The Spojiti blog

What we build and why, in public. No tracking on this page either.

PositioningSeptember 2026

Spojiti knows no one. That's the whole point.

Every messenger you have used knows who you are. It has your phone number, and through it your contacts, your country, your carrier, and a graph of everyone you have ever written to. Encryption protects the words; it does nothing for the fact that the words were exchanged, by whom, and when. That fact is the product those companies sell, or the record they are compelled to hand over.

Spojiti starts from the other end. There is no phone number, no e-mail, no name, no account. Your identity is a key your phone derives from twelve words you keep. Our relay routes sealed envelopes between random ids and deletes them on delivery. When a court asks us who you are, the honest answer is the only answer: we do not know, and we built it so that we cannot find out.

That is not a policy. Policies change with owners, with laws, with pressure. It is a construction, and it is published — in the white paper, in the protocol reference, and in the source. Read it. Then decide whether "we promise not to look" was ever good enough.

EngineeringSeptember 2026

Post-quantum, proven on the phone in your hand

Claiming post-quantum protection is a paragraph. Proving it is a test that runs on the device before the first message: we run NIST's published known-answer vectors for ML-KEM-768, ML-KEM-1024 and ML-DSA-65 at every launch, and only then let the library near a conversation. This post walks through why a silently wrong post-quantum library is worse than none, and how the hybrid handshake, the every-turn ratchet and the hybrid signatures fit together.

Read the post-quantum page →