Sealed end-to-end Coming soon for Windows, Linux and FreeBSD
Free for five accounts · Similar to WinRAR: pay once, or never. It keeps working.

Download Sigil

Sigil comes in two parts: a server you run, and a client your people install. Both will be free to download here. A server is free to use for five accounts, and one client for five servers.

Run the server

It routes sealed messages and holds them while a recipient is offline. A machine at home, a small VPS or a container will do.

PlatformPackage
Linux Tarball with an install script for systemd, OpenRC or SysV. Download soon
FreeBSD Native pkg with an rc.d service and log rotation. Download soon
Windows Installer that registers Sigil as a Windows service. Download soon
Docker The server image as a file: docker load -i it, no registry involved. Download soon

Install the client

Members install the desktop client, enter your server's address, and register on your server, never with Hyperion Labs.

PlatformPackage
Windows A standard installer. Download soon
Linux A single AppImage that runs across distributions. Download soon
FreeBSD Native pkg, packaged like the server. Download soon
macOS Not in version 1.0. Not available

Verify what you downloaded

Verify the downloadminisign and SHA-256

Every release ships SHA256SUMS and its detached signature SHA256SUMS.minisig, made with the Sigil release key, which is also at /minisign.pub. Check the signature first, then the checksum of the file you took, in the folder you downloaded to. A checksum file served from this host can be replaced together with the files it describes; the signature is made with a key that never touches this host.

Release keyRWT33MhWcPx/ue0R8tPxOkzbqhAiCaqyQoxcK06XBIPNgijloKpQeXRq

# Linux
minisign -Vm SHA256SUMS -P RWT33MhWcPx/ue0R8tPxOkzbqhAiCaqyQoxcK06XBIPNgijloKpQeXRq
sha256sum --ignore-missing -c SHA256SUMS

# FreeBSD (sha256sum is in the base system since 13.0)
minisign -Vm SHA256SUMS -P RWT33MhWcPx/ue0R8tPxOkzbqhAiCaqyQoxcK06XBIPNgijloKpQeXRq
sha256sum --ignore-missing -c SHA256SUMS
# Windows (PowerShell); the checksum loop checks whichever listed files are present
minisign -Vm SHA256SUMS -P RWT33MhWcPx/ue0R8tPxOkzbqhAiCaqyQoxcK06XBIPNgijloKpQeXRq
Get-Content SHA256SUMS | ForEach-Object { $h, $f = $_ -split '\s+', 2; if (Test-Path $f) { if ((Get-FileHash $f -Algorithm SHA256).Hash -ieq $h) { "OK      $f" } else { "FAILED  $f" } } }

minisign is a package everywhere: apt install minisign or pacman -S minisign on Linux, pkg install minisign on FreeBSD, and a release from github.com/jedisct1/minisign on Windows. SHA256SUMS lists every file of the release, so the lines for files you did not download are reported as missing; that is expected.

First run

First runThree steps
  1. Step 1 of 3

    Start the server

    Give it a TLS certificate. A self-signed one works, and the install guide shows how to make one.

  2. Step 2 of 3

    Create the first administrator

    Open the administration panel in a browser and set up the first administrator account.

  3. Step 3 of 3

    Choose who may join

    By invitation, by approval, or both. Then hand out the client and your server's address. Every download carries the setup and install guides, the TLS deployment guide, the security model and the wire protocol in its docs folder. Questions go to support@sigilchat.com.

  • No account with Hyperion Labs. Members register on your server, and the company keeps no database of the users on your server.
  • Your data stays put. Accounts and contacts live on your server, and message history on your members' own devices.

Paying can wait.

Similar to WinRAR: pay once and own it forever, or keep closing the reminder. Past five accounts Sigil asks, and nothing forces a payment.

How licensing works