End-to-end encryption

In a chat with end-to-end encryption, a message is locked on your device before it leaves, and only the devices of the person you're writing to have the key to unlock it. On the way, and while it waits on our servers, it is unreadable.

The keys are made on your devices and stay there. Zynkrow's servers only pass the locked messages along.

In an end-to-end encrypted chat, Zynkrow can't read your messages — not our staff, not our systems, and not anyone who gets into our servers. We can't hand their contents to anyone, because we don't have them.

What we still see is what we need to deliver a message: who is writing to whom, and when. If you report a message, the copy you choose to send us is checked against a tag that proves it's genuine; we see only what you report.

Every end-to-end encrypted chat has its own security code: 60 numbers, also shown as a QR code. You and the other person see the same code, worked out from both of your keys.

If the codes on both screens match, your messages go only to them, and nobody is quietly sitting in the middle. You don't have to check it to be protected — encryption is on either way — but checking it is how you can be sure.

When you open Verify encryption, Zynkrow checks the chat for you. Every time someone adds or removes a device, their new set of keys is written into a public key log that can only grow — entries are never changed or removed. Each log state is signed, and your app keeps the last one it saw.

Your app checks three things: the log is signed by Zynkrow's log key built into the app, it has only grown since your app last looked, and the keys your app encrypts to — yours and the other person's — are the ones in the log. If all three hold, you'll see End-to-end encryption was automatically verified, with the time it was checked.

This means Zynkrow can't quietly give your chat a different key without writing it into that log for good, where the owner's own devices see it too. If the check can't be completed, the screen says so — use one of the other ways below.

Open the chat, tap the menu, and choose Encryption (or open the person's info and choose Encryption). Under Other ways to verify encryption:

Scan a QR code. When you're together, open it on both phones and scan the code on their screen. On a computer without a camera, you can upload a photo of their code instead. The share button sends your code as a picture.

Compare a 60-digit number. Read the 60 numbers to each other — in person, or on a call where you know their voice. If every group matches, the chat is verified.

When the codes match you'll see Verified, and a small Verified badge stays in the chat's bar. If they don't match, the code may be from a different chat, or an old one: ask them to open the screen again and check the code they see now.

The code changes when either of you adds a new device, removes one, or sets up secure chats again — for example after reinstalling the app or signing in on a new browser. A line in the chat tells you when it happens, and a chat you verified shows Security code changed — verify again.

Usually this is harmless: they got a new phone. If you weren't expecting it, check with them in another way (a call, or in person) before sharing anything sensitive, and verify the new code.

Your keys live on your devices. If you lose every device, you need a way to get your secure chats back on a new one — that's what these are for.

Recovery code. Made automatically when secure chats start on your account. Download it or copy it and keep it somewhere safe and offline. Zynkrow can't read it and can't make it again for you.

Two-step verification PIN. An optional 6-digit PIN you choose. It protects signing in on a new device and can bring your secure chats back. After too many wrong tries it locks for a while.

You can also choose trusted contacts who can approve getting your chats back. A new device first asks one of your existing devices to approve it; if you don't have one, it asks for your PIN, then your recovery code, then your trusted contacts. Forgetting your PIN never opens your chats for anyone else.

One-to-one chats turn on end-to-end encryption by themselves. Your keys are made the first time you open Zynk Chat on an updated app or browser, and a chat switches over as soon as both of you are set up. A line in the chat shows where it started.

A chat is only encrypted when every device either of you uses can read it. If one of you is still signed in on an older version of the Zynkrow app, messages would never show up on that phone — so new messages are sent the normal way instead, and the chat says so: “<name> is using an older app — messages aren't end-to-end encrypted right now.”

To turn it back on, update the Zynkrow app on that phone, or sign out of it. An older app that hasn't been opened for 30 days doesn't hold a chat back.

These travel over an encrypted connection between your device and Zynkrow and are stored on our own servers in India, but they are not end-to-end encrypted, so Zynkrow can read them:

End-to-end encryption is available for every account and turns on by itself in a 1:1 chat once both people are on the latest Zynkrow. Some features aren't available in secure chats yet; those messages are sent the normal way. An independent security review of our encryption is being arranged.

If something looks wrong — a code that won't match, or a message that won't open — write to support@zynkrow.com. We can help with your account, but we can't read your secure messages.