Security and privacy
What Sigil protects and where the protection ends.
How messages are protected
CryptographySignal Protocol on libsodium
Signal ProtocolX3DH to agree on a shared secret, then the Double Ratchet to change keys with every message. The design Signal uses.
Forward secrecyKeys rotate constantly. A key stolen today opens neither yesterday's messages nor tomorrow's.
XChaCha20-Poly1305Authenticated encryption with a large random nonce.
libsodiumNo hand-rolled cryptography. Every primitive comes from libsodium, a widely used, audited library.
The server is a relay.
It moves sealed messages and holds them while a recipient is offline. It never has the keys to read them. A stolen database yields sealed bytes, not conversations.
Connecting, and signing in
IdentityTrust on first use
Certificate pinningThe client remembers the server's public key on first connection and refuses any other, as SSH does with known hosts. Self-signed certificates work, and renewing a certificate changes nothing, because the key is what is pinned.
Passwords hashed twiceHashed on the device before sending, and again on the server with a per-user salt. A stolen database cannot be replayed to sign in.
Keys encrypted at restPrivate keys are stored under your password with Argon2id, in memory that is locked against swap and wiped when the application closes.
DeniabilityMessage authentication rests on a shared key: your contact knows you wrote a message and cannot prove it to anyone else.
Limits of protection
Sigil is not anonymity software and does not hide metadata. If a threat model needs either, Sigil is the wrong tool.
Not protectedStated in full
Metadata is not hiddenThe server can see who talks to whom, when, and how often. The administration panel does not display it, but the data exists on the machine.
Accounts and membershipWho holds an account, who is whose contact, and who is in which conversation are known to the server.
Profile data is not sealedNames, statuses and pictures are visible to the server, which must show them to your contacts.
Not anonymityA member is identified by a username on a server someone runs.
A compromised deviceWhoever holds an unlocked, signed-in device reads what its owner reads. Lock the device and use the application's auto-lock.
Cooperative featuresDisappearing messages and recall depend on both clients. They are not a guarantee against a recipient who keeps a copy.
Opened attachmentsA received file, once opened, is cached unencrypted on that device. Full-disk encryption covers it.
Closed sourceThe implementation is not public. The protocol and the security model are, and an independent audit is planned.
Check the claims
Verify and reportsecurity@sigilchat.com
The full security model and the wire protocol are in the docs
folder of every download, with the reasoning behind each cryptographic
choice. Sigil has no auto-update and no telemetry, so the
advisories page and its
Atom feed are how an administrator learns
that an update matters.