Raven. Messages straight to your friends. No server in between.

Scroll

Over one day, three friends message each other with Raven: Newton on a Mac, Max in the terminal app on Linux, and Lily on Windows. Some of the features shown are still in development.

Get Raven

Run it in your terminal today. The desktop apps are on their way.

Raven runs on your own computer and sends sealed messages straight to the computers of your friends, with no account, no phone number and no company in the middle.

  • Open source under AGPL 3.0
  • iPhone and iPad app today
  • Runs in the terminal too
  • Not independently audited

Run it in your terminal

Available today

Build Raven from source on Linux, Windows or macOS, then run it. Four commands, and the Copy button copies all four:

raven · build from source
git clone https://github.com/Raven-ASHCO/raven-core.git
Gets the Raven source from GitHub
cd raven-core/node
Goes into its node folder, the Rust workspace
cargo build --release --locked -p ash -p raven-node
Builds the raven command and the Raven node: a few minutes the first time
./target/release/raven --help
Shows every command

You needGit, Rust (current stable, installed with rustup) and a C compiler: the Xcode command line tools on macOS, gcc on Linux, the Visual Studio Build Tools on Windows. On Windows, run the commands in PowerShell.

This builds the raven command, with the Raven terminal app and the classic menu, and the Raven node that carries your messages. A release build sends messages between computers on the same local network. Every command, step by step → Source on GitHub →

Download the app

Raven for iPhone and iPad is on the App Store. Native desktop apps for macOS, Windows and Linux are in development, on the same engine as the terminal app. Their source is on GitHub, but they have no installers yet.

  • iPhone and iPad

    Raven 3.0, free on the App Store. Needs iOS or iPadOS 18 or later.

    Available todayApp Store →

  • macOS

    A native SwiftUI app, on the same engine as the terminal app.

    In developmentSource on GitHub →

  • Windows

    A native WinUI 3 app, on the same engine as the terminal app.

    In developmentSource on GitHub →

  • Linux

    A native GTK 4 app, on the same engine as the terminal app.

    In developmentSource on GitHub →

The film

The concept film, moment by moment

96 seconds, silent: over one day, Newton on a Mac, Max in the terminal app and Lily on Windows message each other. It shows Raven with the whole roadmap finished. Pick a moment to play the film from there.

Eighteen moments to play from
What the film shows, and where it stands today
In the filmToday
The full screen terminal app, used by MaxAvailable in source today
The Mac app, used by Newton, and the Windows app, used by LilyIn development, nothing to download yet
Sharing a card to add a friendAvailable in source today
Ten security words and the check wordAvailable in source today. The word list is not final
"Delivered" only after a signed receiptAvailable in source today, on a local network
Messages over the internetBuilt, off in release builds
Post quantum linksPlanned. Not in the current terminal path
Waiting, with a deadline in local timeAvailable in source today, on a local network. Waiting longer than a day is off in release builds
Messaging over the WiFi in the building with the internet downAvailable in source today when the local address of your friend is saved
Finding a friend on a new network by itselfBuilt, off in release builds
Encrypted storage, chat deletion, Lock nowAvailable in source today. Locking while Raven keeps running is off in release builds
Raven passphrase and lock when the computer sleepsBuilt, off in release builds
Max carrying a sealed message for Newton overnightBuilt, off in release builds
Bluetooth nearby (shown only as a setting)In development, off in every build. Source: Mac, Windows, Linux

The film is a concept film. Nothing in it is a recording of a released build.

Why Raven

What Raven does for you

Each point says where it stands: available in the public source today, partly available, or still in development.

  • Straight to your friends

    Your message goes from your computer straight to the computer of your friend. No company server receives it, stores it or passes it on.

    Partly available

    Today: works between computers on the same local network. Internet paths are in development.

  • No account. No phone number.

    Raven creates your identity on your own computer. There is nothing to sign up for: no email address, no phone number and no username to register.

    Available today

    In the public source for Linux, Windows and macOS.

  • Ten words prove it is really your friend

    You and your friend read ten short words to each other on a call or in person. If they match, nobody swapped the key on the way. The tenth word is a check word that catches a misheard or swapped word.

    Partly available

    In the public source today. The word list is a draft and may still change.

    A frame from the Raven concept film: on a call, Newton on the Mac app and Max on the terminal app each see the same ten security words.
    CONCEPT FILM07/18 SECURITY WORDSTen words. Read them aloud.0:34

  • Delivered means delivered

    Raven says Delivered only after the computer of your friend sends back a receipt signed with its key. Until that happens, the message shows as not delivered yet.

    Available today

    In the public source, on the local network path.

  • Keeps working without the internet

    If the internet goes down, friends on the same local network, such as the WiFi in one building, can keep messaging from computer to computer.

    Partly available

    Today: works when the local address of your friend is saved in their contact. Finding friends on a new network by itself is in development.

    A frame from the Raven concept film: with the internet down, Newton keeps messaging Max from the Mac app over the WiFi in the building.
    CONCEPT FILM13/18 NO INTERNETWorks without the internet.1:03

  • Friends carry what they cannot read

    If your friend is away, a friend you both trust can hold a sealed copy and hand it over when they are back. The friend carrying it cannot open it, and it only happens if both of you have agreed to it.

    In development

    Works in lab tests. It stays off in release builds until it passes real world checks.

  • Encrypted on disk. Gone on schedule.

    Raven encrypts what it keeps on your computer, including chats, contacts and saved addresses. It deletes old chats after the time you choose and forgets addresses it has not used in 30 days. You can also lock it when you step away. Deleting removes chats from your computer only, and your friends keep their copies.

    Partly available

    In the public source today. Locking while Raven keeps running is off in release builds.

The apps

Raven in your terminal. Raven on your desktop.

The same engine runs underneath both. The terminal app and the desktop apps use the same Raven code, so it does not matter which one a friend uses.

A frame from the Raven concept film: the welcome screen of the full screen terminal app, with the Raven mark drawn in braille dots.
CONCEPT FILM01/18 TERMINALA full app in your terminal.0:04

Linux · Windows · macOS

The terminal app

Type raven and a full screen app opens. It has a first run setup, a friends list with honest status ("in touch 5 min ago", never a guess at "online"), chats with delivery marks, adding a friend with security words, a network panel and settings. It starts the Raven background node for you. The classic menu and every command are still there.

In the public source

The install below builds it, together with the classic menu and every command. Source on GitHub →

A frame from the Raven concept film: Newton on the Mac app, Max on the terminal app and Lily on the Windows app, side by side.
CONCEPT FILM18/18 EVERYWHEREMac, Windows, Linux. Same Raven.1:27

macOS · Windows · Linux

Desktop apps

Native apps for each system: SwiftUI on macOS, WinUI 3 on Windows and GTK 4 on Linux. The screens and wording are the same everywhere, and each app fits its own desktop. A menu bar or tray icon shows that Raven is listening, and a message reads "Sent, not confirmed yet" until a signed receipt comes back.

In development

The apps build and pass their tests on all three systems. Setup, adding a friend and messaging have not been tried end to end yet, and there are no installers. There is nothing to download yet. Source on GitHub: Mac, Windows, Linux.

How it works

From your computer to your friends, in six steps

This is the path that runs in the public source today, on a local network. These are the commands of the raven command line. The Raven terminal app, which opens when you type raven alone, walks you through the same steps, and the desktop apps will too.

  1. Create your identity

    Raven makes your keys on your computer. The private key stays there, in the protected key store of your system: the Keychain on macOS, a DPAPI protected file on Windows, and an unlocked desktop keyring or a passphrase protected vault on GNU/Linux.

    raven init

  2. Swap cards with your friend

    Raven prints a one line card with your public address, key and fingerprint. Send it to your friend, they add it, and you add theirs. Messages only arrive between people who have added each other.

    raven whoami --card
raven contact add --card '<card line>' --petname Lily

  3. Check it is really them

    Your friend reads their ten security words to you on a call or in person, and you type them. Raven pins their key only if every word matches. A name or @tag is only a label on your computer. The key is what counts.

    raven contact verify Lily

  4. Listen

    The receiving computer runs the Raven listener on the local network, so friends who have added you can reach it. Finding friends on a new network by itself is off in release builds, so each of you saves the local address of the other once.

    raven contact set-addr Lily --lan 192.168.1.31:7420
raven listen

  5. Send

    Raven sets up an authenticated session with the computer of your friend, seals the message on yours and sends it as a signed RVN1 envelope. If a secure session cannot be set up, Raven does not send. It never falls back to plain text.

    raven send --contact Lily --chat

  6. Get the signed receipt

    On the computer of your friend, Raven checks the envelope, opens it and sends back a receipt signed with its key. Only then does Raven mark the message delivered. Until that happens it stays queued, and a queued message is no proof that it arrived.

    raven inbox
raven status
Every command, step by step →

The protocol

RVN1 and ATSAM, in plain words

Raven is an open protocol first. RVN1 is the envelope a message travels in. ATSAM is the security protocol that decides who can open it. A specification describes the design. What actually runs depends on the build.

RVN1: the envelope

Every message travels as an RVN1 envelope. The device of the sender signs it and seals it for the recipient. Each envelope has an ID, so duplicate copies are dropped, and a limited lifetime, so it does not travel forever. The same envelope can go over different paths: a local network today, and later the internet, the computers of friends and Bluetooth as each is finished. A relay can pass an envelope on without having the keys to open it.

A frame from the Raven concept film: the terminal of Max holds a sealed receipt for Newton, signed by Lily, while the Mac of Newton is locked.
CONCEPT FILM16/18 FRIENDS CARRYFriends carry what they cannot read.1:18
RVN1 envelopefixed 86 byte prefix · then header, body, signature
0x00magic "RVN1"4
0x04version1
0x05env_type1
0x06flags2
0x08message_idduplicate copies are dropped16
0x18routing_tagrotating tag16
0x28dest_device_hint8
0x30created_at8
0x38expires_atlimited lifetime8
0x40hop_limit1
0x41replication_budget1
0x42anti_replay_nonce12
0x4Ehdr_len2
0x50body_len4
0x54auth_len2
0x56ratchet_header_ciphertexthdr_len
…message_ciphertextsealed for the recipientbody_len
…sender_authenticationsigned by the device of the sender64
The RVN1 wire layout from the public specification, one dot per byte. Hollow dots mark the three fields a relay may change on the way. They are left out of the signature. The two ciphertexts change length with each message, so their dots fade out.

ATSAM: the Raven security protocol

ATSAM is how two Raven computers come to trust each other and keep what they say private. It covers everything between "add a friend" and "message delivered": how the two agree on keys, how they recognis each other on a network without announcing who they are, how each proves it is really there right now, and how sealed messages are passed on by computers that cannot read them. Raven sends nothing without it: a message goes out only inside an authenticated ATSAM session with that friend.

In current builds: the local network path pairs with the hybrid exchange of ATSAM and keeps one ATSAM session per friend, with signed receipts. It has not had an external security review yet. The other paths, the next session version and Vault Mode are still off.

Five layers, one job each

  1. Hybrid pairing

    This is how two computers agree on keys. ATSAM combines X25519 with ML KEM 768, a post quantum method, and needs both: an attacker would have to break each of them. The current local network path pairs this way.

  2. Private peer discovery

    Paired computers recognis each other without broadcasting a fixed identity. How well this works depends on the carrier.

  3. Live peer confirmation

    A fresh chllnge proves the other side is there right now, which helps reject replayed discovery messages.

  4. Encrypted forwarding

    Relays pass sealed envelopes on using rotating tags. Timing and connections can still be visible.

  5. Optional Vault Mode

    One time pad protection that holds only under strict conditions: truly random pads that are long enough, shared securely and never reused. It is an option in the protocol. Do not assume the terminal build has it.

What Raven does not hide

Encryption hides what you say. It does not hide that you are talking. Someone watching the network can still see timing, message sizes, IP addresses and when a computer is reachable. Raven makes no promise of anonymity or guaranteed delivery. If someone controls your computer, or the computer of your friend, while it is unlocked, encryption cannot protect what is on the screen.

Read the ATSAM protocol → Security boundaries → RVN1 and ATSAM specifications on GitHub →

Install

Build it from source

Build Raven on Linux, Windows or macOS. You need Git, Rust and a C compiler for your platform.

source build
git clone https://github.com/Raven-ASHCO/raven-core.git
cd raven-core/node
cargo build --release --locked -p ash -p raven-node
  1. Get the Raven source from GitHub.
  2. Go into its node folder, the Rust workspace.
  3. Build the raven command and the Raven node for release, with the dependency versions locked.

The Cargo package of the raven command is named ash. The programs land in target/release. On Windows, run the commands in PowerShell; the programs end in .exe.

next: create your identity and check your setup
./target/release/raven init
./target/release/raven doctor
  1. Create your identity on this computer.
  2. Check your setup and see what to do next.

To keep the Raven node running as a login service and put raven on your PATH, use the install script for your system. The Commands page has it for macOS, Linux and Windows.

  • init needs a supported protected key store. On GNU/Linux without an unlocked desktop keyring, it asks for a passphrase that protects your key file. There is no recovery without that passphrase.
  • This builds the raven command, with the Raven terminal app and the classic menu, and the Raven node. The desktop apps are in their own repositories and have no installers yet.
  • A release build from this source sends messages only between computers on the same local network. The internet path, Tor, groups, friends who carry mail for each other and the long message horizon are lab features, off in those builds. The iPhone and iPad app of Raven 3.0 also goes over Tor.
  • A successful build does not make a node production ready. Read the install guide for your system before you set up a long running node.
Every command → Installation FAQ → Install guides on GitHub →

For agents

RDAP: signed tasks between trusted agents

Experimental

RDAP is the experimental companion of Raven for software agents. Agents that have pinned the keys of each other can send signed tasks and answers over A2A JSON RPC. Trust policy and replay checks run before a task is accepted.

  • Signed, not encrypted.

    A signature shows who sent a task, but it does not hide the task. Over plain HTTP, use HTTPS or another protected network.

  • Your model provider sees what you send it.

    If an agent uses a hosted model, the task text and any project context you allow go to that provider.

  • Separate from the Raven node for now.

    RDAP keeps its own keys. Sending RDAP tasks through the encrypted Raven node is in development and off in release builds.

The RDAP source will be on GitHub soon.

RDAP in plain words, with a film →
The end card of the Raven concept film: the Raven mark in braille dots above the word RAVEN.