End-to-end encryption
Every message, file, and call is encrypted on your device before it ever touches the network. Only the people in the chat hold the keys — not us.
See it in action
Now available for macOS
Encrypted messaging that leaves no trace.
Postal Pigeon encrypts every message and file end-to-end, stores nothing on our servers, and permanently deletes the entire conversation the instant the last person leaves the chat. Nothing to seize. Nothing to leak. Nothing left behind.
Servers are provisioned, ready when you are.
Perfect — sending the last of the assets now.
Got them. Encrypting locally before I forward anything.
This chat and every file in it disappear the moment everyone leaves.
Features
Privacy that isn't a promise — it's architecture.
Every design decision in Postal Pigeon removes a place where your data could sit, wait, or be found.
Self-destructing chats
The moment the last member leaves a conversation, every message, file, and key associated with it is permanently and irreversibly erased.
Nothing stored in the cloud
Messages pass through our relays, never rest on them. No backups, no message history on a server, no metadata warehouse to subpoena.
Built for macOS, not ported to it
A native menu bar app with Touch ID unlock, system notifications, and Handoff support — fast, quiet, and completely at home on your Mac.
Open, verifiable protocol
Our encryption protocol and clients are open for independent audit, so "trust us" is never the only option you have.
No metadata trail
We don't log who talked to whom, when, or how often. There's no social graph sitting on a server waiting to be mined.
How it works
Every conversation has a lifecycle. Postal Pigeon lets it end.
Keep scrolling — the formation behind this section is the conversation itself, forming, holding, and then disappearing for good.
01
Encrypted on your device
Before anything leaves your Mac, it's sealed with keys only the chat's members hold.
02
Delivered, never stored
Our relays pass encrypted data straight through — nothing is written to disk, logged, or cached.
03
Gone when the room empties
When the last participant leaves, the chat and everything in it is wiped instantly and permanently.
Security
The details, for people who check the details.
Postal Pigeon combines a Signal-style double-ratchet key exchange with AES-256 payload encryption and per-device key rotation. Keys are generated and stored in the macOS Secure Enclave whenever available — they never leave your device, encrypted or otherwise.
- X3DH-style key agreement, forward and future secrecy
- AES-256-GCM for message and file payloads
- Per-conversation ephemeral keys, rotated automatically
- Local storage encrypted at rest, tied to your Mac's Secure Enclave
- Zero-knowledge relay infrastructure — we can't read what we can't see
What people are saying
Trusted by people who think about this for a living.
"I stopped worrying about where our design files end up. When a project chat closes, it's actually closed — not archived somewhere I forgot about."
"I looked at the protocol before I recommended it to my team. Forward secrecy, no server-side plaintext, nothing lingering after a chat empties — it holds up."
"We run a fully remote team and half our conversations involve things we shouldn't still have a record of a year later. Postal Pigeon made that a non-issue."
Pricing
Simple pricing. No data-mining business model.
Postal Pigeon doesn't sell attention, contacts, or metadata — so the pricing page is refreshingly boring.
Personal
Free
- Unlimited 1:1 and group chats
- End-to-end encrypted files up to 2 GB
- Self-destructing chats, always on
- Native macOS menu bar app
Most popular
Pro
$4.99/month
- Everything in Personal
- Unlimited file size
- Custom retention windows per chat
- Priority relay routing
FAQ
Questions worth asking.
Is Postal Pigeon really free to use?
Yes. The Personal plan covers unlimited encrypted chats and files up to 2 GB, permanently, with no ads and no data resale. Pro adds larger files, custom retention, and priority routing for people who need it.
What exactly happens when the last member leaves a chat?
The moment the last participant leaves, Postal Pigeon revokes every key tied to that conversation, wipes any queued data on our relays, and clears the local copy on each device that already left. There's no "trash" or recovery window — deletion is immediate and unrecoverable by design.
Can Postal Pigeon or a third party read my messages?
No. Messages are encrypted on your device before they're sent and decrypted only on the recipients' devices. Our relays only ever see encrypted bytes — we don't hold the keys, so we can't read the content even if compelled to.
Is the encryption protocol open to review?
Yes. Our protocol specification and client source are published for independent audit. We'd rather you verify our claims than take our word for them.
Do you have apps for Windows or Linux?
Yes — Postal Pigeon ships natively for macOS, Windows, and Linux. Grab the right installer for your platform from the download section above. An iOS/Android release is on the roadmap.
What are the system requirements?
macOS 13 Ventura or later (Apple Silicon & Intel), Windows 10 or later (64-bit), or most modern 64-bit Linux distributions via the AppImage. All builds update themselves in the background.
Now live · Beta
One link. Every device. Zero installs.
On a locked-down work laptop, a library computer, or someone else's machine? Postal Pigeon runs entirely in the browser — the same end-to-end encryption, the same self-destructing chats, and nothing left behind once the tab closes.
Full end-to-end encryption
Loads in seconds
Works on any OS or browser
Launch the Web App
postal-pigeon.duckdns.org
Say it. Then let it go.
Postal Pigeon is free to download and free to use with the people who matter — on macOS, Windows, or Linux.