Ledger Chat
Messaging in Ledger Chat
How direct messages are encrypted, where your history is kept, and how to recognise a message that was not.
Direct messages in Ledger Chat are encrypted on your device before they are sent, and can only be decrypted on the devices of the people in the conversation. Encryption and delivery are handled by XMTP, an open messaging network built for wallet addresses.
How a message is protected
XMTP uses Messaging Layer Security (MLS), the IETF standard published as RFC 9420. Each device has its own keys, created in your browser the first time you allow secure messaging. Keys are rotated as the conversation continues, so a key taken from a device later does not unlock earlier messages.
- The text of a message, your replies and your reactions travel encrypted.
- XMTP nodes store the encrypted data so a recipient who is offline can receive it later. At the time of writing, XMTP keeps it without a time limit.
- Neither XMTP nor Humanity Ledger holds the keys needed to read it.
Messages that travel through our server
Sometimes XMTP delivery fails, for example when the other person has not yet set up secure messaging on any device. Rather than lose the message, the app can send it through our own server instead. A message sent this way is stored on our server in a form we can read.
These messages are marked in the conversation with a label that reads Not end to end encrypted. Messages without the label went through XMTP.
We are closing this gap
Our server now refuses to log the content of these messages and can be set to reject unencrypted messages entirely. That setting stays off until every client can encrypt fallback messages, so that nobody's messages are silently dropped. Progress is tracked on the audits page.
Where your history is kept
Your conversation history is stored in your browser on each device. If you clear your browser data, or use a private window, the history on that device is removed. It can be downloaded again from XMTP only for as long as the network keeps it and only on a device that holds valid keys.
Attachments
Images, files and voice notes are uploaded to our storage provider, and the conversation carries a link to them. The file itself is not encrypted yet, and anyone who obtains the link can open it. Until attachments are encrypted on your device before upload, avoid sending files you would not want a stranger to see.
What else our server knows
| Information | Who can see it |
|---|---|
| Message content sent through XMTP | Only the people in the conversation. |
| Message content sent through the fallback | The people in the conversation and our server. |
| Your contacts and contact requests | Our server, so that they follow you to new devices. |
| Whether you are online | Our server, for a short time, so others can see that you are available. |
| Who you talk to and when, for XMTP messages | XMTP nodes can see that encrypted data was sent to a conversation and when. They cannot read it. |
Features
- Replies, reactions, voice notes, images, polls and GIFs.
- Read receipts, which you can turn off in settings.
- Saved messages for anything you want to keep.
- Message search across the history stored on your device.