Getting started
Keylane ID
Every other messenger asks who you are. Keylane asks your device to prove it holds a key. This page explains what that difference means in practice — and what responsibility it hands to you.
What a Keylane ID is
A Keylane ID is a cryptographic key pair generated on your device the first time you open the app. The public half is what other people use to reach you. The private half never leaves the device and is never transmitted to us.
This is not an account in the usual sense. There is no username reserved on a server, no password stored in a database, no record connecting the identity to a person. When you send a message, your device proves possession of the private key; nothing about who you are enters the exchange.
What it is not
- Not a phone number. Nothing is tied to a SIM, a carrier, or a number that can be ported away from you.
- Not an email address. No verification link, no inbox that can be compromised to take over your identity.
- Not stored on our servers. The relay knows public keys and device identifiers. It does not hold anything that would let it act as you.
- Not recoverable by us. This is the part that deserves your attention — see loss and recovery.
What it is made of
Under the surface, a Keylane ID is several keys with different jobs:
| Key | Algorithm | Purpose |
|---|---|---|
| Identity key | Ed25519 + ML-DSA | Long-term. Proves this device belongs to your identity. |
| Signed prekey | X25519 + ML-KEM | Medium-term. Used to establish shared secrets with new contacts. |
| One-time prekeys | X25519 + ML-KEM | Consumed once, then destroyed. The basis of forward secrecy. |
| Device identifier | Time-ordered UUID | Routing address. Decoupled from any real-world identity. |
Each pairing is hybrid: a classical algorithm and a post-quantum one side by side. An adversary must break both to compromise the exchange, which means today’s recorded traffic is not decryptable by a future quantum computer alone. The full construction is in the whitepaper.
Creating your Keylane ID
There is no signup form. The process is:
- Install the app from Google Play or the App Store.
- Open it. Keys are generated on-device using the platform secure random number generator. This takes a moment and happens once.
- Choose a display name. This is a local label your contacts see — it is not verified, not unique, and not an identifier. Pick anything, including something that is not your name.
- Publish prekeys. The app uploads public prekey bundles to the relay so people can start conversations with you while you are offline. Only public material is uploaded.
That is the whole process. There is nothing to confirm and nothing to remember, because there is no credential to forget.
Your identity now exists on this device and nowhere else, and there is no way to recover it if the device is lost. Read loss and recovery before you rely on it for anything that matters.
Sharing your ID
To reach you, someone needs your public identity. The app offers a QR code and a shareable link.
- In person — scanning a QR code directly from the other person’s screen is the strongest option, because there is no channel in between for anyone to tamper with.
- Remotely — a link over another channel works, but inherits that channel’s security. Someone who controls it could substitute their own identity.
For contacts whose authenticity genuinely matters, verify the safety number with them through a second channel after connecting. Encryption tells you a message came from a particular key; only verification tells you the key is the right person’s.
Devices
A Keylane ID currently lives on exactly one device. You cannot yet link a second phone, tablet, or desktop to the same identity, and there is therefore nothing to revoke. Multi-device is the next substantial item on the roadmap rather than something already shipped, and we would rather say so here than let you plan around a feature that is not there.
The protocol underneath is already addressed per device rather than per account: messages are encrypted to a device identifier and every envelope carries one, which is what makes adding devices later an extension rather than a redesign. What is missing is the linking flow, the approval and revocation handling, and encrypting each message to several of your own devices at once.
When it lands, linking will require physical access to a device you already hold — a code scanned from one screen to the other. There will be no remote path, no email link and no SMS code, because those are exactly the weakness this design exists to remove.
Until then, plan for a single device. That makes the loss and recovery section below the most consequential part of this page.
Key rotation
One-time prekeys are consumed as people start conversations with you, and the app replenishes them automatically. Signed prekeys rotate on a schedule. Neither requires anything from you.
Your long-term identity key does not rotate on a schedule — rotating it means becoming a new identity to your contacts. If you believe the device or the identity key was compromised, the answer today is to create a new identity and tell your contacts through a channel they can verify. Revoking one device while keeping the identity requires multi-device, which is not shipped yet.
Loss and recovery
This is the most important section on this page, and the one where Keylane’s design has a real cost.
If you lose every device holding your keys, your Keylane ID is gone permanently. We cannot restore it, because we never had it. There is no password reset, no support override, and no backdoor — the same properties that stop an attacker or a court from taking your identity also stop us from giving it back.
What each situation means:
- You lost the device, or reinstalled the app. The identity is unrecoverable. Install Keylane, create a fresh identity, and reconnect with your contacts. They will see you as a new contact, which is the correct behaviour — a stranger claiming to be you should not inherit your identity.
- Your device was taken while Keylane was unlocked. Assume everything on it was read, create a new identity, and tell your contacts through a channel they can verify. There is no remote wipe and, without multi-device, nothing to revoke from.
- Your device was taken while Keylane was locked. The stored history is encrypted with a key that no longer exists on the device — see client security for exactly what that does and does not cover. You still lose the identity, because the keys were only there.
Preparing properly
- Accept that the identity is disposable for now. Until multi-device and a paper recovery key ship, a lost device means a new Keylane ID. Treat your ID as something you can rebuild rather than something you can restore.
- Use a ten-digit PIN and turn on locking when the app goes to the background. This is what decides the outcome if the device is seized rather than merely lost.
- Keep a way to reach important contacts outside Keylane, so you can re-establish a verified connection when you need to start over.
Multiple identities
Nothing stops you from maintaining separate identities for separate contexts — there is no phone number forcing them to be the same person. Each is independent, and they cannot be correlated by the relay through any identifier we hold.
Deleting your identity
Removing the app removes the private keys, which ends the identity. Your published prekeys expire from the relay and undelivered envelopes addressed to your devices are purged at their 14-day TTL.
Because we hold no account record, there is nothing else to delete and no deletion request to file. Your GDPR rights and what they apply to are covered in the privacy policy.