Security · last updated 28 August 2026

What B3 encrypts — and what it does not

B3 is a private encrypted messenger. Messages, calls and files are sealed on your phone with post-quantum end-to-end encryption before they reach any server. B3 cannot read them. There is no key escrow and no plaintext fallback. This page is the honest version, not the brochure.

What is B3?

B3 is an Android messenger (with a desktop web client) whose identity is a cryptographic key generated on the device — not a phone number, not an email. You add people by QR code or ID. The public service runs at bfree.st, hosted in Switzerland. Organizations can run the same stack on their own servers.

Does B3 have a backdoor?

No. There is no key escrow, no silent extra recipient, and no path that sends a readable copy to the server. If B3 cannot encrypt a message to a verified key, it does not send it. A lawful request to the operator can yield routing metadata. It cannot yield message contents, because those exist on the server only as ciphertext the operator cannot decrypt.

How does the encryption work?

Each conversation is established with PQXDH: a hybrid of X25519 and ML-KEM-1024 (NIST FIPS-203). That initial agreement is what stops a “harvest now, decrypt later” attack on archived handshakes. After that, a Double Ratchet gives every message its own key (forward secrecy). Bodies are AES-256-GCM. Call media is DTLS-SRTP.

The ratchet itself is classical, the same class as Signal’s PQXDH. A future cryptographically relevant quantum computer that broke X25519 could attack ongoing ratchet state. It could not unlock the initial hybrid handshake.

What lives on your phone

• Identity keys in the Android Keystore (StrongBox where the hardware exists). They are generated there and never exported.
• Chat history in a SQLCipher database. The passphrase is derived from your app PIN and a hardware-bound key. A seized, rebooted phone does not open the database without the PIN.
• A duress PIN and a panic control that wipe identity, sessions, the database and its key.
• An encrypted vault and a local calendar that are not synced to any cloud.

What the server stores

B3 is not a pure in-memory relay. When you are offline, ciphertext is held so the message can be delivered later, then purged. Identifiers in the database are HMAC-SHA256 hashes, not raw IDs. Public prekey bundles are public keys only. Contact-request payloads are sealed to the recipient.

Retention is short — hours, not months. Burn-after-read messages are deleted after they are read. This is a policy the operator enforces. End-to-end encryption is what protects contents if that policy is broken.

What we do not claim

• Metadata privacy is not mixnet-grade. To route a message the server must know that two hashed accounts exchanged traffic, and when. Sealed payloads hide who the sender is inside the envelope. They do not hide that an exchange happened. If your threat model is the operator, or a compelled operator, this is the largest gap.
• The protocol has not had a third-party cryptographic audit. B3 implements PQXDH + Double Ratchet itself (libsignal is AGPL). It is covered by tests and cross-language vectors. Until an independent audit, do not treat it as one.
• The web client trusts the operator by construction. The browser downloads the JavaScript from our server. Whoever controls that server can ship code that reads plaintext before encryption. Use the Android app when that matters. Signal and WhatsApp Web have the same structural limit.
• No Google does not mean no network. Delivery uses a co-signed companion app and a content-less wake. Your IP is visible to the TLS terminator unless you put a VPN or Tor in front.

Google, Apple, ads

The Android app does not use Firebase Cloud Messaging, advertising SDKs, or third-party analytics. Notifications are a wake on our own connection; the wake carries no message body. There is no Play Store listing required: you install the APK from bfree.st/download/B3.apk.

Transport pinning

The phone app trusts only B3’s private root certificate authority for ws.bfree.st. A publicly valid certificate from Let’s Encrypt or any other public CA is refused for that host. That protects the transport against a rogue public CA. Message content is protected by E2E even if the transport is hostile.

Groups

There is no server-side group object. A group is a roster on the clients. Each member gets their own pairwise encrypted copy. Only the owner may change membership, and every change is signed. A phone that cannot verify the signature ignores the change. Nobody can quietly add a silent reader.

This page matches the engineering security model. For what personal data is processed, see Privacy. To compare B3 with Signal, WhatsApp and Telegram, see Compare.