OtherMobile application · Communication platform · API/backend
End-to-end encrypted mobile messenger
We built a privacy-first encrypted messenger for Android and iOS, with Signal-protocol encryption for chats and groups, encrypted media and local storage, voice and video calling, push notifications and self-expiring messages. Delivery ran in the client's own repository under daily code review.
Problem
The client wanted a Signal-style secure messenger with phone-number onboarding, strong end-to-end encryption, encrypted local storage and real-time calling, delivered into its own repository under its own code review.
Solution
The team built a Flutter app on a Clean/BLoC-Cubit architecture and a Dockerized Fastify backend migrated from JavaScript to TypeScript, with MySQL, Valkey and Centrifugo for real-time messaging. Messages use the Signal protocol (X3DH and Double Ratchet, sender keys for groups), media is AES-encrypted before upload to S3 via presigned URLs, and history is kept in an encrypted local database. WebRTC calling, FCM and SNS push notifications, map-based location sharing and self-expiring messages driven by Valkey sorted sets and a background worker completed the feature set.
Key features
- Phone-number OTP onboarding, hashed PIN, recovery codes and auto-login
- Signal-protocol end-to-end encryption for one-to-one and group chat
- Client-side encrypted media uploads with presigned URLs
- Encrypted on-device message storage with offline sync
- Voice and video calling over WebRTC with call history
- Push notifications via FCM and SNS
- Read receipts, unread counts, pin, archive, delete and search
- Contact sync and invites
- Map-based location sharing
- Scheduled self-expiring messages
- Privacy settings modelled on leading secure messengers
Tech stack
- AWS S3
- AWS SNS
- AWS SSO
- BLoC
- CallKit
- Centrifugo
- Cubit
- Dart
- Docker
- Drift
- Fastify
- Flutter
- GetIt
- GitHub
- Google Maps API
- JWT
- Kafka
- LocalStack
- Miro
- MySQL
- Node.js
- SQLite
- Sequelize
- Twilio Verify
- TypeScript
- Valkey
- WebRTC
- bcrypt
- docker-compose
- flutter_secure_storage
- injectable
- libsignal_protocol_dart
- libsodium
- ngrok
- socket.io
- sqlite3_flutter_libs
Services behind this project
Read more
22SEPHow to choose a software development company
How to choose a software development company: an honest checklist for comparing vendors on evidence, estimates, team, code ownership and how they handle risk.
Process5 min read
22SEPFlutter vs React Native: choosing a cross platform framework
Flutter vs React Native compared on architecture, performance, UI, native features and team skills, with a checklist to pick the right framework for your app.
Engineering5 min read