XRPL Token Services

Sign in · Sign up

XRPL Message

Encrypted messaging carried inside XRPL transaction memos.

Read this before you install it

This is an experiment, not a product, and it is not part of the paid services on this site. It is published here so it can be tried on a real phone.

  • It runs on XRPL devnet only. It does not touch mainnet and cannot move real XRP. The Batch amendment it depends on is not active on mainnet until 29 September 2026.
  • No cryptographer has reviewed it. The protocol is built from standard pieces — X25519, Ed25519, XChaCha20-Poly1305, a Double Ratchet — but assembling standard pieces correctly is exactly where this kind of software usually fails. Assume it is broken in some way nobody has found yet.
  • Do not use it for anything that matters. Not for anything private, and not for anything you would be harmed by losing.
  • It is a debug build, signed with a debug key. Android will warn you that it comes from an unknown source. That warning is correct and you should not learn to ignore it.

What it does do: messages are split across several payments inside one all-or-nothing Batch transaction, scattered over a shared pool of accounts that every user reads, so the server answering those queries learns who is online but not who talks to whom. Message contents are end-to-end encrypted with forward secrecy.

Download

Download xrpl-message-debug.apk 13.8 MB · Android 8.0 or newer

SHA-256, so you can check the file is the one that was built:
e9126aa971ed5fc21a80c7d7e156332c1a17fb0be693dd35377c6ddf371572ca

QR code linking to this page Scan with the phone to open this page on it
Somebody to message

A devnet account exists purely so there is someone to message while testing. Its messaging key is published, so the app can open a conversation with it.

rwNBZCjdDESkDeUuZgVhNQ3DT2A2T2uXNL

Scan the code with the app, or paste the address into the Send to field. It answers, echoing your message back, so you can see a whole round trip rather than just a transaction leaving. Replies are rate limited, and it is not private: whoever runs it can read what you send it.

QR code containing the test account address The test account address
Installing it
  1. Tap the download above on the phone.
  2. Open it from your notifications or the Downloads folder.
  3. Android will refuse the first time and offer a settings screen. Allow installs from the browser you used, then tap the file again.
  4. Open XRPL Message. It creates a fresh devnet account on first run, which starts empty — the Account screen shows the address so it can be funded from a devnet faucet.

The app asks for one permission: internet access. It talks to a single XRPL node and nothing else.

What it does not do yet
  • Conversation history is held in memory. Closing the app loses the ability to read earlier messages — that is forward secrecy working as designed, but it does mean history does not survive a restart.
  • Cover traffic hides how much you send, not when. Real conversation arrives in bursts and the decoys do not, so timing analysis could still separate them.
  • Starting a conversation with someone new looks up their address, which tells the server you are interested in it. Messages with people you already know cost no such lookup.
  • Removing someone from a group is not instant. Until every remaining member has re-keyed, they can still read what is sent.
  • The account seed is encrypted with a key held by the phone, but unlocking the phone is not required to use it.