Security
Security
How Railgun protects what you send: the cryptography in the clients, how keys are handled, and how to report a vulnerability.
Last updated
Encryption
We describe what ships today and what is still in progress separately, because they are not the same thing. For the exact status of every component, see the encryption page.
Available today
- Direct messages between Railgun users are end-to-end encrypted with libsodium sealed boxes — X25519 key exchange and XSalsa20-Poly1305 — so only the recipient’s device can read them.
- Identity keys are generated on your device; the server stores only public keys, never private ones.
- Desktop key material is protected at rest with XChaCha20-Poly1305 before storage.
Planned, not yet shipped
A full Signal Protocol implementation (X3DH + Double Ratchet), which adds Perfect Forward Secrecy and post-compromise security, is written and under review but is not yet wired into any client you can download. Until it is, we do not claim it.
- X3DH + Double Ratchet handshake and ratchet — implemented against libsignal, not yet instantiated by a shipping client.
- Perfect Forward Secrecy and future secrecy (post-compromise security) — arrive with the ratchet above.
- End-to-end encryption for group and channel messages — not yet implemented.
Key Management
Your identity keys are generated locally on your device using cryptographically secure random number generators. Private keys never leave your device and are stored in secure storage (Keychain on macOS, Credential Manager on Windows, libsecret on Linux).
Open Source
Railgun's protocol and trust pages are published here; source availability is described on the download page.
View on GitHubReporting Vulnerabilities
We take security vulnerabilities seriously. If you discover a vulnerability, please report it responsibly:
Email:
security@railgun.chatPlease include a detailed description of the vulnerability and steps to reproduce. We aim to respond within 48 hours and will work with you to resolve the issue.
Security Audits
We are committed to regular security audits by independent third parties. Audit reports will be published here as they become available.
Best Practices
To maximize your security when using Railgun:
- Always download Railgun from official sources
- Verify download checksums before installation
- Keep your operating system and Railgun updated
- Use strong device passwords/biometrics
- Verify safety numbers with your contacts
- Be cautious of phishing attempts