End-to-end MLS encryption
Built on the IETF standard RFC 9420: keys live only on participants' phones and are renewed every time the group changes. Post-quantum cipher suites are available.
Invitation-only network · end-to-end encryption
The messenger whose server sees nothing
Cifrela encrypts every message on your phone using the MLS protocol. The server only relays ciphertext and has no keys to read it.
Download for Android
iPhone — coming later (via TestFlight)
Signature
c6328dc3787830c0461a9b33ae2e2cc35a70805ee82285cabd5050ce37bf72f6
File
5800c2dbc74a4307377ac67dad7a21bbd6e3102326d7c5262186068441d1649d
SHA-256 of the signing certificate and of the file. Check them against the server owner's message or softsoledgeit.com — not against this page.
Invitation-only network
You can sign up with your email or with an invitation from a friend or the administrator. Every participant's key is certified by the authentication service, so nobody can quietly take the place of the person you're talking to.
Wipe everything
A single action deletes your account on the server and all data on your phone, beyond recovery. The server keeps ciphertext for 30 days at most.
How to install on Android
- Download the APK with the button above and wait for it to finish. Android 8.0 or newer is required.
- Open the file
cifrela.apkfrom the notification or from your Downloads folder. - Allow installs from unknown sources if Android asks: Settings → Apps → Special app access → Install unknown apps → your browser → “Allow from this source”.
- Play Protect may warn you about an unknown developer — this is a test build: “More details” → “Install anyway”.
- Sign up: pick a username in Latin letters, enter your email and the code we send you (or an invite code), and create a PIN.
The update won't install (“App not installed”, “package conflict”)? Don't uninstall the app — your keys and history would go with it — and contact the server owner through another channel: this happens when the file was signed with someone else's key.
The old “Chopik MLS” test build is a separate app: Cifrela installs alongside it. Chats and accounts are not transferred.
To check the file: sha256sum cifrela.apk; the signature, on a computer: apksigner verify --print-certs cifrela.apk. Compare the values with the server owner's message.
Open on your phone
Point your phone's camera at the code to open this page.
https://chopik.softsoledgeit.com/
Verify with an independent source
This page comes from the same server as the app, so it proves nothing: a compromised server would show forged values here. The genuine ones are in the server owner's message (sent through another channel) and on softsoledgeit.com:
- SHA-256 of the signing certificate — proves the owner signed the APK;
- the full fingerprint of the authentication service (AS) — the app shows it after you sign up.
If anything doesn't match, don't use the app and contact the server owner through another channel.