Skip to the content
Sign inOpen ILLEST

End-to-end encrypted chat

Chat, calls and servers, encrypted end to end.

ILLEST has the shape you already know: servers and channels, replies and reactions, voice and screen sharing. The difference is underneath. Every message is encrypted on your device, and the server that carries it only ever holds ciphertext.

Open ILLEST in your browserCreate an account

Nothing to install to try it.

A photograph of ILLEST: the channel general in a server called Lantern Club, with its messages, the members panel, the list of channels and the box to write in.
A photograph of the app. The people, the server and the messages are made up for this page.

Messages

Encrypted before it leaves your device.

A message is turned into ciphertext on your device and turned back on the devices of the people it is for. The server carries and stores the ciphertext. It is not given the keys.

  • One encrypted group per conversation

    Each direct message and each channel is its own group, using MLS (RFC 9420). When someone joins or leaves, the group's keys change.

  • No plain-text fallback

    If a message cannot be encrypted, it is not sent, and you are told why.

  • Keys you can check

    ILLEST remembers an account's key the first time it sees it. If the key changes you are warned, and you can compare a safety number with the person.

  • No direct connections

    Messages, files and calls all go through the server as ciphertext. Your device never connects to another person's, so a conversation never gives them your IP address.

A photograph of a conversation between two people, its header marked encrypted with the group's epoch, and the list of friends beside it.
A photograph of the app. The people and messages are made up for this page.

What the server still knows, and what this does not protect

  • The server knows who has an account, which conversations exist, who is in them, when messages are sent and roughly how big they are. It cannot read what they say.
  • In a browser, the page's code comes from the server, so whoever runs the server could change that code to capture your password. The desktop app carries its code inside the app instead of fetching it from the server each time, so it does not have that weakness.
  • On the desktop, your device's key is kept in your system keychain and used by the app's own process. The window that draws the screen can ask the app to sign you in or open a message, and is not sent the key. Another program running as you can read the keychain on Windows and Linux, and on macOS the app does not yet ask the keychain to restrict it. One command that moves an older device's key into the app is still present, so this is not yet a promise that no key ever passes through the window.
  • Encryption does not protect you from your own computer. Another program running as you can reach what you can.

Calls

Talk, and show your screen.

Join a voice channel and you are in the call. Share your screen or a window, and everyone else chooses whether to watch: until they press Watch, your picture is not decrypted on their device.

  • Encrypted on your device

    Voice and screen frames are sealed on your device with keys from an encrypted group before they leave it. The server relays them and cannot open them.

  • Through the server, never direct

    Calls are relayed, not peer to peer, so nobody in a call learns your IP address from it.

  • Stages

    A stage is a voice channel where a few people speak and everyone else listens.

  • The controls a call needs

    Mute, deafen, push to talk, and a volume control for each person.

A photograph of a voice room: three people on tiles, the bar of call controls underneath, and who is in the room in the list of channels.
A photograph of the app. The people here are made up for this page.

Servers

Servers, with a channel for each thing you do in them.

Make a server for a team, a club or a few friends. Every channel in it is encrypted the way a direct message is.

  • Four kinds of channel

    Text for talking, voice for calls, stages for talks to an audience, and forums where each topic is a thread.

  • Roles and permissions

    Give people roles, set what each role may do, and read an audit log of what changed.

  • Invites and onboarding

    Invite people with a link, ask new members a few questions when they arrive, and review applications to join.

  • The usual conveniences

    Replies, threads, pins, reactions, custom emoji and stickers, and search. Search looks through the messages your device has already received, because the server cannot read them.

A photograph of a forum channel in a server: its posts, each with who wrote it and its replies, the members panel grouped by role, and the list of channels.
A photograph of the app. The server, its members and its posts are made up for this page.

Wallet

A wallet inside the chat, and it is yours.

Hold and send crypto without leaving the conversation. The wallet is made on your device from a recovery phrase that only you have. ILLEST does not hold it, cannot spend from it, and cannot recover it for you.

  • Several networks

    Ethereum, Base, Arbitrum, Optimism and Polygon, plus Solana and Bitcoin. Sending is built for each of them. It has been tested against stand-ins for the networks, and not yet with real money.

  • A password for spending

    Spending needs a wallet password that is separate from your account password, so signing in does not unlock your money.

  • Ask for payment in a conversation

    Send a payment request as a card in a chat, and the other person can pay it from their own wallet.

  • It pays for ILLEST, too

    A subscription, a username and anything in a shop are paid from this wallet, in USDC on Solana.

In a browser, anything that can run code on the page can reach an unlocked wallet, so keep everyday amounts there. The desktop app keeps the wallet's keys and signs in its own process, so the screen asks for a signature and is never handed the key that made it. The words of your recovery phrase do pass through the screen: when you create a wallet, when you import one, and when you ask to see them.

A photograph of the wallet card: the balance, Send, Receive, Swap and Request, and the coins held on Solana, Ethereum and Bitcoin.
A photograph of the app. The balances here are made up for this page; they are not a real account.

Marketplace

Shops in servers, and a marketplace for usernames.

A boosted server can open a shop channel and sell items and roles at a fixed price. The ILLEST server's shop is the marketplace for usernames: list a name you hold, and someone else can buy it.

  • Paid in crypto, wallet to wallet

    Everything is paid in USDC on Solana. One transaction from the buyer's own wallet pays the seller and the platform's fee together.

  • The server holds no money

    It holds no key and makes no payment. It reads the finished transaction from the chain, and counts it only once it is final.

  • Delivered when it is paid

    A role is given and a username moves to its buyer as the payment counts. An item is delivered by its seller, and both sides follow the order.

  • Subscriptions, the same way

    A subscription is paid in USDC for one, three or twelve months. It gives you five usernames instead of two, your page on its own subdomain, and larger uploads.

A photograph of a server's shop channel: four listings, items and a role, each with its seller and its price in USDC.
A photograph of the app. The shop, its sellers and its listings are made up for this page.

Pages

A page that is all yours.

Build a public page inside ILLEST on a canvas: start from a template, drag blocks in, give each its own frame, depth, effects and motion, and lay it out for desktops and for phones.

  • Sixteen templates

    Monolith, Hologram, Vinyl, Arcade, Zine and eleven more: each a whole page to start from and make your own.

  • Twenty-one kinds of block

    Text, links, socials, badges, pictures, galleries, video, a music player, a countdown, a terminal, a marquee, a 3D object and more.

  • A layout for each screen

    A page has a desktop layout and a phone layout, and the editor draws exactly what a visitor sees.

  • Paid from your page

    Put your wallet on it, as a donation or the whole wallet, and visitors pay you from theirs.

  • Public on purpose

    A page is public and is not encrypted. It is served away from the app, on purpose, to keep a page away from your messages.

Your page is at illest.world/yourname, and with a subscription at yourname.illest.one.

A photograph of the page editor: the page's address, Publish, the outline of the page's blocks, and the Hologram template's card in the preview.
A photograph of the app. The name on the page is made up for this page.

Names

More than one username, each one styled.

An account holds up to two usernames, or five with a subscription, and you choose which one is your main name. Each can have its own colour, typeface and effects, and the effects stack.

  • Seen where you are seen

    Your style shows in conversations, member lists, calls and your profile.

  • A name that changes hands is marked

    If a name moves to a different person, others see a new-owner mark for a while, so an old name is not mistaken for the person who held it before.

  • In your wallet

    The wallet lists the names you hold and what state each is in, and lets you choose which is your main name.

  • Bought and sold

    A username you hold can be listed in the marketplace at a fixed price, paid in USDC. It moves to the buyer the moment the payment is final.

A second username needs an account verified with Google, and opens thirty days after you join unless you subscribe.

A photograph of the wallet's Names screen: two usernames on one account, the one shown now and another, two of five used with a subscription, and a field to claim another.
A photograph of the app. The names here are made up for this page.

Switched off here

ILLEST has these, and this server has them turned off, so this page does not count them among its features.

  • Cameras in calls.
  • Keys that belong to a single call. Here a call uses keys from the channel's group, so the people in that channel hold them whether or not they have joined the call.

Try it.

ILLEST opens in your browser.

Open ILLEST in your browserCreate an account