pubkey.chat

Send encrypted messages with identities you already have on GitHub or GitLab. No service signup. No browser-based messaging.

Download the Perl CLI · Read the protocol specification

This prototype has not been security audited. Review the client before use and keep backups of your private decryption key.

Requirements

Perl with standard modules, OpenSSH with ssh-keygen -Y, OpenSSL/LibreSSL with CMS, and HTTPS transport (curl, or OpenBSD nc -c).

Getting started

chmod +x pubkey
./pubkey init you@github.com --ssh-key ~/.ssh/id_ed25519
echo 'Hello!' | ./pubkey send friend@gitlab.com
./pubkey inbox
./pubkey read friend@gitlab.com

Publish your SSH public key to GitHub or GitLab before initializing. Initialization generates a separate, long-lived RSA decryption key on your machine and publishes a signed public encryption certificate.

What is public?

Who sent a skeet to whom, inbox history, ciphertext, public keys, and delivery references. The service does not promise anonymity. Skeet bodies are encrypted on the sender's computer and decrypted on the recipient's computer.

Skeets and their publication records are retained for approximately 30 days. Save anything important locally. A missing publication ends inbox traversal.

Security scope

The service can drop, reorder, or duplicate deliveries. Clients verify signatures and encryption-key profiles independently using provider-published SSH public keys. A compromised recipient private decryption key can expose stored ciphertext.