Off-network messenger
Taftan
ENFA
TaftanVersion 1.0

Encrypted message transferwithout networkdependency.

Taftan moves encrypted messages between two phones without needing the internet. It works through sound, through a screen, or hidden inside an ordinary photograph. No SIM card, no Wi-Fi, no account required. When the only available network cannot be trusted, the message travels inside a photo that looks completely normal to anyone who sees it.

  • 01Same room, no network: the acoustic channel sends the message through the device speaker.
  • 02No shared location: embed the message inside a photo and send it through any messaging app.
  • 03Screen to camera: display encoded frames on one screen and scan them with the other camera.
  • 04Every message is encrypted with AES-256-GCM before it leaves the device.
Download the applicationView a transfer demonstration
Acoustic range
Up to 8 m
Channels
Three
Encryption
AES-256-GCM
Platforms
Android + iOS
Same roomAcoustic channel carries the message
۹:۴۱

Channel 01

Sound

Device B (receiver)

Sent in under a secondSending

Password

Point 01

Device A (sender)

Point 02

Encrypted with the shared password

Point 03

Device B (receiver)

Data over sound

Two devices, one room, no network required.

Read more→
AB

Data over camera

One screen displays encoded frames; the other camera captures them.

Read more→
FRAMES 47 / 64

Hidden in a photo

The message is concealed inside an ordinary photograph and sent through any platform.

Read more→
seed:apple lakeHIDDEN MESSAGEAddress arrives at 21:00. Bring the key.
Purpose

Some messages cannot go through the internet.

When the internet is unavailable, when the messaging app is being monitored, or when the room you are in is the only safe path, Taftan provides a channel that still works.

  1. The internet is not always there when you need it.

    Outages, throttling and deliberate shutdowns happen without warning. Taftan does not need a network connection. The acoustic properties of the space around you are enough to carry a message.

  2. Not every messaging app can be trusted.

    When the platform you have access to is being monitored, Taftan encodes your message inside a photo or an audio clip and delivers it through that same platform. Anyone watching sees only an ordinary photo or voice note.

  3. Some information must never travel in plaintext.

    Passwords, recovery phrases, addresses and authentication codes all need protection. Taftan encrypts every message with a password you choose before anything leaves the device.

  4. Built for ordinary people, not just technical ones.

    Open the app, pick a channel, write the message, send it. Three options on one screen. No configuration required.

Three channels, one application

Choose the channel that fits the situation.

Taftan covers same-room transfer, screen-to-camera transfer and concealment inside a messaging platform. Every channel applies encryption before sending.

AB

Acoustic

01Acoustic
Two devices, one room, no network required.

Data over sound

The sending device plays a modulated audio signal through its speaker. The receiving device captures it through its microphone and reconstructs the message. Both devices use the standard speaker and microphone that come built into every phone. No Bluetooth pairing, Wi-Fi or SIM card involved. It works in basements, on planes and anywhere with no network signal, as long as both devices can hear each other.

Strong points

  • Effective from close range up to about eight metres under normal indoor conditions.
  • Three operating modes: audible standard, resilient for noisy environments, and ultrasonic for when silence is required.
  • Automatically falls back to resilient mode when ambient noise is high.

Trade-offs

  • Both devices need to be within hearing range of each other.
  • Throughput is approximately 20 to 100 bytes per second depending on the mode. Not suitable for video or large files.

When to useTwo people in the same location. In-person meetings. Moving data between two devices. Any situation where nothing should travel over a wired or wireless network.

Modes inside this channel

  • AudibleA

    A modulated signal in the human-audible range (roughly 1.5 to 2.5 kHz). The highest throughput of the three modes. Best for quiet environments.

    + Highest throughput- Audible to anyone nearby
  • ResilientB

    A lower-frequency signal with enhanced forward error correction. Designed for noisy places including traffic, background conversation and general ambient noise.

    + Noise-tolerant- Reduced throughput
  • UltrasonicC

    A signal above the human hearing range (roughly 18 to 20 kHz). Nobody in the room can hear it. Throughput is equivalent to the audible mode.

    + Inaudible to humans- Speaker variation may reduce effective range
View technical details→
How a transfer works

Four steps to move a message from one device to the other.

The process is the same for every transfer. Switching channels is a single tap.

  1. 01

    Compose the message.

    Plain text, a password, a recovery code or a file from device storage. The acoustic channel handles a few kilobytes; the optical channel handles larger files.

  2. 02

    Choose a channel.

    Acoustic, Optical or Steganographic. Taftan suggests the most appropriate option for the current context, but the choice is always yours.

  3. 03

    Agree on a shared password.

    Share it with the other person through a separate channel beforehand: face to face, on paper or by voice. The password is the one element an observer cannot intercept.

  4. 04

    Send. The other device decrypts.

    Play the audio signal, show the screen or send the photograph. The receiving party points their device at the source or opens the photo in Taftan. The message comes through.

Taftan runs without an account, without registration and without a server. Nothing in the app records who sent what to whom or when it was used.

Documented use cases

Six real situations where Taftan is the right tool.

These are documented uses, not hypothetical ones.

01Network outage, Tehran, January

Internet connectivity is unavailable across the country.

Problem

A family member needs a working VPN address before the end of the evening. All messaging apps are offline. There is a printed reference sheet and a phone in hand.

With Taftan

The address is entered into Taftan, the acoustic channel is selected, a shared password is set and the device plays the signal. The receiving device, sitting two metres away on the table, decodes it.

Outcome

The address is received in under a minute. No SIM card contacted the network. No server logged anything. The two devices handled the exchange entirely on their own.

02Counter separated by glass, Istanbul

Handing over the device is not possible.

Problem

Two people are separated by a counter and a glass partition. The device cannot be passed through, and speaking clearly over the ambient noise is not practical.

With Taftan

The optical channel is opened. The sending device displays a moving grid of encoded frames. The receiving device holds its camera facing the screen for about ten seconds. The frames are captured and decoded.

Outcome

Six kilobytes of a signed PDF, including an attached photograph, arrived correctly on the other device.

03Monitored messaging application

Sending in plaintext is not safe.

Problem

A wallet seed phrase needs to be shared. The only working messaging app scans every photo and message for content flagged by the platform operator.

With Taftan

An existing photo is selected, the steganographic channel is opened, the seed phrase is pasted in, a password is set and Taftan produces a new photo that is visually identical to the original. The photo is sent through the messaging app.

Outcome

The receiving party opens the photo in Taftan, enters the password and the seed phrase is there. The messaging app received only a photo. The seed phrase was never exposed.

04Airport departure gate

The device is in flight mode and the gate area is loud.

Problem

A colleague needs a booking reference and is standing nearby. Bluetooth pairing is impractical and the gate Wi-Fi requires a login.

With Taftan

The acoustic channel is opened in Resilient mode. The reference is transmitted as a modulated signal over the ambient gate noise.

Outcome

The reference came through correctly despite the background noise. No pairing or network configuration was needed.

05Air-gapped device

A signing device must stay offline.

Problem

A hardware signing device is kept offline intentionally. A transaction needs to go in and a signed transaction needs to come out, with no network connection at any point.

With Taftan

Taftan on the online device displays an optical frame grid. The offline device captures it with the camera. The offline device then displays its own frame grid in response. The online device records it.

Outcome

Data crossed the air gap in both directions. The offline device stayed disconnected from every network throughout.

06Quiet environment requiring silence

No acoustic output is permitted.

Problem

The situation demands silence. Using a USB cable in front of others is not ideal.

With Taftan

The acoustic channel is set to Ultrasonic mode. A short signal above 18 kHz is transmitted through the speaker. Nobody in the room can hear it.

Outcome

The receiving device, on the same surface, decodes the signal. No audible disturbance.

Platform compatibility

Choose a channel that works with your messaging platform.

If you need to send through a messaging app, this table shows what each platform does to the attached file. Pick the row, column and mode accordingly.

OKTransmitted without modification. Use Silent mode.

LossyUse Robust mode. Capacity will be reduced.

NoSelect a different channel for this platform.

PlatformPhoto (default)File / documentVoice note
SignalOKOKLossy
TelegramLossyOKLossy
WhatsAppLossyOKNo
Instagram DMLossyn/aNo
iMessageOKOKLossy
EmailOKOKOK

Most messaging platforms re-encode voice notes, so the acoustic channel rarely survives transmission in voice note form. For those scenarios, send the audio as a file attachment or use the steganographic channel instead.

Security architecture

Encrypted before it leaves the device.

Nothing is transmitted until the message has been encrypted with a key that only the sender and receiver know.

Taftan uses AES-256-GCM, the same cipher used by banks, government agencies and commercial password managers. Encryption converts the message into data that cannot be read without the correct password.

Before it becomes the encryption key, the password goes through PBKDF2-HMAC-SHA256 with 100,000 iterations. Every guess an attacker makes requires repeating all 100,000 iterations. A long, unpredictable passphrase makes exhaustive search computationally out of reach.

The password never leaves the device. Taftan sends nothing to any server, because no server exists. Every part of the application runs entirely on the user's device.

  • What an observer intercepts

    Noise on the speaker. A grid of tiles on a screen. A photograph that looks exactly like any other photograph.

  • What Taftan never stores

    The password. The original message. The recipient identity. The time of transmission. Nothing that connects the sender to the receiver.

  • What you must keep safe

    The password. Lose it and the message is permanently gone. Taftan holds no master key, and there is no server to hold one.

Encryption process

  1. 01

    You compose a message

  2. 02

    Taftan derives an encryption key from the password using PBKDF2-HMAC-SHA256

  3. 03

    AES-256-GCM encrypts the message using the derived key

  4. 04

    The chosen channel transmits the encrypted data

  5. 05

    The receiving device decrypts the data using the same password

  6. 06

    The original message appears on the receiving device

Download

Install Taftan on your mobile device.

No account. No registration. No telemetry. Download and start immediately.

01

Android

Signed APK file. Install through the standard sideloading process on any device running Android 9 or later. Grant microphone permission for the acoustic channel and camera permission for the optical channel when prompted.

v1.0.1 / arm64-v8a + armeabi-v7a / 18 MB

02

iOS

Available through TestFlight while App Store review is in progress. Requires iOS 15 or later. Permission prompts appear the first time you use each channel.

v1.0.1 / iOS 15 or later / 22 MB

03

Desktop (forthcoming)

macOS, Windows and Linux builds run the same Taftan core inside a native application window. Useful for air-gapped scenarios where one party uses a laptop or workstation.

macOS arm64, Windows x64, Linux x64

Frequently asked questions

Technical and operational questions.

Direct and complete answers.

01Does Taftan require internet connectivity?

No. The acoustic and optical channels work with no network at all. The steganographic channel only needs the messaging app you use to send the photo, which is entirely optional. Two phones in a basement with no signal is exactly the scenario Taftan was built for.

02Must both devices have Taftan installed?

Yes. The receiving device needs the app to decode the audio signal, the screen frames or the hidden message in the photo. It is free to download.

03Will an observer be able to detect that a message is concealed?

When using the steganographic channel through a messaging app, the other party receives only a photograph. There is no visible sign and no metadata marker. Proving the presence of hidden data requires a specialised forensic tool. Robust mode is designed specifically to resist that kind of analysis on common social platforms.

04What happens if the password is lost?

The message cannot be recovered. Taftan does not keep a copy of the password and there is no recovery option. Write it down somewhere safe before transmitting anything critical.

05Is this application lawful to use?

Taftan is software for the private transfer of messages between two people who have agreed to communicate. It uses standard microphone, camera and display hardware and applies encryption that is legal in the vast majority of jurisdictions. The user is responsible for the content of every message sent.

06Is the source code available?

Not currently. The code is proprietary. The technical specification describing how messages are encoded and decoded is documented separately, so an independent security researcher can verify a complete transfer end to end. Open-sourcing under a permissive licence is being considered.

07Can my messages be recovered?

No. Taftan does not run any server in the transfer path. All encryption and channel operations happen on your device. Nobody has visibility into any message, and nothing can be retrieved after the fact.

08Which devices are supported?

Android 9 and later. iOS 15 and later through TestFlight. Desktop builds for macOS, Windows and Linux are in development.

Get started

Two devices. One shared password. No intermediary.

Install Taftan on both devices, agree on the password through a separate channel beforehand, and run a quick test transfer using whichever channel fits your situation.

Download the applicationRead the documentation