To send, use the SonarPass app on your phone.
The whole app is one file. After it loads, it makes zero network requests — the footer counts them live, and it stays at 0. Your text travels between the two devices as near-ultrasound sound waves only: no internet, no server, no cloud, nothing in between.
Before anything is played, your text is encrypted with AES-256-GCM (the same class of cipher banks and governments use). Anyone recording the audio in the room captures only ciphertext. Tampering is detected: every message carries an authentication tag, and damaged or forged audio is rejected, never displayed.
Pairing creates a random 256-bit key on your device. It moves to the other device only inside the QR code you scan (or the code you paste) — it is never transmitted over sound or network. The emoji fingerprint at the top is derived from the key: when both devices show the same emojis, they hold the same key.
There is no public-key cryptography here at all — nothing for a quantum computer running Shor's algorithm to break. The symmetric parts (AES-256, SHA-256) keep ~128-bit strength even against quantum attacks (Grover's algorithm), which is the level standards bodies consider quantum-safe.
Messages are never encrypted twice with the same key. Each one is locked with its own one-time key; the moment it is used, that key is destroyed and the next one is derived by a one-way step that cannot be reversed. Even if a device is stolen later, everything sent before stays locked forever.
Each message carries its position in the key chain. A recording of an old message played back later no longer has a valid key — it is rejected outright with an "old or out-of-sync" notice, never delivered as new.
Sent and received text is masked as dots by default, revealed only on demand, and received text wipes itself after 60 seconds (unless you press Keep). Nothing sensitive is written to visible logs.
The pairing QR / pairing code IS the key. Don't screenshot it, share it, or leave it on screen — anyone who captures it can decrypt your transfers. If in doubt, generate a new key on the Pair page; the old one stops working instantly.