Security
Security model
What Ledger Chat protects you from, what it does not, and what you can do yourself.
No product protects against everything. This page explains, in plain terms, which risks Ledger Chat is designed to handle and which ones remain your responsibility or are still open.
What we protect against
| Risk | How Ledger Chat handles it |
|---|---|
| Someone reading your direct messages on the way | Messages are encrypted on your device and only decrypted on the recipient's. |
| Our own servers being breached | Direct messages delivered through XMTP are not on our servers in readable form. Your PIN is stored only as an Argon2id hash. |
| Someone pretending to be you | Signing in needs a signature from your wallet. Our servers ignore any identity the browser claims that is not backed by a valid session. |
| Password leaks and SIM swaps | There is no password to leak and no phone number to steal. |
| Someone opening the app on your unlocked device | The PIN blocks the app until it is entered. |
What we do not protect against yet
- Messages sent through the fallback path, community posts and attachments can be read by our servers. See Encryption for the full list.
- Metadata. Our servers know who your contacts are, which communities you belong to and when you are online. XMTP nodes can see when encrypted messages are sent.
- Your IP address in calls, unless you turn on the setting that relays every call.
What no messenger can protect against
- Malware on your device, which can see whatever you see.
- A person you are talking to who saves or shares what you send.
- Someone who has your wallet's recovery phrase. They are you, as far as any system can tell.
What you can do
Protect your recovery phrase
Write it down, keep it offline, and never type it into a website or a chat.
Check what you sign
A sign in message for Ledger Chat names this website. A message for any other domain, or a request to approve a transaction, is not our sign in.
Watch for the label
If a message is marked Not end to end encrypted, treat it like an email: fine for most things, not for secrets.
Lock your devices
Use a screen lock on every device where you use Ledger Chat, and a PIN that is not easy to guess.