Every privacy tool has limits. A tool that hides them isn't one you should trust. Here are ours, in plain language — so you can decide what Night Drop is right for, and what it isn't.
Night Drop is built so that we can't read your messages, map who you talk to, or hand over data we never keep. That part is structural — it holds even if we're compelled. But no messenger can protect you from everything. The honest boundaries below fall into three groups: things that are out of scope by design, things only you can control, and where the app is still being hardened.
These aren't bugs to be fixed; they're the edges of what any software of this kind can promise. We'd rather say so than pretend otherwise.
If malware or spyware with deep access is on your phone or computer, it can read what you type and see on screen before Night Drop ever encrypts it. No app can defend against a fully compromised device from inside that device. Keep your device updated and uncompromised — that's the foundation everything else rests on.
Night Drop routes over Tor to hide the network path. A powerful global observer who can watch huge portions of the internet at once might, in theory, correlate traffic timing and volume to link the two ends of a conversation. We pad message sizes to blunt this, but defeating a global passive adversary is an open problem for Tor itself, not something we can solve alone.
Your identity lives only on your device — that's the anonymity guarantee. If you lose the device and never made a backup, those chats are gone, and no one (including us) can recover them. Night Drop offers optional encrypted backups so you can choose recoverability; the default is that there's nothing to recover.
Night Drop hides what you send and who you send it to. It doesn't hide from your own network that you're using Tor at all. In places where using Tor is itself risky, that's a separate consideration — bridges and pluggable transports help, and are on our roadmap.
Some things are simply outside any app's reach, because they live on the other person's side or in your own choices.
End-to-end encryption means only the two of you can read a message. It can't stop the other person from taking a screenshot, keeping their own backup, or showing someone their screen. When they turn on server storage or keep a backup of your chat, Night Drop shows you a clear, persistent warning — because privacy you can't see isn't privacy. But trust between two people is still between two people.
On screenshots specifically: we don't block them — blocking only moves someone to photographing the screen with another phone, which no app can detect. Instead, when the other person screenshots your chat, you're told. Read the limit carefully: only Android 14 and later can report a screenshot at all. On older Android, on desktop, for screen recording, and for a camera pointed at the screen, the capture is silent. No notice is not evidence that nothing was captured.
Encrypted backups are protected by a recovery password shown to you exactly once and never stored anywhere. That's what keeps a backup safe from us and everyone else — and it means if you lose the password, you lose the backup. We can't reset it, because we never had it. Write it down somewhere safe.
Disappearing messages and delete-for-everyone remove content from both devices, but they can't un-see what someone already read, photographed with another camera, or remembered. Physical-world observation is always outside the software.
Secure Folder is a separate user account, and Android freezes the apps inside it while it's locked. A copy of Night Drop kept there isn't running, so it receives nothing until you unlock the folder and open it — the sender sees the message held, not delivered, however long that takes. Turning on background delivery inside the app can't change this.
Your messages are no less private there — arguably more so, since nothing reaches the lock screen. What you give up is knowing when someone has written to you.
Night Drop is open source and built on audited cryptography libraries, but the app itself is young. We'd rather you know exactly where it stands than trust a superlative.
The cryptography is built on well-reviewed libraries (the same Double Ratchet family used by Signal, the Tor project's own Rust implementation, and vetted password and encryption primitives), and the security-critical code is isolated in a single Rust core. But the app as a whole has not yet had an independent security audit. Until it has, we won't claim more than that — and we'll publish the audit and its fixes when it's done. Treat Night Drop as promising and improving, not battle-tested.
The app lock encrypts your messages. It does not yet cover the file that holds your own Tor address, or the one folder Tor keeps per contact — each named after their address. Someone who takes your phone and copies its storage can read that list without breaking any encryption, and without your PIN.
As of 0.1.15 those entries no longer pile up: deleting a chat removes that person, and logging out or using the wipe code clears the lot. What remains exposed is the identity you are using right now, and the contacts you currently have. We are working on moving those into the encrypted store too; until that ships, assume a seized phone shows who you have been talking to.
Messages sent while you are offline wait on a relay. From 0.1.26 each chat drops them in its own mailbox, under an address that changes every day, and your phone collects them in small groups over separate Tor connections, padded with mailboxes that do not exist. So a relay can no longer tell that messages from different people, or from different days, are for the same person.
What it can still tell: that messages in one chat on one day belong together; which mailboxes your phone collects as one group (about seven contacts at most); that a mailbox checked for weeks and never used is probably padding; and a burst when you send to several people at once. A chat whose other side runs a version before 0.1.26 keeps the old, fixed address in both directions until they update, and you will see a notice in that chat. The limit of 50 contacts is what keeps those groups small; it is enforced by the app, not the protocol. And offline messages rely on your clock: if it is wrong by more than three hours, a message can go to a mailbox nobody checks and expire unread after 24 hours. Messages delivered directly are unaffected.
If your network blocks Tor by blocking the public list of relays, a bridge is an unlisted way in. If it instead inspects traffic and blocks Tor by how it looks, that needs a WebTunnel bridge — Tor carried inside ordinary HTTPS to a normal-looking web server, with a TLS handshake matched to Chrome's.
What we have measured, on our own network: with every route except that one web server blocked at the router, Night Drop still connected and published its address; with the bridge removed under the same block, it could not build a single circuit. An intrusion-detection system carrying 52,311 public signatures, over a thousand of them for Tor, raised nothing and saw only ordinary TLS.
What we have not done is run it from inside a country that filters this way. Public tooling is a much weaker adversary than a national firewall, and one thing is not disguised at all: the shape of the traffic. A connection that pulls tens of megabytes while sending very little does not look like reading a web page, however ordinary the handshake is. If being identified as a Tor user is itself dangerous where you are, do not rely on this alone.
The full messaging flow is verified end to end in automated tests, and the Tor path has been exercised over the live network. Broad testing across many real devices, networks, and conditions is still underway. Expect rough edges on flaky connections.
When both people are online, messages go directly, device to device. Offline delivery and first-contact short codes lean on a relay that holds only sealed, unreadable blobs. You can add extra relays or run your own, so no single one is a choke point — and we're expanding the default set for resilience.
Photos and videos are stored sealed on your device. To play a video in your phone's built-in player, we briefly write a decrypted copy to an app-private, owner-only folder — other apps can't read it — and wipe that folder on logout and on the next launch. While the external player has the file open, and until that cleanup runs, a decrypted copy exists on disk. Viewing an image in-app never writes plaintext out.
The part of the encryption that protects message contents already has a strong margin against future quantum computers. The initial key-agreement handshake is classical today, like most messengers — there's no live threat, but a well-resourced adversary could record traffic now to try to decrypt it years from now. Our plan for closing that gap is documented publicly rather than glossed over.
Within those honest limits, Night Drop is designed so that we hold no key to your messages, keep no logs, and store no account that could be seized or subpoenaed. Any server only ever sees sealed, unreadable blobs under short-lived, unlinkable handles. You have no phone number or email tied to your identity, you approve who can reach you, and your history lives on your device by default. That's the deposit box: sealed, dropped, and opened by no one in between.
Read the full design and threat model in the open — the source and documentation spell out every claim on this page, including these limits.