Part of Vulos
Your key is your identity, not an account.
Sovereign mail, chat, files & identity — one keypair, delivered over a peer-to-peer mesh and mixnet.
Envoir is the open-source reference implementation of DMTAP (the Decentralized Message Transfer & Access Protocol): one sovereign keypair identity for mail, chat, calendar, contacts, files, and groups, so that not even a global observer sees who talks to whom. A human address like you@envoir.org is only a pointer to your key — lose the provider, keep the identity. There is no cryptocurrency and no blockchain anywhere in this project.
Pre-alpha reference implementation. Today's web client simulates network delivery (clearly labeled) so the whole protocol is demonstrable end to end in a browser. An independent external security audit has not yet happened and is the gate before any production deployment. See Roadmap.
One key, every surface
Mail, chat, calendar, contacts, files, and groups — all on the same MOTE substrate, all under one keypair identity.
Three-pane inbox, threading, labels, snooze, scheduled/undo send, and per-message transport-path provenance — pure-mesh or gateway-touched, always labeled.
Chat
DMs (deniable X3DH + Double Ratchet) and channels (signed MLS groups) on the same substrate as mail — an honest protocol badge on every conversation.
Calendar
Month/week/day views and an agenda rail, recurring events, and meetings whose invitations and RSVPs travel as peer-to-peer messages, not a query against a central server.
Contacts & Identity
Per-contact key verification — TOFU-pinned vs. verified via safety number — plus your own safety number, linked devices, and a versioned recovery policy.
Files & Groups
Content-addressed, end-to-end encrypted files of any size. A shared folder is simply a group — a group has its own address, like team@envoir.org.
Installable & offline
A real PWA: home-screen install, offline app-shell load via a service worker, and content-free Web Push wake-pings that never reveal who or what.
What it looks like
Mail, chat, calendar, identity, and the transport-path provenance graph.
Fully responsive down to ~360px phones. Full gallery in the docs.
Quick start
A Rust workspace and a build-step-free web client — try the in-process delivery demo first.
git clone https://github.com/vul-os/envoir cd envoir cargo build --workspace # two in-process nodes exchange a real, # end-to-end-encrypted MOTE cargo run -p envoir-node -- demo # the web client — no build step, no npm cd client python3 -m http.server 8095 # open http://localhost:8095
- 1Build the workspaceRust 1.75+,
cargo build --workspacebuilds the node, gateway, and every crate. - 2Run the delivery demoThe clearest illustration of what's real today — a genuine sealed-and-verified MOTE exchange, no mesh required.
- 3Open the web clientNo framework, no npm, no CDN — real identity crypto in the browser, with clearly-labeled simulated network delivery.
Honest about what's real
A reference implementation that says exactly what's real code versus what's specified for later.
Real today
The MOTE delivery engine, signed key discovery, a real libp2p mesh transport (proven on loopback), real IMAP/POP3/SMTP/JMAP servers, the legacy gateway, and the pluggable naming/resolver framework.
Not the default yet
The node daemon still uses a plain TCP transport, not the libp2p mesh, by default. The mixnet exists as wire types and a simulator, not a running transport.
The one hard gate
An independent external cryptographic and code audit hasn't happened yet — it's the gate before any production deployment. Treat everything here as pre-alpha.
Part of VulOS
Vulos is a family of open, self-hostable apps. Envoir implements the open DMTAP spec standalone — self-hosting has every protocol feature, client, and privacy guarantee a hosted operator would offer; a hosted operator only ever sells convenience.
Explore Vulos →