Documentation & FAQ

How does Qubit work?

Qubit is a post-quantum messenger that uses only symmetric cryptography. It does not use asymmetric cryptography (e.g. RSA, ECC, Diffie-Hellman), which would be vulnerable to quantum computer attacks. Messages are encrypted with AES-256-GCM on your device; the server only stores the ciphertext and never has access to it in plain form.

Why is Qubit post-quantum?

Quantum computers (when fully realised) will be able to break widely used asymmetric schemes. Qubit does not use them at all. Key exchange is done in person (offline), and only a shared symmetric key is used for encryption. Symmetric algorithms (e.g. AES-256) are considered resistant to quantum attacks with an appropriate key length.

How does key exchange work?

Two people must meet in person. Each generates a unique “conversation nickname” in the app and shares it with the other. Then both parties agree on a shared key (min. 16 characters, letters, digits, hyphen) and enter it in the app. This key is used to encrypt and decrypt messages. The key is never sent over the network; in the production version only the app on your device stores it.

Why are my data secure?

The server never receives message content in plain form. You only send an encrypted blob (IV + ciphertext + tag) to the server. Decryption happens only on your device, in the iPhone or Android app, using the key that only you and the recipient know. Even the server administrator cannot read the messages.

Keys in the mobile app

In the Qubit mobile apps (iOS and Android), encryption keys are stored only on your phone, in the operating system’s secure storage (Keychain or Android Keystore). They are never sent to the server or to any cloud service. Even if the server were compromised, your keys remain protected — this is the strongest security model for offline key exchange.

How long are messages kept?

A message is deleted from the server 30 days after the recipient's device has collected it. A message that was never collected is kept — deleting something that never arrived would destroy it before it was ever delivered. Deletion removes the single copy, so it disappears for both of you. If you would both rather keep a conversation permanently, each of you turns on “Keep full history” in that channel's settings; it takes both, because the message belongs to both of you. Turning it off again applies only from then on — anything already kept under your agreement stays.

What does the tick next to my message mean?

One tick means the other person's device has downloaded the message. That is all the server can honestly tell you: it sees a device collect the encrypted data, never whether a person read it. There is no second “seen” tick, because there is nothing truthful to base one on.

Voice messages

You can record and send a voice message of up to two minutes. It is encrypted on your device with the same key as your text messages, so we cannot listen to it. Receiving and playing voice messages is free for everyone and always will be; sending them is part of Qubit Pro, a subscription available in the app.

Message content limitations

For simplicity and consistency:

• Character encoding: All characters used in European languages are supported – letters with diacritics (ą, ł, ó, ö, ü, ä, é, ñ, ç, ß, đ, etc.), digits, and punctuation.
• Length: Maximum 1000 characters per message.
• Voice messages, but no files: You can record and send a voice message (up to two minutes). Files, images and other attachments are not supported.
• No group chats: Communication is only between two people.
• No reactions: There are no emoji or message reactions.

FAQ