Your keys never leave your device.
Keys are generated in your browser using libsodium. They are encrypted with a password you choose (Argon2id + XSalsa20-Poly1305) before being stored. No Morphit server ever sees them.
Security posture
What we promise, and what that means for you.
Zero tracking.
No cookies. No analytics. No third-party scripts. No telemetry. Your IP address reaches the server you use, as with any website; Morphit's code keeps it only in memory for rate limiting and never writes it to disk or a log. Look at the Network tab in your browser.
A node can run with zero clearnet.
An operator can run a Morphit node that never touches the clearnet internet. Chain reads and upgrades travel over Tor and I2P; BTC/XMR fee checks and prices come from onion services (block explorers, Haveno and Bisq price servers) and from other Morphit nodes; an upgrade is installed only if it matches the hash @morphit signed on chain. Even the server's own system stays off clearnet: package updates go through Tor, and the clock is set from onion services. The software refuses clearnet, and a firewall lets only Tor and I2P out; if plain Tor is blocked, the node switches to bridges by itself. The node claims zero clearnet only when its own checks pass, and other nodes show that as the instance's own claim: they cannot verify it. (Someone watching the server's line can still see that it runs I2P.)
Chat is end-to-end encrypted.
Every message is encrypted in your browser before it leaves (X25519 and ChaCha20-Poly1305, from libsodium), with a fresh one-time key mixed with both of your chat keys, so only you and your partner can read it, and your partner knows it really came from you. No server holds a key that opens it. Your partner's key is pinned: if it ever changes, Morphit stops and asks you first, and a 60-digit safety number lets you check each other outside Morphit. What stays public is the envelope: messages live on the Blurt chain, so who wrote to whom, when, about which order and how long each message is are visible, and there is no forward secrecy. The full design is in docs/adr/0015-chat-crypto.md.
Signed, fingerprinted releases.
Every release is built from a GPG-signed git tag on main, and @morphit anchors it on the Blurt chain: the SHA-256 of the source tarball and of the offline bundle, and the hashes of the files that start the website (page shell, service worker, entry code). Your browser reads that signed record straight from a public Blurt node, not from this site, re-checks the files this site served against it, and names any that differ in a red warning; a node installs an upgrade only if it matches. That catches a file changed by accident or by a partly compromised server; it cannot protect you from a hostile operator, who serves the checking code too. There is no Subresource Integrity on the scripts, and builds are not yet byte-for-byte reproducible, so you verify a download by its hash and signature (docs/VERIFY-YOUR-DOWNLOAD.md), not by rebuilding it.
Open-source, open threat model.
The full threat model is in the repo's docs/SECURITY.md. We're explicit about what we protect against and what we don't — because pretending otherwise would be worse than honesty.
Bug bounty program
We run a discretionary security recognition program. Every actionable finding gets reviewed by a real engineer, gets an answer, and — if it materially improves Morphit's security posture — gets rewarded in BLURT (paid from @morphit-fees) or BTC, scaled to severity and the report's quality. No fixed tier table; case-by-case adjudication. Hall of fame credit available even when payment isn't. The full scope, severity guidance, payment workflow, and what we won't do (no NDA, no exclusive disclosure) is documented in docs/SECURITY.md.
Warrant canary
We publish a weekly warrant canary signed with the operator's PGP key. The canary explicitly declares no NSL / FISA / gag-order / backdoor demand has been served. Freshness proofs include a current blockchain head, a current Bitcoin chain head, and a current news headline (proves the canary cannot be pre-generated). If the canary stops updating for more than 14 days, treat it as silent: the operator may be under coercive pressure, and you should switch to a different federated operator.