Nullkey

Encrypt messages and files

Encrypt with their public key. Decrypt with your private keys. Share through any app.

Encrypted locally. No uploads. Works offline.

X25519 + ML-KEM-768AES-256-GCMML-DSA-65

Help & details

  1. Exchange public keys

    Share your public key link and open theirs to add them. Then check your safety emoji together once.

  2. Write, then encrypt & copy

    Press Ctrl ↵Tap Encrypt & copy, then paste the copied link into any chat, email or post. You can also copy ciphertext or save a .cipher file.

  3. Decrypt with your private keys

    Open their link in the browser that stores your private keys, or paste the ciphertext into the Decrypt tab.

Files work the same way. Drop one on the page to get an encrypted .cipher file you can attach in your chat app; its real name and type are hidden inside.

If you prefer the share menu, install Nullkey from Chrome's menu on Android. Then, in apps that offer sharing, choose Share → Nullkey to open an encrypted message or .cipher attachment. Availability depends on your browser and device; on iPhone, use message links or paste instead.

About your public key
Made for you
Your browser creates it the first time you visit. There's nothing to sign up for.
Safe to share
It works like a mailing address: anyone with it can send you private messages, but nobody can use it to read them. Your private keys stay in this browser unless you export a backup.
Saved in this browser
Clearing your browsing data deletes it. To keep a backup, or to use it on another device, copy a private key backup from My keys.
Security details
Encryption
AES-256-GCM, with a fresh key for every message (HKDF-SHA-256, random 128-bit salt).
Quantum-safe
Every message key combines X25519 with ML-KEM-768, the NIST post-quantum standard. Reading a message would mean breaking both, so messages recorded today stay private even from future quantum computers.
Sender
New messages use ML-DSA-65 sender signatures. Verify the full Nullkey ID and safety emoji to authenticate its owner.
Safety emoji
10 emoji from a set of 256: 80 bits of SHA-256 over your whole ID, too many to fake.
Integrity
Any change, reorder or cut to a message or file makes it fail to open.
Network
None. The page's security policy blocks every outgoing connection, and it works offline.
Code
The browser's WebCrypto, plus pinned local noble ML-KEM-768, ML-DSA-65 and Argon2id implementations.
What it can't hide
  • Your chat app still sees that you sent something, when, to whom, and roughly how long it was.
  • Protected keys are saved encrypted; their passphrase is required to reconstruct them. Session-only keys are lost when the tab closes unless you export a backup. This does not add forward secrecy.
  • You trust this page each time it loads. If your device itself is compromised, no encryption can help.
1 of 5

Private, encrypted messages over any app

Type a message in Nullkey and press Encrypt & copy. Paste the result into any chat app, email or post, like any other message. That app, and anyone watching it, only sees scrambled text. The person you chose copies it into their Nullkey to read it.

You both need Nullkey open in a browser. There's no account, and nothing you write is sent to any server.

Protect your private keys

Set a passphrase to save encrypted keys in this browser, or keep them only in this tab.

Use at least 12 characters. It cannot be recovered if forgotten.

Protect keys

My keys

Share your public key; keep your private keys secret. Choose how to protect them below.

Public key

Safe to share

People use this to encrypt messages to you and verify your signatures. Your Nullkey ID packages your public keys together.

SHA-256 fingerprint

Generating…
Verify key with fingerprint emoji

    These emoji are a fingerprint of your public key. Anyone who adds you sees these same 10 for you. Compare them once, on a call or in person: if they match, they have the right public key.

    Private keys

    Keep secret

    Your private keys decrypt your messages and sign what you send. Save them encrypted with a passphrase, or keep them only in this tab.

    Locking clears drafts and decrypted history. Reloading always locks protected keys.

    Back up or restore private keys

    New backups are encrypted with a passphrase you choose. You need that passphrase to restore them. Old unencrypted backups can still be imported.

    Generate a new key pair

    Replace this browser's keys if your private key backup has been compromised.

    • Messages encrypted to your old public key won't decrypt here anymore.
    • Share your new public key with your contacts.
    • Your saved people stay as they are.