With no signal at all a message hops from phone to phone over Bluetooth until it reaches the person it is for. That took about an hour in testing.
End-to-end encrypted via the Signal Protocol · X3DH + Double Ratchet · see the crypto →
Messages go from one phone to the other with no company server in between. Encryption does not take the message back out of their phone.
X3DH and a Double Ratchet, against Signal's published spec.
Your identity is an Ed25519 key pair made on the phone, and if you lose the phone the key goes with it, the way an SSH key does.
ECIES-encrypted mail between Whispr users, with threads and reply-all.
On the same Wi-Fi the phones talk straight to each other.
A Tor hidden service reaches someone who is not on your network. One message from Germany to India landed in under a minute. The first message of a session waits while the circuit builds.
Each hop is short, but a phone that receives a message passes it on, and nobody in the chain can read it. Tested twice under 5 km it arrived in about an hour, then in an hour and twenty-five minutes. The route is whatever devices happen to be in between, so that time is not something anyone controls.
Android only, and you will be sideloading the APK, so Android warns you before it installs; if you want to check the signature it should read CN=Whispr, not CN=Android Debug. There is no iOS build.
Full release history: changelog
USING WHISPR WHERE TOR IS BLOCKED
Some networks block Tor. If your messages don't deliver, install Whispr and open Settings → Network → Bridges. Tap the (i) icon there for a step-by-step guide to setting up bridges for your region.
The guide is in the app because a network that blocks Tor can block this website too.
Whispr does not use any home-made cryptography. It is Signal's published design, implemented from their spec.
IN PROGRESS
obfs4 hides Tor traffic from deep-packet inspection by making it look like random bytes; vanilla bridges shipped in v1.1.14 and obfs4 was meant to follow in v1.1.15, which it did not.
IN PROGRESS
None of this works yet. Latency over Tor and NAT traversal without a relay are both unsolved.
PLANNED
Rotating the key when someone leaves is the unsolved part. Everything else is a shared group key derived between the members.
PLANNED
Per-message timers that delete on both devices when they expire, though a screenshot beats them.