Keryx: Encrypted QR Courier

Some messages are too important to trust to a server. Keryx (KEER-iks) encrypts your message on your device first — then lets you choose how it travels. Changing the delivery never weakens the encryption, because the encryption is part of the message, not a property of the channel. No accounts. No backend. No Google Play Services. Nothing to sign up for. FOUR WAYS TO DELIVER — AND A LIVE CHAT 📷 Live screen scan — your screen shows the message as QR codes; their camera reads it. A true air gap: no connection of any kind. 🎞 Animated QR or encrypted file — the whole sequence as a single animated image or file. Send it by email, cloud, or USB. The carrier sees only ciphertext. 📶 Nearby transfer — direct device-to-device over Wi-Fi Direct or a shared Wi-Fi network. No internet, no server, no Google services in the path. 🌐 By address — two saved contacts who are apart connect directly over the internet, with no relay and no rendezvous service. Keryx states on screen that this exposes your network address, before you connect. You decide. 💬 Live chat — separate from delivery: a live encrypted conversation of typed text between two saved contacts, nearby or by address. Nothing of the conversation is saved — no history, no log. When the chat ends, it is gone. ENCRYPTION AES-256-GCM on every message. Argon2id for passwords. Perfect Forward Secrecy with per-message keys, and post-quantum hybrid encryption — X25519 combined with a fresh ML-KEM-1024 encapsulation (NIST FIPS 203) on every message to a saved contact — on by default, so recorded traffic stays sealed against future quantum computers. Post-quantum sender signatures via ML-DSA (NIST FIPS 204), at a strength you choose. Or hold the key yourself: a hardware-bound Android Keystore key, a password only you know, or a 32-byte key you supply. VERIFY WHO YOU ARE TALKING TO Mark a contact Verified by scanning a code computed from both phones' key sets — live camera only, so a substituted key cannot arrive with a matching code beside it. Or compare a sixteen-word fingerprint out loud. CONTROLS THAT ACTUALLY HOLD • Sealed expiry — the deadline is encrypted and authenticated with the message. It cannot be extended, removed, or forged, and an open message clears itself the moment it expires. • Burn after reading — one read on the receiving device, enforced across re-delivery. Honestly framed: it prevents repeated access, not a photograph. • App lock — a PIN gate on Keryx itself. • Duress PIN — a second PIN opens a clean, empty app while destroying your keys and deleting your contacts and saved content. It looks like a normal unlock, though the wipe runs first and takes a moment longer. Irreversible on purpose. • Screenshot and recording block on every screen that can show decrypted content. • Metadata stripping — remove GPS, device model and timestamps from images before they are encrypted. • Stealth options — neutral filenames, plain black-and-white QR codes. WHAT KERYX NEVER DOES No backend to subpoena. No account tied to your identity. No telemetry, no ads, no analytics. QR generation and scanning run on a pure-Java, on-device engine — no model to download, no network call. Received PDFs and Office documents open inside Keryx, served from memory on Android 11 and later, so decrypted bytes never reach flash storage. The boundaries of what Keryx does not protect are published just as plainly as what it does. Android 10 or later. One-time purchase. No subscription. No in-app purchases. No ads.