The nerdy stuff

You clicked. Welcome.

The rest of this site is written for people who just want to talk to their family. This page is for you: the design decisions, the actual ciphers, and the numbers. If any claim here doesn’t hold up, we want to hear about it — team@elevenmessenger.com.

The one rule

Everything follows from a single invariant: if the server is compromised, the attacker gets nothing worth having. The server stores and relays opaque ciphertext plus key material it cannot open. It never sees message content, names, or file bytes, and it never receives a usable key. Not "we promise not to look" — can’t.

The cryptography

• Identity: every member has an ECDH P-256 keypair. The private key lives only on your devices; the public half joins the roster.
• Per-thread keys: every conversation gets its own AES-256-GCM key, wrapped to each member’s public key via ECIES. The server stores only the wrapped blobs. Membership is enforced by cryptography, not by a row in a permissions table.
• Everything rides inside the envelope: attachments, their filenames, their MIME types, and sender names travel inside the encrypted payload — never as server-side metadata. Even roster display names are sealed under a per-space key the server can’t open.
• Invites: the one-time secret lives in the URL #fragment, which browsers never send to any server. It bootstraps your keys locally, then it’s spent.
• Sign-in: WebAuthn passkeys — and not just for authentication. The PRF extension derives the key that seals your backup vault, so the vault server holds ciphertext it can’t open either. No passwords exist anywhere in the system.
• Push: notification payloads are sealed bytes, decrypted on-device. The Apple push relay holds a signing credential, not a decryption key — it forwards the same ciphertext Apple already sees.
• Admin is not god: the admin credential authorises roster management only. It is not, and cannot become, a decryption key. Only its hash is stored.
• Tamper-evident history: every write — messages and key hand-outs alike — is journaled under chained, signed Merkle checkpoints (RFC 6962-style). Members’ devices gossip the chain heads inside E2EE traffic and alarm on forks, clients can demand inclusion proofs for held messages, and invite links carry a MAC that pins the joiner’s first key. A public witness log — anchoring the chain outside the server — is the designed next step.
• AI helpers are members, not backdoors: a bot is an ordinary E2EE member whose "device" is a machine its operator runs — it can decrypt exactly the conversations it’s been invited into, and bot code never runs inside the server process.

All wrap/unwrap and encrypt/decrypt happens client-side, in plain, unminified, framework-free JavaScript served with no build step — the code your browser runs is the code we wrote, readable in your dev tools right now.

What a stolen database actually yields

Steal an Eleven space’s entire database and you hold: a membership graph (which keys are in which threads), message timings and sizes, wrapped key blobs you can’t unwrap, and ciphertext. No names, no message content, no files, no phone numbers, no emails — chatting never collects them, and a paid space’s billing contact lives with Stripe, not in any space’s database. The security page spells out the honest limits, including what’s still open on key distribution (a swapped key is caught and alarmed today; a public witness log comes next).

The deployment model

This is the part we think is novel — not any one piece, but the combination: one static ~18 MB binary; one isolated process and database per space; a thin TLS router over unix sockets; scale-to-zero hibernation into object storage with a single-writer lease; versioned side-by-side deploys with automatic rollback. Full detail, including the arithmetic for scaling to billions of members: the planet-scale page.

Built by humanity, built to outlive AI

The licence is its own design decision: the GAI Licence — MIT plus a share-alike clause returning any distributed derivative to the commons, with preserved 🤖 authorship markers, because generative AI distils the public work of billions of people and no one downstream gets to fence that off. The story page has the why.

A companion engineering rule you can check in the code: everything must stay maintainable by humans alone. Vanilla JavaScript with no build step, one boring Go binary, tools you can read in an afternoon — so the product outlives the availability, and the price, of the intelligence that helped build it. If AI gets cheaper, this is a solid baseline; if it goes away, nothing here dies with it.

By the numbers

• ~44klines of code, total — web, server, native apps, helpers
• 18 MBthe entire server, one static file
• ~23 MBRAM for a whole running space — app, database, frontend
• 1.3 MBthe iPhone app download
• 2.2 MBthe Mac app download
• 0.21load average of the whole production fleet on 2 vCPUs

Hand-measured on the production fleet, July 2026. They drift a little every release; treat each as “about”.

Against the privacy specialists

The features page compares Eleven with the apps regular people actually use. You’ll want this table instead — every pillar of the Eleven model exists somewhere in this landscape; the bet is the combination.

Snapshot as of July 2026 — these projects ship fast; corrections welcome.

Run it yourself

Self-hosting is a right here, not a dare: one binary, a €4-a-month box, about ten minutes, certificates and updates handled for you. It has its own page, with the actual commands.

Watch it run

The live fleet — capacity, services, versions rolling out — is public at status.elevenmessenger.com, part of the openness charter. The philosophy of building this way is The Eleven Factors — a serious parody of 12factor.net.

And yes, obviously: zsh.