Messaging and conversations
End-to-end encrypted messaging for any size of conversation. Text, voice messages with playback controls, replies, emoji picker, bookmarks. Conversations persist across devices and synchronize live as peers type.
Drag-and-drop photos, documents, anything. Each attachment is encrypted client-side before it leaves your device, then synced to every participant in the conversation.
Translate messages in-thread to your preferred language. Convert any message into a task with one tap. AI features run against your AI provider, on your keys.
Content in uChat is inside the end-to-end encrypted envelope: it is encrypted in your browser before it is transmitted, and the server stores ciphertext it holds no key for.
All authentication and key exchange uses NIST-standardized ML-DSA-65 (FIPS 204) signatures and ML-KEM-768 (FIPS 203) key encapsulation. There is zero RSA, zero elliptic-curve, zero classical-only crypto in the authentication path. Defeats store-now-decrypt-later attacks.
Every payload is encrypted in your browser using XChaCha20-Poly1305 (RFC 8439) with a 192-bit nonce and a Poly1305 authentication tag. The plaintext exists only in your tab's memory. When you close the tab, the plaintext is gone.
For uChat content the server only ever stores ciphertext and public keys. It cannot decrypt your data — by architecture, not by promise: there is no backdoor, no master key and no key escrow, because no key that would open it ever reaches the server.
Your private keys are derived in your browser from three secrets only you control, and are held in memory for the session only — never written to browser storage, never sent to the server. A new device derives the same keys locally from the same three secrets.
UltimaOS runs in any modern browser — Chrome, Firefox, Safari, Edge. Nothing to install. Sign in by re-entering the three secrets your keys are derived from, and the same keys are rebuilt locally on whatever device you are using.
Sending a message, uploading a file, writing a note — the content is encrypted with XChaCha20-Poly1305 and authenticated with an ML-DSA-65 signature before any byte crosses the network boundary.
The server keeps an opaque blob it has no key for. When you open uChat, those blobs are streamed to your device, decrypted locally and rendered. Plaintext exists only in your tab.
Any change you make is uploaded and picked up by every other device you are signed in on, so uChat looks the same wherever you open it.
Start encrypted conversations from your address book. Type-ahead suggestions are powered by Contacts and stay encrypted.
Drag-and-drop photos, documents and anything else. Files encrypts and syncs them across the conversation.
Convert any message into a task with one tap. Tasks inherits the message's encryption and provenance.
Schedule a meeting from a thread. Calendar events link back to the conversation they came from.
UltimaOS runs in Chrome, Firefox, Safari and Edge. Nothing to install. Sign in with your passphrase to derive your private key locally.
The launcher shows every app. uChat is right there with its capsule video preview. Click to open.
uChat works alone, but it shines when combined with the rest of the UltimaOS apps. Same identity, same workspace, one place to work.
Short answer
Yes. All content in uChat is encrypted in your browser using XChaCha20-Poly1305 with a fresh key per item. The UltimaOS server only ever stores ciphertext and public keys — it cannot decrypt your data, no matter who asks.
Short answer
uChat uses the same post-quantum stack as every other UltimaOS app: ML-DSA-65 (FIPS 204) for authentication, ML-KEM-768 (FIPS 203) for key encapsulation, XChaCha20-Poly1305 (RFC 8439) for symmetric encryption, and HKDF-SHA256 for key derivation.
Short answer
Yes. Sign in on any device by re-entering your three secrets and the same keys are derived locally, so your uChat content follows you. Changes sync live across all signed-in devices.
Short answer
Yes. UltimaOS is built and operated in the European Union by an EU company. The architecture is GDPR-compliant by design — encrypted data, EU-only infrastructure, no US CLOUD Act exposure, no advertising, no third-party trackers. See the GDPR page for the full breakdown.
Short answer
UltimaOS is free for individuals and families — permanently, not as a trial. Organizations pay per seat once early access ends, and that is what funds the free accounts. There is no per-app add-on.
Short answer
Yes. UltimaOS supports encrypted export of all your content for backup and portability. The export is encrypted to a key you control; you can store it on your own infrastructure or in a personal encrypted backup.
Short answer
Messages in uChat are encrypted at rest with no server-side retention. You can set per-conversation retention rules: messages auto-purge after a chosen time. Once purged, the ciphertext is deleted from the server and unrecoverable.
Short answer
One-to-one voice and video calls live in uMeet, launched from a uChat conversation. uChat itself focuses on text, voice messages with playback controls, file attachments and replies.
No ads, no data mining, no trial clock. Individual and family accounts are free — permanently. Organisations pay per seat, and that is what funds it.