform. They are separate fields that delivery, chat previews and cleanup rely on. So we do not know what is in the photo, but we do know a file of that name and size was sent — and, as always, who talked to whom and when.
Three gaps remain, unchanged: groups and channels are not end-to-end encrypted, there is no forward secrecy, and there are no safety numbers yet.
Also shipped
Camera on Linux desktop now records video with sound, not just photos. The WebRTC library we use for calls cannot record on desktop, and requiring ffmpeg was not an option — it is missing on plenty of machines, a lesson voice messages already taught us. EION now drives GStreamer directly; those libraries are already present wherever the app runs. The preview keeps running while recording, because a camera cannot be opened twice.
Two bugs found on the way, neither visible by reading the code. One element in the pipeline silently swallowed the end-of-stream signal, and without it the recorder never finalises the file — every video would have shipped broken. And MP4 writes its index at the very end, so an interrupted recording is unplayable; we switched to formats that write as they go.
The wallet is a full page now instead of a cramped dialog: withdrawals sit with your coins pointing down, top-ups sit with your token balance pointing up, so it is clear what moves where. Account creation asks for the password twice. Deleting an account now also wipes what stayed on the device.
Still a beta, downloads still closed. When they open, you will read it here first.
eion.network
EION is now on Product Hunt.
The launch itself is still ahead — for now the page is simply there, so you can follow it and get a notification the day we go live.
https://www.producthunt.com/products/eion-messenger
What the page says, in short: direct chats and calls are end-to-end encrypted — text, captions and attachments alike, with the key generated on your device. Groups and channels are not encrypted yet, and we say so rather than hide it.
The launch itself is still ahead — for now the page is simply there, so you can follow it and get a notification the day we go live.
https://www.producthunt.com/products/eion-messenger
What the page says, in short: direct chats and calls are end-to-end encrypted — text, captions and attachments alike, with the key generated on your device. Groups and channels are not encrypted yet, and we say so rather than hide it.
Product Hunt
EION — Messenger: Encrypted chats and calls. We say what is not encrypted | Product Hunt
In EION, direct chats and calls are end-to-end encrypted — text, captions and attachments alike. The key is generated on your device and never leaves it, so we cannot read your messages and cannot recover them for you. Groups and channels are not encrypted…
Your account now works on the phone and the computer at the same time
Until this week EION allowed exactly one device per account. Signing in on the desktop kicked the phone out, and everything that arrived afterwards the phone never saw. That is fixed: a device is now a thing in its own right, with its own encryption key, its own delivery queue and its own push token. Messages are sealed for every one of your devices, so the same conversation is readable on both.
What follows from that is less obvious than it sounds. An action you take "just for yourself" has to happen on all of your devices, or it is not really done. So deleting a message, clearing a chat, removing a contact, reading a chat, saving or deleting your own sticker, muting a group, clearing a channel's history — all of these now travel between your devices, live if the other one is online and on the next sign-in if it was not.
One design decision cost us the most, and it is worth writing down. Our first attempt used a queue: the server remembered a pending deletion and removed the row once a device picked it up. With one device that works. With two, the first device to sign in consumed the event and the second one never learned about it — the message simply stayed there. The same shape of bug had already bitten us once with delivery receipts. A queue you drain on read is incompatible with multiple devices; what works is a log that nobody drains, where each device keeps its own position. Both deletions and settings now use that.
A second lesson, and this one we repeated three times in a day. Wherever the code needed to say "send this to everyone except the author", it said it in terms of the nickname. That was correct when an account meant a device. With two devices it means the author's other device is excluded too — so a push landed on your own phone, your own message did not appear on your desktop, and a deletion stopped halfway. Excluding yourself has to be about the device, not the account.
Group notifications
They did not exist. Neither push nor local — a group message simply never reached the notification shade, and the "mute this group" switch in the menu controlled nothing at all, because there was nothing to mute. Both now work: the server sends a push to members who are offline and have not muted the chat, the app shows a notification when the message arrives over the socket while it sits in the background, and tapping it opens that group rather than just the app. The mute switch is stored on the server now, which is also why it is the same on both of your devices — the decision not to disturb you belongs to whoever sends the push.
Honest limits, as usual
Attachments sent before a device joined your account will not open on it: they were sealed for keys that device did not have, and no format can fix that after the fact. History from before a device was registered does not appear on it either. And on Linux there are no push notifications at all — Firebase does not support the platform, so the desktop app learns about messages when it is open.
Channels and comments are next: everything described above exists in chats and groups, and not yet there.
Still a beta, downloads still closed. When they open, you will read it here first.
eion.network
Until this week EION allowed exactly one device per account. Signing in on the desktop kicked the phone out, and everything that arrived afterwards the phone never saw. That is fixed: a device is now a thing in its own right, with its own encryption key, its own delivery queue and its own push token. Messages are sealed for every one of your devices, so the same conversation is readable on both.
What follows from that is less obvious than it sounds. An action you take "just for yourself" has to happen on all of your devices, or it is not really done. So deleting a message, clearing a chat, removing a contact, reading a chat, saving or deleting your own sticker, muting a group, clearing a channel's history — all of these now travel between your devices, live if the other one is online and on the next sign-in if it was not.
One design decision cost us the most, and it is worth writing down. Our first attempt used a queue: the server remembered a pending deletion and removed the row once a device picked it up. With one device that works. With two, the first device to sign in consumed the event and the second one never learned about it — the message simply stayed there. The same shape of bug had already bitten us once with delivery receipts. A queue you drain on read is incompatible with multiple devices; what works is a log that nobody drains, where each device keeps its own position. Both deletions and settings now use that.
A second lesson, and this one we repeated three times in a day. Wherever the code needed to say "send this to everyone except the author", it said it in terms of the nickname. That was correct when an account meant a device. With two devices it means the author's other device is excluded too — so a push landed on your own phone, your own message did not appear on your desktop, and a deletion stopped halfway. Excluding yourself has to be about the device, not the account.
Group notifications
They did not exist. Neither push nor local — a group message simply never reached the notification shade, and the "mute this group" switch in the menu controlled nothing at all, because there was nothing to mute. Both now work: the server sends a push to members who are offline and have not muted the chat, the app shows a notification when the message arrives over the socket while it sits in the background, and tapping it opens that group rather than just the app. The mute switch is stored on the server now, which is also why it is the same on both of your devices — the decision not to disturb you belongs to whoever sends the push.
Honest limits, as usual
Attachments sent before a device joined your account will not open on it: they were sealed for keys that device did not have, and no format can fix that after the fact. History from before a device was registered does not appear on it either. And on Linux there are no push notifications at all — Firebase does not support the platform, so the desktop app learns about messages when it is open.
Channels and comments are next: everything described above exists in chats and groups, and not yet there.
Still a beta, downloads still closed. When they open, you will read it here first.
eion.network
Group chats are now end-to-end encrypted
Our posts on encryption have always listed where it stops. One more gap is closed: groups. Text, replies, captions, pinned messages and attachments in a group are sealed on your device before they leave it, and the server stores only ciphertext.
There is no shared group key, and that is a deliberate choice. Each message is sealed for every device of every member who is in the group at that moment — the same multi-recipient envelope that direct chats and attachments already use. That removes the hardest part of group encryption, handing out and rotating a key, and gives two properties for free: someone who joins sees the conversation from the moment they joined, and someone who is removed cannot read what comes next. The price is about 92 bytes per device on every message, so the format stops at 255 devices. Above that, or if a member's app has no key yet, the group falls back to plain text instead of quietly leaving someone unable to read.
Channels stay unencrypted, on purpose. A channel is public — anyone can subscribe — so encryption would hide nothing from anyone, while it would break search, previews and notifications. WhatsApp Channels and Telegram channels are not end-to-end encrypted either. Stickers are not encrypted anywhere: a sticker message is only a code from the shop.
The limits we named before still apply. The server sees file names, sizes and the length of voice messages, and who talks to whom. There is no forward secrecy. Public keys come from our server, so until safety numbers exist this does not formally protect you from us. Group messages stay on the server for up to 30 days.
This update is required: older builds cannot decrypt group history and would show ciphertext after a restart.
Also shipped
A new name or avatar of a group or channel now appears for everyone at once, not after restarting the app.
Voice messages in groups and in channel comments show delivery ticks, and group ticks no longer reset when you reopen a chat.
A file forwarded from a chat or a group into a channel is re-uploaded without encryption, because channel readers could not open an envelope that was never addressed to them.
Tapping buy twice on premium or on a paid channel subscription no longer charges you twice.
Still a beta. Test builds for Android and Linux are on the site.
eion.network
Our posts on encryption have always listed where it stops. One more gap is closed: groups. Text, replies, captions, pinned messages and attachments in a group are sealed on your device before they leave it, and the server stores only ciphertext.
There is no shared group key, and that is a deliberate choice. Each message is sealed for every device of every member who is in the group at that moment — the same multi-recipient envelope that direct chats and attachments already use. That removes the hardest part of group encryption, handing out and rotating a key, and gives two properties for free: someone who joins sees the conversation from the moment they joined, and someone who is removed cannot read what comes next. The price is about 92 bytes per device on every message, so the format stops at 255 devices. Above that, or if a member's app has no key yet, the group falls back to plain text instead of quietly leaving someone unable to read.
Channels stay unencrypted, on purpose. A channel is public — anyone can subscribe — so encryption would hide nothing from anyone, while it would break search, previews and notifications. WhatsApp Channels and Telegram channels are not end-to-end encrypted either. Stickers are not encrypted anywhere: a sticker message is only a code from the shop.
The limits we named before still apply. The server sees file names, sizes and the length of voice messages, and who talks to whom. There is no forward secrecy. Public keys come from our server, so until safety numbers exist this does not formally protect you from us. Group messages stay on the server for up to 30 days.
This update is required: older builds cannot decrypt group history and would show ciphertext after a restart.
Also shipped
A new name or avatar of a group or channel now appears for everyone at once, not after restarting the app.
Voice messages in groups and in channel comments show delivery ticks, and group ticks no longer reset when you reopen a chat.
A file forwarded from a chat or a group into a channel is re-uploaded without encryption, because channel readers could not open an envelope that was never addressed to them.
Tapping buy twice on premium or on a paid channel subscription no longer charges you twice.
Still a beta. Test builds for Android and Linux are on the site.
eion.network
Games in EION: five of them, and you can play a friend or the app
An invite is just a message. Send it into a chat or a group, the other side taps Accept, and the board opens on both devices. In a direct chat that invite is end-to-end encrypted like any other message, and in a group everyone sees who is looking for an opponent.
Connect Four, Battleship, Checkers, Chess and Long Backgammon. Every one of them also plays against the app, at three levels, so a new account is not stuck waiting for someone to answer.
The opponent is ours. We wrote the chess, checkers and backgammon engines instead of pulling in a library, and measured them against what we had before: chess 10-0, checkers 9-1, backgammon 174-50. The hard level thinks for a second or two, and it runs in a separate thread so the rest of the app does not wait for it.
The rules live on the server, not in the app. Every move is validated there, the app only highlights the moves it is told are legal, and the dice are rolled by the server. In Battleship the enemy ships are never sent to your device at all, so there is nothing to peek at.
No coins are ever at stake. You cannot bet, and there is no way to win someone else's balance — that is a deliberate line, not a missing feature. Coins buy boards and pieces in the shop, and nothing else.
What this update changes
The boards are real wood now, with grain, rosettes, coordinates on the frame and a carved set of chess pieces. The games window shows each game by its own board instead of the same icon five times.
A game invite in a chat finally looks like every other message: in a group it carries the sender's avatar and name, and your own invites show the delivery ticks. It also appears immediately in a group that is already open, instead of after you leave and come back.
The app no longer switches itself to English. If our server was asleep when translations were refreshed, the fallback used to pour English over the language you had chosen. It does not any more, and the built-in translations for all 21 languages are used first.
Linux chats got the jump-to-latest arrow that groups and channels already had.
Still a beta. Test builds for Android and Linux are on the site.
eion.network
An invite is just a message. Send it into a chat or a group, the other side taps Accept, and the board opens on both devices. In a direct chat that invite is end-to-end encrypted like any other message, and in a group everyone sees who is looking for an opponent.
Connect Four, Battleship, Checkers, Chess and Long Backgammon. Every one of them also plays against the app, at three levels, so a new account is not stuck waiting for someone to answer.
The opponent is ours. We wrote the chess, checkers and backgammon engines instead of pulling in a library, and measured them against what we had before: chess 10-0, checkers 9-1, backgammon 174-50. The hard level thinks for a second or two, and it runs in a separate thread so the rest of the app does not wait for it.
The rules live on the server, not in the app. Every move is validated there, the app only highlights the moves it is told are legal, and the dice are rolled by the server. In Battleship the enemy ships are never sent to your device at all, so there is nothing to peek at.
No coins are ever at stake. You cannot bet, and there is no way to win someone else's balance — that is a deliberate line, not a missing feature. Coins buy boards and pieces in the shop, and nothing else.
What this update changes
The boards are real wood now, with grain, rosettes, coordinates on the frame and a carved set of chess pieces. The games window shows each game by its own board instead of the same icon five times.
A game invite in a chat finally looks like every other message: in a group it carries the sender's avatar and name, and your own invites show the delivery ticks. It also appears immediately in a group that is already open, instead of after you leave and come back.
The app no longer switches itself to English. If our server was asleep when translations were refreshed, the fallback used to pour English over the language you had chosen. It does not any more, and the built-in translations for all 21 languages are used first.
Linux chats got the jump-to-latest arrow that groups and channels already had.
Still a beta. Test builds for Android and Linux are on the site.
eion.network