Open-source, end-to-end encrypted relay
Encrypted on the sending device. Deleted from the relay once delivered.
ZeroByte moves private data, such as health and medical records, between two devices that were paired with each other, for example a phone and a laptop. Every update is encrypted on the device that sends it, with a key the relay never receives. The relay passes the sealed envelope on and deletes it once the other device has collected it.
-
No accounts
Two devices pair once, on the local network. Nobody signs up or signs in.
-
No request logs
No cookies, no analytics. Load is counted per app, anonymously: no mailbox names, tokens or IP addresses.
-
No keys on the relay
Every update is sealed on the device that sends it. The relay cannot open it.
How it works
How two devices exchange data
Two devices pair once and agree a key. From then on, every update is sealed on the device that sends it, and the relay only holds it until the other device has collected it.
-
01
Pair
Two devices pair once, in the same room or on the same network: a QR code or a comparison of digits on both screens. They agree a 32-byte link key. It stays in each device's keychain and is never sent to the relay.
-
02
Seal
From the link key, each device derives a mailbox name, an access token and one encryption key per direction (HKDF-SHA256). Every update is sealed with ChaCha20-Poly1305 before it leaves the device. A replayed or altered envelope fails to open.
-
03
Pass
The relay holds a sealed envelope until the other device collects it. The reader deletes what it has read. A mailbox without a write for 30 days erases itself, and unpairing deletes it at once.
Use cases
For data the servers in between shouldn't read
-
Sports performance
An athlete's phone holds training and health data. The team's sports scientist analyses it on a Mac, with models that run locally. ZeroByte carries it from one to the other.
-
Health
A patient's app sends readings to the clinician's device. The relay holds them sealed until they are collected, then deletes them.
-
Private AI on your own hardware
A phone sends data to a model running on its owner's computer and gets the answer back. No cloud service sees the question or the answer.
-
Sync without a backend
A phone and a laptop, or a tablet and a watch, keep an app's private data in step: each sends only what it changed, and both merge it into the same state. There is no server that stores it and no account to protect.
Relay
What the relay can and cannot see
The relay can see
- Which app a mailbox belongs to
- A random 128-bit mailbox name
- The size and time of each envelope
- The IP address of each connection
- A push token, if the app registers one
The relay never receives
- Health, medical or any other private data
- Names, emails or phone numbers
- Device names
- The link key or any key derived from it
Your users create no account and sign in to nothing. The relay keeps no request logs and sets no cookies. It counts requests and bytes per app, anonymously, without mailbox names, tokens or IP addresses. An envelope is capped at 1 MiB, a mailbox at 32 MiB.
On relay.zerobyte.cloud, the hosted relay, Cloudflare's storage also keeps a 30-day history of each mailbox so that it can be recovered after a failure. It holds the same sealed envelopes and nothing more, so a pruned envelope may stay there, still sealed, for up to 30 days. A relay you run yourself keeps whatever its own storage keeps.
Protocol
Built from open standards
The two devices agree their key once, at pairing, on the local network. After that, every update is sealed and checked with algorithms published as open standards: HKDF (RFC 5869) and ChaCha20-Poly1305 (RFC 8439). The relay only stores and forwards sealed envelopes. It has no key to open them with, and nothing to keep once they are delivered.
Optional extensions add push notifications that carry no content, and a live channel two online devices can use to set up a direct, peer-to-peer connection. Messages on that channel are sealed with keys of their own. A push registration is stored encrypted, and the relay can open it only while a request presents the mailbox token.
Timeline v1, in every SDK, keeps one keyed state on both devices over the same sealed envelopes. Each device sends only the keys it changed, as commits ordered by a hybrid logical clock, so both copies end up the same whatever order the commits arrive in. A device that is new or lost its copy catches up from the other, a long catch-up over several syncs, and a sync with nothing new to send writes nothing. The relay sees nothing it did not see before.
| Part | What it uses |
|---|---|
| Key agreement | At pairing, on the local network |
| Key derivation | HKDF-SHA256 |
| Encryption | ChaCha20-Poly1305, one key per direction |
| Replay protection | Sequence numbers in the authenticated header |
| Retention | Until read; idle mailboxes after 30 days |
| State sync | Timeline v1: commits ordered by a hybrid logical clock; the latest change to a key wins |
| Extensions | Push (APNs and FCM), live signalling, STUN/TURN for peer-to-peer |
| Signal frames | ChaCha20-Poly1305 under separate keys, within a 5-minute window |
| Push at rest | AES-256-GCM, keyed from the mailbox token |
Protocol specification Envelope format Timeline v1 Test vectors
Open source
Open source, with a relay you can run yourself
The protocol, the relay and the SDKs are public on GitHub. You can read every line that handles an envelope, check the test vectors against your own implementation, and run the relay on your own server, in Docker or on your own Cloudflare account. relay.zerobyte.cloud runs the same code as a hosted service: register your app in the console and point the SDK at it.
| Repository | Contents | Licence |
|---|---|---|
| zerobyte-protocol | Specification and test vectors | CC BY 4.0 |
| zerobyte-relay | The relay, for Node, Docker or Cloudflare Workers | AGPL-3.0 |
| zerobyte-swift-sdk | iOS, iPadOS, macOS, watchOS, tvOS, visionOS | Apache-2.0 |
| zerobyte-android-sdk | Android and the JVM, in Kotlin | Apache-2.0 |
| zerobyte-js-sdk | Browsers, Node, Deno, Bun, Workers | Apache-2.0 |
| zerobyte-dotnet-sdk | Windows and .NET 10 | Apache-2.0 |
| zerobyte-docs | Guides, references and samples | CC BY 4.0 |
Pricing
Hosted for you, or run it yourself
| Plan | Price | Includes |
|---|---|---|
| Personal | €9 a month | One app and 250,000 envelopes a month on relay.zerobyte.cloud, with pushes through your own APNs and FCM keys. Writes pause at the allowance until the next month. |
| Pro | €19 a month | Five apps and a million envelopes a month, then €10 for each further million. Never cut off. |
| Your own relay | No charge | The same relay under AGPL-3.0, on your server, in Docker or on your own Cloudflare account. No limits but yours. |
Both hosted plans can be cancelled at any time. An envelope is one sealed message of up to 1 MiB. Prices include no VAT; where VAT is due, the customer accounts for it.
Contact
Where to report bugs and ask questions
| Topic | Where |
|---|---|
| Bugs and questions | Open an issue in the repository it concerns |
| Security | Report privately from the repository's Security tab |
| Anything else | hello@zerobyte.cloud |