DEV Community: Vardum (formerly VEIL)

What Vardum Messenger does, in 47 seconds

Vardum (formerly VEIL) — Fri, 23 Oct 2026 09:17:09 +0000

Disclosure: I'm the founder of Vardum.

I made a short video of what the messenger actually does: https://mastodon.social/@veil_im/117489419461816308

No phone number or email. Your account is 24 words that only you hold.
Messages are encrypted on the phone: a double ratchet with a hybrid X25519 plus ML-KEM-768 handshake, and a new key for every message.
The relay only passes on ciphertext. It holds no keys.
Messages can burn 5 minutes to 24 hours after they're opened.
In a one-to-one chat, nothing sends until both people confirm the safety code.

The cryptography is self-reviewed, with an independent audit planned for early 2027. Every claim and its limits are listed at https://tryvardum.app/claims/. The code is at https://github.com/VardumTechnology/Vardum, and the iPhone beta is free on TestFlight: https://testflight.apple.com/join/Aqay7XH2

Criticism welcome, especially on the crypto.

We've been quiet for four weeks. Here's what we built.

Vardum (formerly VEIL) — Wed, 21 Oct 2026 18:00:51 +0000

You've probably noticed we've been quiet lately. You'd be right, and here's why.

For the last four weeks we've been heads down, building the things you kept asking us for. Here's what we've done:

1️⃣ We rebranded. VEIL is now Vardum.
2️⃣ We open-sourced our code (AGPL-3.0): https://github.com/VeilPrivate/Vardum
3️⃣ We finished our final native beta build for iPhone. Join on TestFlight: https://testflight.apple.com/join/Aqay7XH2
4️⃣ We're now selling Google Pixel phones with GrapheneOS Hardened "Graph", set up and checked, with Vardum preloaded. From A$750: https://tryvardum.app/phones/
5️⃣ Android beta: only 12 spots for the first 14 weeks. Email matt@tryvardum.app to secure yours. Already on GrapheneOS Hardened "Graph"? The download link is here: https://tryvardum.app/android/
6️⃣ Vardum AI: local AI software that runs on the phone itself. It works with no internet connection, and your chats stay on your phone, never on a cloud AI or our servers. In testing.
7️⃣ Vardum Desktop AI: a local AI program for your own computer. In testing.

See it all on our new website: https://tryvardum.app

Our cryptography is self-reviewed, with an independent audit planned for early 2027. The AI products are in testing and not for sale yet. GrapheneOS is an independent open-source project; Vardum isn't affiliated with or endorsed by it.

For the technical detail: the messenger uses a double ratchet with hybrid X25519 and ML-KEM-768 key agreement, and every claim we make is listed with its limits on our claims register.

VEIL is now Vardum

Vardum (formerly VEIL) — Fri, 16 Oct 2026 16:51:56 +0000

VEIL is now Vardum. Because of trademark issues with the name Veil, we've rebranded to Vardum, ahead of our independent cryptographic audit planned for early 2027.

Same app, same team, same encryption. Your account, Vardum ID (formerly your Veil ID), contacts and conversations all carry over, and there's nothing you need to do. We're also building Vardum for Android.

Private messaging that stays private, even if someone has your phone.

Join the iOS beta: https://testflight.apple.com/join/Aqay7XH2 · https://tryveil.app

The cryptography is self-reviewed today; an independent cryptographic audit is planned for early 2027. Every claim is labelled at https://tryveil.app/claims

Secure October Day 16: Why your number is the leak

Vardum (formerly VEIL) — Fri, 16 Oct 2026 00:10:57 +0000

Secure October, Day 16: why your number is the leak. A phone number is a permanent identifier across every app that asks for it — searchable, subpoenaable, resold. VEIL asks for none: identity is a keypair generated on your device, rotatable in one tap. No number, no graph. #SecureOctober

Secure October: 31-day series for Cybersecurity Awareness Month. VEIL is E2E encrypted messaging with post-quantum hybrid key agreement (ML-KEM-768 + X25519) — no accounts, no email, no tracking. iOS beta in review with Apple.

VEIL is now open source — and running on our own infrastructure

Vardum (formerly VEIL) — Thu, 15 Oct 2026 11:51:52 +0000

Big VEIL news: we now run our own relay on infrastructure we own and operate, and the entire codebase is open source (AGPL-3.0) — crypto core, relay, protocol. Anyone can verify what we claim.

What's public and checkable today: X25519 + ML-KEM-768 post-quantum E2EE. Deleted means deleted — hard delete, zero rows. Burn-after-open enforced server-side. Nothing-at-Rest — a locked phone holds nothing to extract. Encrypted vaults with hidden volumes, private notes, steganography. Anonymous signup.

Every claim carries its test status at tryveil.app/claims — limits included: no independent audit yet (self-reviewed, the code is the proof), calls are same-network only today.

Read the code: github.com/VeilPrivate/VEIL

iOS beta: testflight.apple.com/join/Aqay7XH2

VEIL is a post-quantum E2EE privacy suite — messaging, encrypted vaults, private notes, steganography. No accounts, no email, no tracking.

Secure October Day 15: What October taught us

Vardum (formerly VEIL) — Thu, 15 Oct 2026 00:05:02 +0000

Secure October, Day 15, halfway: the month's theme in one line — 'stay safe online' usually means behaving carefully. Real safety means complying fully with nothing to extract. No accounts, no tracking, nothing at rest. That's the standard we build to. #SecureOctober

Secure October Day 14: Your 2048-bit key has an expiry nobody printed

Vardum (formerly VEIL) — Wed, 14 Oct 2026 00:09:28 +0000

Secure October, Day 14: your 2048-bit key has an expiry nobody printed. RSA-2048 is fine today and breakable on a future quantum machine — and recorded ciphertext waits. Hybrid ML-KEM-768 + X25519 in every VEIL handshake keeps today's messages sealed past that horizon. #SecureOctober

Secure October Day 13: Hide the file inside the picture

Vardum (formerly VEIL) — Wed, 14 Oct 2026 00:07:35 +0000

Secure October, Day 13: hide the file inside the picture. VEIL's steganography embeds encrypted text inside ordinary images — the picture opens like a picture; the payload doesn't exist unless you know where to look. Encryption keeps secrets; steganography keeps the secret that a secret exists. #SecureOctober

Secure October Day 12: Screenshots outlive the chat

Vardum (formerly VEIL) — Mon, 12 Oct 2026 00:05:59 +0000

Secure October, Day 12: screenshots outlive the chat. Ephemeral messaging promised disappearing; the other person's camera kept a copy. VEIL can't stop a camera — nobody can — so we say so plainly. Burn-on-open, hard-delete from both devices: what we can promise, we deliver. #SecureOctober

Secure October Day 11: Your cloud backup is the weak copy

Vardum (formerly VEIL) — Sun, 11 Oct 2026 01:55:00 +0000

Secure October, Day 11: your cloud backup is the weak copy. End-to-end encryption that ends at the backup isn't end-to-end. VEIL keeps keys and files on-device; the server stores ciphertext it can't read and nothing at rest to seize. The weak copy is the one you can't see. #SecureOctober

Secure October: 31-day series for Cybersecurity Awareness Month. VEIL is E2E encrypted messaging with post-quantum hybrid key agreement (ML-KEM-768 + X25519) - no accounts, no email, no tracking. iOS beta in review with Apple.

Secure October Day 10: Plausible deniability isn't paranoia

Vardum (formerly VEIL) — Sun, 11 Oct 2026 01:54:59 +0000

Secure October, Day 10: plausible deniability isn't paranoia. When a vault exists, its absence is itself evidence. VEIL's decoy vaults are indistinguishable from the real one - there is always something ordinary to find. You comply fully; there is nothing to extract. #SecureOctober

Secure October Day 9: Duress codes, explained

Vardum (formerly VEIL) — Fri, 09 Oct 2026 09:01:33 +0000

Secure October, Day 9: duress codes, explained. One code wipes. A second code opens a decoy — a real, working VEIL with nothing sensitive in it. Under coercion you can comply fully and still protect what matters. It's a documented seizure scenario, not paranoia. #SecureOctober