Zero-knowledge key escrow, explained — how Peopoli can't read your DMs

2026-10-16 · Updated 2026-10-16

Most products that say “encrypted” mean “encrypted in transit.” The server still holds a key, or can reset your password and read everything. Peopoli's Whisper messenger is built on a stricter idea: the server relays ciphertext and holds nothing that can decrypt it — including your backups. This post explains how that works, in plain English, including the part most products quietly skip: what happens when you forget your password.

The encryption: done on your device, always

Every conversation is protected with an X25519 keypair — the same class of elliptic-curve design Signal uses (we use the nacl.box construction). Encryption and decryption happen in your browser. The server stores ciphertext and routes it. That's the whole job. There is no server-side key that could be subpoenaed, breached, or “temporarily turned on for law enforcement,” because there isn't one.

The backup problem, and zero-knowledge escrow

Client-side encryption creates an awkward question: your messages are locked with a key that lives only on your device — so what happens when you switch devices? The usual answer is a backup. The usual backup is the flaw: whoever stores the key can read your mail.

Whisper's answer is zero-knowledge key escrow. Your secret key is wrapped (encrypted) in your browser with a key derived from your passphrase using Argon2id — a memory-hard function that makes offline brute-force expensive — and the wrapped blob is stored on the server as opaque ciphertext. The parameters are enforced server-side, so a client can't quietly negotiate weak ones. The server stores a thing it cannot open. That's the “zero-knowledge” part: we have your backup, and we can't read it.

The honest part: lose both, and it's gone

If you forget your passphrase and you've lost your recovery code, your messages are unrecoverable. Not “difficult” — unrecoverable, by anyone, including us, forever. A one-time recovery code (128 bits of CSPRNG entropy, rendered base32, shown exactly once at setup) is the only backstop. Most “encrypted” products quietly hold a way in; we architecturally don't, and we'd rather tell you that plainly than discover it in an audit.

Why this is rare

Because it's a product decision with a cost. A vendor that holds keys can promise “account recovery!” and upsell a support plan. A vendor that holds nothing has to say what Whisper says: keep your recovery code somewhere safe. We think that trade is the only honest one for a social platform — and it's checkable: the client code runs in your browser, and the server only ever sees the wrapped blob.

What this doesn't cover

Scope matters. Only Whisper DMs are end-to-end encrypted. Public posts, notes, media and mail are server-side data — protected, but visible to the operators by necessity of search and rendering. We won't claim otherwise: “Your DMs are end-to-end encrypted. Your posts are yours — not tracked, not sold, not trained on.” That's the accurate sentence, and it's the one we print.