bono is built so privacy rests on architecture and mathematics, not promises. This page explains what protects a conversation, what we deliberately don't promise, and how to verify it.
For network-level anonymity — hiding that a connection happened at all — pair bono with a VPN or Tor.
You get a room code and a secret code. The room code helps the two devices meet; the secret is the real password, best shared out loud rather than typed into the same channel.
Both devices run CPace. The secret never crosses the wire — only a mathematical proof that both sides know it. Guessing is possible only live, through the relay, and a room lives for just a few minutes before it disappears. And a wrong secret is only ever a live guess: after three wrong attempts the room burns and the code stops working.
Both screens show the same five control words. Compare them out loud. If they match, no one is sitting in the middle relaying your chat. Trust your own ears here — this is a "compare out loud" check, not a certificate.
Everything travels as AES-256-GCM ciphertext. Close the room and the keys, the messages and the room itself simply stop existing — on both devices and on the relay.
Nothing here is invented by us. bono is assembled from published, reviewable standards — so you can check the primary source for every claim.
A password-authenticated key exchange (PAKE) that turns a shared secret into a strong key without ever transmitting the secret. It is the PAKE selected by the IETF's Crypto Forum Research Group (CFRG).
IETF CFRG specification →The prime-order group the handshake runs over, built on Curve25519. It removes the sharp edges (cofactor pitfalls) that trip up naïve elliptic-curve code.
ristretto.group →The cipher that protects every message. It both encrypts the content and detects any tampering in transit, so altered ciphertext is rejected rather than decrypted.
NIST specification →An audited, dependency-free pure-JavaScript cryptography library. bono bundles it locally, so no crypto code is fetched from a third party at runtime.
github.com/paulmillr/noble-curves →A Short Authentication String: both sides derive the same handful of words from the handshake and read them aloud. The same idea secures ZRTP voice calls.
RFC 6189 (ZRTP) →The server's whole job is to move ciphertext between two devices, and to store nothing readable. It never holds a key or a plaintext byte — there is nothing to read and nothing to steal.
What it does see, honestly. To hold a conversation together the relay has to know that two connections belong to the same room, so while a room is alive it can see that two ephemeral connections share one opaque handle. That handle is a random address, not an identity: no account, no number, no name, and no link to any room before or after it. Because a dropped connection no longer ends a conversation, that window now lasts as long as the room does — up to three minutes after a device goes quiet, rather than three seconds. It exists in memory only, under a hard time limit, is never written to disk and never logged, and an address is never reused. Restarting the relay destroys every room and every held seat. What the relay still cannot do is read anything, learn who you are, or keep any record of who talks to whom.
The one thing it may hold briefly is an offline note: if you leave a note for a saved contact who is offline, it is sealed to your shared secret and left on an opaque shelf. We store only that sealed envelope — up to 24 hours, deleted the moment it is picked up. So the sender can tell a note reached its device rather than quietly lapsing, the relay also remembers, for up to 7 days, one bare fact about the shelf: that it was emptied by pickup or by expiry — a single flag stored against a one-way hash of the opaque address, with nothing readable, no note, no sizes and no identities. The relay cannot read the note itself, cannot see who left it or for whom, and never sends a push. (Verifiable once the code is open.)
Our own architectureThe security-critical heart of bono — the CPace handshake, the key derivation, and the zero-knowledge relay — is being prepared for public release under an open license, with a written protocol specification and test vectors. Don't take our word for how it works; read it.
GitHub — coming soonModern standard cryptography. CPace · Ristretto255 · AES-256-GCM, on the audited noble library.
Zero-knowledge, zero-storage relay. The server forwards ciphertext, keeps nothing readable, and holds no record of who talks to whom.
Open core. The protocol and its specification, published with test vectors.
Bug bounty. A standing invitation — and reward — for finding flaws.
Reproducible Android builds. So the app you install matches the source.
Independent professional audit. An outside team, checking our work.
Not a safe, not a bunker. Just a closed door — and a conversation that stays inside the room.
Start a private conversation