Instacrypt
A Post-Quantum-Ready Encryption Assistant
Context
We now live in a society where computers and mobile devices are a necessary part of our lives. This increases the chances of identity theft and often raises privacy concerns, as the services and applications we use to communicate with each other are either unsafe — like email — or run by companies that are not to be trusted.
Another example, according to an InformationWeek article on December 10th, 2019: “A total of 2.7 billion email addresses, 1 billion email account passwords, and nearly 800,000 applications for copies of birth certificates were found on unsecured cloud buckets.” Not encrypting your data before you send or store it is really just asking for trouble.
Problem
Encryption tools have historically been cumbersome or too hard to use. Passwords are hard to share safely, and key-based encryption has an undesirable learning curve, especially for non-technical users. Keys are hard to manage and exchange — it takes considerable effort for the average user. As a result, the only successful implementation of proper encryption for everyday data safety has been what's embedded seamlessly within applications. But even with platform operator trust aside, that locks users into a specific vendor or app: you can only communicate securely with people on the same platform. And the safest applications are rarely the most user-friendly — users end up choosing between safe and pleasant, never both.
Solution
Instacrypt is a set of tools that simplify encryption so the average user can set up, encrypt, and decrypt files to share with others seamlessly — without being locked into any vendor or application. Furthermore, decoupling encryption and the communication/storage platform (i.e. chat, e-mail, cloud storage) also removes the need to trust the communication/storage platform operator to do the right thing.
It's designed to be simple enough that people with a typical threat model can use it without touching a password or key at all, and sophisticated enough for advanced users to meet their heavier security needs. Developers can also use it to replace PGP in daily use, applications, and git signing.
Cryptography
Instacrypt is essentially a UX-enhancement wrapper around age by Filippo Valsorda, using the hybrid classical (X25519) + ML-KEM approach for encryption — a widely accepted construction for post-quantum readiness — with ML-DSA-65 (FIPS 204) signatures. We are not reinventing encryption. It's not custom cryptography. It just makes battle-tested open source technologies more usable.
Terminology
Traditional key-based encryption terminology is not very intuitive. In Instacrypt, secret keys are known as “keys” and public keys are known as “locks”. The combination of the key, lock, and metadata are known as an "identity" .
Share it freely. Anyone can use your Lock to encrypt a file only you can open.
Share itOnly your Key can unlock what was locked up with your Lock.
Keep privateYour Key and Lock together associated with an alias & e-mail address.
ProtectedUsage
Users have a choice of the following ways to use Instacrypt:
- Instacrypt App — GUI application, for everyone
- icc — CLI application, for advanced users and developers
The app runs on Linux, macOS, and Windows (x86_64 and arm64) plus Android and iOS; the CLI covers the desktop platforms. Both are free and open source, and can be used independently with all data residing only on the device they're installed on — which may be preferred by users with heavy security needs. For everyone else, there's Instacrypt Cloud: a purpose-built service both apps can connect to for a much better experience.
Local use only
You can skip the Cloud entirely and use either app without restrictions. To make exchanging locks easier, file export/import and animated QR codes let users swap locks (public keys) in person or over any communication channel.
Both apps have full export capabilities for backups and restores, and profiles can be imported manually onto multiple devices — or synced with a third-party service like Syncthing or your own cloud storage.
As for sharing the encrypted file itself: use any medium you like (chat, email, or a file-sharing service). This is arguably the most private way to use Instacrypt — and the inconvenience is exactly why Instacrypt Cloud exists, doing the heavy lifting for you instead.
Cloud service
Value-added features of Instacrypt Cloud:
- Sync keys, contacts, and settings across devices seamlessly
- Import developer locks published in the Cloud Directory
- Exchange locks with contacts the way you'd add and accept a friend on social media
- File sharing — one-click upload of an encrypted file, and only the intended recipients can receive and decrypt it, directly inside their own Instacrypt apps
Instacrypt Cloud stores user email addresses and a minimal amount of metadata in plain-text required to operate its convenience features. Everything else is encrypted on your device before upload — there is no way for Instacrypt Cloud to read it. Contact lists and their sync history are fully encrypted, and contact add/accept transactions are encrypted end-to-end: the server sees only delivery metadata and never stores who sent a request. For file sharing, the service records only the file's name and size — the contents stay inside the encryption, and the sender's identity is cryptographically bound within it so it can't be forged. The sender-to-recipient routing is metadata the service holds only while a share is active, then deletes. No social graph accumulates on the service.
Complete list of what's zero-knowledge and what's not…
| Data | Instacrypt Cloud | Storj |
|---|---|---|
| Keys (private) | Encrypted (only if you enable identity sync) | — |
| Locks (public) & directory profile | Plaintext — lock, display name, email, nickname (only if you publish to the Directory) | — |
| Contact list & sync history | Encrypted | — |
| Contact groups | Encrypted | — |
| Contact add / accept requests | Encrypted; delivery metadata only, sender not stored | — |
| Settings | Encrypted | — |
| Notifications | Encrypted | — |
| Shared file contents | Encrypted | Encrypted |
| Shared file name | Plaintext while the share is active; purged after a short retention window once it's downloaded, expires, or is cancelled | — |
| Shared file size | Plaintext while the share is active; purged after a short retention window once it's downloaded, expires, or is cancelled | Size only |
| Sender → recipient of a share | Plaintext while the share is active; purged after a short retention window once it's downloaded, expires, or is cancelled | — |
| Email address | Plaintext | — |
| Sign-in credential | Hashed (Argon2id) — your password never reaches us | — |
| Two-factor secrets | TOTP secret encrypted at rest (readable only to verify your codes); WebAuthn keys are public; recovery & email codes hashed | — |
| Device sessions | Plaintext — device label, last seen; session tokens hashed | — |
| Plan & subscription | Plaintext — tier, status, VIP, Stripe subscription ID | — |
| Payment details | Never stored (handled by Stripe) | — |
| Account & operational metadata | Plaintext — timestamps, email-verification & terms-consent records, anti-abuse rate-limit logs | — |
Servers are hosted in Nuremberg, Germany with full-disk encryption. The file-sharing service stores files in the EU1 region of Storj. No personally identifiable information beyond an email address is needed to sign-up for Instacrypt Cloud; paid plans require normal payment details, which are processed and stored by Stripe — never on Instacrypt Cloud servers.
Developers
Most of the client-side heavy lifting is done by the icfx Go library — free and open source. Use it to build applications on top of Instacrypt's friendlier encryption.
Further out, an ic-agent key daemon is on the roadmap, so existing applications can request signatures and decryption from Instacrypt without embedding anything — the same role gpg-agent plays for PGP.
There are also plans to draft an RFC for e-mail encryption with icfx. The first demo implementation will likely be Aerion.
Sustainability
Instacrypt was originally built as an internal tool for a tech consultancy's own needs. It's now released to the public as free and open source software. The only thing we ask for in return is community review and feedback to improve the software. The Instacrypt library and apps will remain open source forever. The library and client side apps will always be kept completely usable without Instacrypt Cloud.
We will also do our best to make Instacrypt Cloud's basic features free for groups of 3 people. Our hope is that the modestly priced paid plans will go towards covering hosting charges and additional resources to continue improving all components of the project. We will never show/run ads or sell user information.
Outside of subscribing to a paid plan, you can also support this project by giving our repos a star or buying us a coffee:
Be sure to mention "Instacrypt" in the "Say something nice..." field so we know what project the coffee is for. 🙏