Qor Chat

Why Qor?

Qor exists because normal "secure messaging" still leaves too much behind. Many apps encrypt message contents, but the server can still learn phone numbers, account identifiers, contact lookups, delivery patterns, recipient routing, reconnect behavior, IP metadata, and social graph edges.

Qor is built around a stricter idea: the server should carry encrypted traffic without learning who you are, who you search for, who you talk to, or what you say.

It uses post-quantum cryptography, private discovery, anonymous authentication, blind routing, Tor transport, sealed envelopes, and global mix delivery to remove metadata from the protocol instead of asking users to trust that it will not be abused.

Who is this for?

Qor is for people and communities who want messaging that treats metadata as seriously as message contents.

It is for privacy-focused users, developers, researchers, journalists, organizers, self-hosters, security-conscious teams, and anyone who does not want their identity, contacts, searches, or conversations mapped by a central service.

Qor does not require phone numbers, does not upload address books, and does not build messaging around server-visible user handles.

It is also for people who want control. Qor is designed as infrastructure you can inspect, run, and reason about, with a single security-focused runtime and fail-closed privacy systems instead of optional weaker modes.

What makes it different?

Qor combines protections that most messengers do not combine in one system.

Messages use a layered cryptographic stack: LibSignal Double Ratchet with post-quantum PQXDH, hybrid ML-KEM-1024 + X25519 encryption, ML-DSA-87 signatures, sealed-sender envelopes, fixed-size padded transport frames, and post-quantum WebSocket sessions. When peer-to-peer delivery is available, Qor can send over a mutually authenticated post-quantum QUIC path so the server is not involved.

Discovery is private by design. Qor uses OPRF so the server cannot see the username being searched, computational PIR so it cannot see which record is fetched, and encrypted discovery blobs so only the client can decrypt the result. The server does not learn who you looked up or whether the lookup succeeded.

Routing is also different. Active sends do not include a username, phone number, inbox ID, route ID, mailbox ID, bucket, shard, or destination selector. The sender submits only an opaque sealed envelope into a global mix. Messages are delayed, shuffled, mixed with cover writes, and later trial-decrypted locally by clients. The server can move encrypted blobs, but it cannot tell who they are for.

Authentication avoids stable identity leakage too. Qor uses OPAQUE for password authentication, anonymous Privacy Pass tokens for unlinkable reconnects, blind routing credentials, rotating rendezvous commitments, encrypted block lists, and encrypted avatar delivery through uniform-size private blobs.