Encryption was the easy part.
Every private messenger depends on a server that tells your phone which key belongs to whom. We built Morse so that server can be caught lying, and so a lie costs more than it could ever be worth.
8 minute read
When you message @ada on Morse, your phone locks the message with Ada’s key before it leaves your hand. Only her phone holds the key that opens it. Not us, not our servers, not anyone who breaks into them.
Which leaves a question most messengers would rather you didn’t ask. Where did your phone get Ada’s key?
From us. Your phone asked our directory for @ada’s key and believed the answer. Every lock on every message you will ever send her rests on that one reply.
The quiet swap.
Suppose the reply is wrong. Suppose the directory hands you a key it holds itself, and hands Ada one for you. Your phone locks every message perfectly, for the wrong person. The server opens it, reads it, locks it again for Ada and passes it on. Nothing breaks. Nothing looks different. The encryption never had to fail.
This is not a thought experiment. In 2018, two senior technical officials at GCHQ, Britain’s intelligence agency, published a proposal for reaching encrypted chats without breaking the encryption at all. The provider would quietly add a hidden participant to the conversation, and the app wouldn’t say so. More than fifty companies, charities and security experts, Apple and WhatsApp among them, signed an open letter asking GCHQ to drop it.
The proposal needed only one thing: a server that hands out keys and can’t be checked. A server can be hacked. The people who run it can be pressured, bribed, or served an order they aren’t allowed to talk about.
“We would never” is a promise. It isn’t a protection.
The check almost nobody does.
Good messengers know this, and give you a way to catch it. Every Morse chat has a safety number. Sit down with a friend, compare the two, and if they match, nobody is in the middle. It works, and it stays: it’s the one check that holds even if everything else colludes.
But a defence that only works when two people read strings of digits to each other protects the few who do. Most people never will, and they shouldn’t have to. So the question we built Morse around was simple: what would it take for everyone to be protected by default?
Know only what we must.
The first half of the answer is to know as little as possible. What we never had can’t be leaked, sold or handed over.
So Morse doesn’t ask for your phone number, your email or your address book. You pick a username. Messages are sealed so our delivery servers can’t see who sent them, and every one is padded to a standard size, so we can’t tell “OK” from a paragraph. We can’t see who’s in your groups, or even what they’re called.
But a messenger can’t know nothing. It has to know which key is yours, or nobody could ever reach you. That’s the one thing we can’t avoid knowing, so it’s the one thing we built to be checked.
Write it where everyone can see.
Every key Morse hands out is written into a single log that only grows. Nothing in it is ever edited or removed: a new key is a new entry at the end. Your phone won’t use a key unless it can see that key in the log, and it rejects any version of the log more than five minutes old.
That changes the swap. To give you a false key for Ada, we would have to write it into the same log that everyone’s phone checks, Ada’s included. If her keys ever change, Morse tells you.
The idea is borrowed, and that’s the point. The web made the same move for website certificates: since April 2018, Chrome won’t trust a new certificate unless it has been written to a public log. The web stopped running on promises from the companies that issue certificates, and started running on records anyone can check.
A log has a weak spot of its own, though. Whoever keeps it could show you one version and everyone else another. That’s called a fork, and catching one takes somebody who isn’t us.
Witnesses who don’t answer to us.
A witness is a small server run by an operator outside Morse. Every 15 seconds it asks for the newest version of the log and checks it before signing: that our directory signed it, and that it contains the last version the witness signed, entry for entry, with nothing rewritten. A witness never signs an older version, or a different one in its place. It never sees a message, a username or a wallet. To a witness, a version of the log is a number, a size and a fingerprint.
Your phone only accepts a version that most of its pinned witnesses signed. And here is the part that makes it work: two majorities of the same group always share at least one member. So to show you one log and Ada another, at least one witness has to sign both. Those two signatures, side by side, are the proof.
A lie proves itself.
Make lying expensive.
Proof is half of it. A liar who is caught should pay.
Every witness stakes a bond to take part, and so does our directory’s own key. Anyone who finds two conflicting signatures can post them on-chain, where a program checks them. The bond is slashed. A tenth goes to whoever caught it, and the rest is locked or burned. None of it is ever paid to Morse, so we never gain from a slash.
Going offline never touches a bond. A witness that misses a version misses its pay, nothing more. Only a signed lie costs the bond, and the bond grows with a witness’s pay, so a lie always costs at least two years of it.
We’re held to the same rule. Once the network is open, Morse runs exactly one witness, bonded and slashable like any other, and the threshold is set so we can never reach a majority, alone or with our directory.
None of this asks you to trust a blockchain either. Your phone never waits for a verdict: it already refuses any key the witnesses haven’t vouched for. The chain can take trust away from a witness that lied, and it can never grant it. Each app release names the witnesses your phone trusts, so no amount of money or tokens changes which keys it accepts.
Who pays for honesty.
Running a witness is a real job, and real jobs get paid. Not with ads, and never with your data: measuring what you do is exactly what our servers are built not to do.
Messaging stays free. It never needs a wallet, credits or a token. Credits are for extras:
- Sending files past the 16 MB limit.
- Keeping messages waiting past 30 days for a phone that’s been switched off.
- Putting a small price on message requests from strangers, so spam stops paying.
You buy credits in USDC, SOL or BTC, and each one is signed blind. When you spend it, our servers can tell it’s genuine, but not who bought it. A share of every credit sold pays the witnesses for every version they sign.
The Morse token is what holds the loop together. It’s the bond witnesses stake, and what every credit purchase burns. You never need to hold it: pay in USDC, SOL or BTC and the app swaps for you. Your wallet and your username never meet, and nothing about who you talk to, or when, is ever written to a chain.
So the loop closes. People who want extras pay for them, that pays the witnesses, and the bonds keep the witnesses honest.
A language that won’t let us slip.
Honest intentions don’t prevent honest mistakes. In practice, encryption rarely fails because the maths broke. It fails because a key ended up somewhere it shouldn’t: a log file, a crash report, a copy nobody erased.
So Morse is written in Mesh, a programming language we built for it. Mesh treats keys as a special kind of value. A key can’t be printed, logged, saved or passed around the program like ordinary data, and it’s destroyed the moment it’s no longer needed. Code that tries any of that doesn’t build.
Mesh borrows its big idea from Erlang and Elixir, the technology behind phone exchanges and some of the world’s biggest chat apps. Every job on our servers runs as its own isolated worker. If one fails, the others carry on, and Mesh can start it again on the spot. The same core runs inside the iPhone, Android, Mac and Windows apps.
Writing your own language is a trade. A young language can have bugs of its own, so every change we make ships with a test that fails without it.
Where the edges are.
“Kept honest” applies to what we say, too. Morse can’t protect a phone that’s already compromised, or unlocked in someone else’s hand. It can’t stop the person you’re talking to from taking a screenshot. And someone who can watch the whole internet can still see when you’re active, and may work out who you talk to from timing alone. Hiding the sender isn’t the same as being anonymous.
Need us less.
The point of all this isn’t to ask you to trust Morse more. It’s so you can need us less. Each piece is ordinary on its own: encryption, a public log, signatures, a bond. Together they turn “trust us” into something your phone, and anyone watching, can check.
It launches in stages, and each stage stands on its own. Today both of the witnesses your phone checks are ours: the log is checked, but by us. Every stage below moves that check further out of our hands.
- Public checkpointsEvery version of the key log, posted to a public chain anyone can check.
- Independent witnessesOperators outside Morse sign the log alongside us.
- Anonymous creditsExtras paid in USDC, SOL or BTC, spent without a trace.
- The Morse tokenBonds for witnesses, burned by every credit bought.
The full design is public: the key log, the witness network, and exactly what our servers can see. Don’t take our word for any of it. That was the whole idea.