Exchange — Support
Exchange is a cryptographic messenger: encrypt anything on your device, send it through any app you already use, and decrypt back. Your private keys never leave your phone. This page covers the most common questions; if you don't find the answer, the email link at the bottom reaches a human.
Get in touch
The fastest way to reach the developer is email: nettrash@nettrash.me. Please include your iPhone model and iOS version — that helps a lot when reproducing extension or keychain issues.
Getting started
How do I add my first recipient?
On the home screen, tap the + button and pick one of two paths. If you're with the other person physically, ask them to open Exchange and tap "Show QR code" on their identity row, then tap Scan QR on your Add Recipient sheet and point your camera at their screen. The public-key bundle fills in automatically; type their display name and tap Save.
If you can't meet in person, the other person can copy their public-key bundle from their identity row and send it to you over any channel (iMessage, email, signal, paper). Paste it into the Public key bundle field on your Add Recipient sheet and save. Verify the fingerprint matches what they see on their phone — that's the step that prevents a man-in-the-middle on whatever channel you used.
How do I send my first encrypted message?
Two routes. Inside Exchange, tap the Compose icon (pencil-and-paper) in the top toolbar, pick a recipient, type your message, tap Encrypt. The screen swaps to a result view with the encrypted envelope shown as a single base64 line. Tap Share and pick whichever messenger you want to send it through — iMessage, Mail, Telegram, anything.
If you and the recipient both have Exchange installed and use iMessage, the slicker path is the iMessage extension. In any iMessage conversation, tap the + button next to the compose field, find Exchange in the apps list (the first time, you may need to tap "More" and enable it), pick the recipient, type, hit Encrypt & insert. A 🔒 Encrypted message bubble drops into the compose field; tap iMessage's blue Send arrow.
How do I decrypt an envelope I received?
If it came through the iMessage extension (a 🔒 Encrypted message bubble), just tap the bubble and Exchange opens with the plaintext shown.
If it came as text in any other app — pasted into iMessage, sent over WhatsApp, in an email — copy the EXC2: blob, switch to Exchange, tap the Decrypt icon (open lock) in the top toolbar, tap "Paste from clipboard," then Decrypt. The plaintext appears with a footer telling you whether the sender's signing key matched a recipient you've saved.
Frequently asked questions
Why doesn't Exchange show up in iMessage's app drawer?
iMessage caches its installed-app list aggressively. After installing Exchange for the first time, force-quit Messages (swipe up from the bottom and swipe Messages off the top) and reopen it. Then in any conversation, tap + next to the compose field, scroll the list to the bottom, tap "More," and toggle Exchange on. You can drag it into Favorites so it shows up in the first row.
The app says "Signature verified, but the sender's signing key doesn't match anyone in your recipients." Should I be worried?
It means the envelope decrypted cleanly and the signature is mathematically valid — but the signing public key is one Exchange has never seen on this device. Two innocent reasons: the sender hasn't been added to your recipients yet, or they regenerated their identity (Reset identity in their Settings) and you have their old keys. The footer shows their fingerprint; if it matches what they tell you it should be, add them as a recipient and you'll see "from <their name>" next time.
The cautious reading: someone else encrypted this message to you and signed it with a key you don't recognise. The plaintext is still readable, but you have no proof of who actually composed it. Treat it like an unsigned email from an unknown address.
What happens when I tap "Reset identity" in Settings?
Your encryption and signing private keys are deleted from the iOS Keychain, and every recipient you've saved is removed from the local store. A fresh keypair is generated on the next moment of the launch — you'll see the splash screen briefly, then return to the home screen with a new identity. This is irreversible. Anything previously encrypted to your old public key becomes unrecoverable forever, even if a copy of the ciphertext exists somewhere else. Your contacts will need your new public key before they can encrypt to you again.
Can I move my identity to a new iPhone or to a Mac?
Yes — Exchange 1.1 ships three ways, in roughly increasing order of effort:
iCloud Keychain (default). The identity private keys are written to iOS Keychain with the Synchronizable bit set, so they travel automatically across the iPhone and Mac signed into the same Apple ID. A new iPhone restored from your Apple account picks up the existing identity once iCloud Keychain syncs through. iCloud Keychain is itself end-to-end encrypted with a device-class secret, so the keys are never visible to Apple in plaintext. You can turn this off in Settings → Identity sync to pin the key to one device only — that's the original v1.0 behaviour, useful if you want strong forward secrecy at the cost of multi-device convenience.
Passphrase backup. In Settings → Backup & transfer, "Export identity (passphrase)" prompts for a passphrase, runs PBKDF2 + ChaCha20-Poly1305, and gives you a single line of base64 (EXCBKP1:…) that contains your identity and your full recipient list. Save it in a password manager; later, "Import identity (passphrase)" with the same passphrase replaces the local identity on another device. The strength of the passphrase is the only thing protecting the export, so pick something long and unique.
QR transfer. When both phones are physically with you, "Send identity (QR code)" on the source device shows an encrypted single-use QR; "Receive identity (Scan QR)" on the target device scans it, shows the fingerprint, and asks you to confirm before overwriting. Faster than typing a passphrase, but only safe in a setting where the QR is visible only to your two devices — don't photograph it, don't show it on a video call.
All three options overwrite the local identity on the receiving device. Anything previously encrypted to the old key on that device that isn't reachable through the imported one becomes unreadable; that's the cost of replacing rather than adding. Recipient lists on the other hand are preserved across a standard iOS encrypted backup-and-restore, and the passphrase backup also includes them.
Do my recipients sync between iPhone and Mac too?
Yes — Exchange 1.1 also syncs the recipient list across your devices. The mechanism mirrors identity sync but is one step more careful: the recipients are encrypted on-device with a key derived from your identity, and only the resulting opaque blob rides iCloud Keychain. Apple sees ciphertext only — display names, public keys, fingerprints, and notes are end-to-end encrypted between your devices, regardless of whether you have Advanced Data Protection turned on.
Toggle this off in Settings → Recipients sync if you want to keep the recipient list strictly local to each device.
Edge case worth knowing: if you add or remove a recipient on two of your own devices in the same minute and the changes don't reach iCloud Keychain in order, one device's change can overwrite the other. The blob is whole-list, not per-recipient; that's a deliberate simplification because edits are rare for personal use. If you need bulletproof multi-device editing, the passphrase backup is the more deterministic mechanism.
I lost my phone. Can I recover my old messages?
If you had iCloud Keychain sync turned on (the default in 1.1) and your iPhone was signed into your Apple ID, your identity is still in iCloud Keychain — sign in on a new device and Exchange picks up the same identity once it syncs through. You'll be able to read messages that arrive going forward, but anything that was already on the lost phone and hasn't been re-sent is gone.
If iCloud Keychain sync was turned off, or you used the original v1.0 build, the identity is unrecoverable: there's no master key, no recovery mechanism, no developer back door, by design. The cost of that strong forward-secrecy guarantee is that a lost-and-not-wiped device leaks every message ever sent to its identity, but a lost-and-wiped device takes them with it.
What about Universal Links — should tapping an Exchange link open the app?
Yes. Exchange registers https://exchange.nettrash.me/msg as an associated-domain link. When a recipient taps an encrypted bubble in iMessage, or right-clicks an Exchange link in Messages on Mac and chooses Open Link, iOS or Mac Catalyst opens Exchange and decrypts the envelope automatically. If the app isn't installed, the link falls back to Safari and lands on a 404 — the URLs are pure data carriers and have no web page behind them. Install Exchange, then re-tap the link, and it opens in the app.
Why does the encrypted envelope start with EXC2:?
That's the protocol version marker. EXC2 is the current envelope format — Curve25519 ECDH + Ed25519 signature over a ChaCha20-Poly1305 wrapped key and body. If a future version of Exchange changes the format, the prefix will bump (EXC3:, etc.) and the app will refuse to open the new format with an "unsupported version" error rather than try to brute-force it. Old envelopes you've already received continue to decrypt as long as the same version number is supported.
The camera says "No camera available" — am I missing something?
iOS Simulator has no real camera, so QR scanning never works there. Use a real iPhone for the scan path, or paste the public-key bundle as text instead. On a real iPhone, if you previously denied camera permission, you'll see "Camera access is required" with a hint to Settings → Exchange → Camera; granting it there clears the message immediately on return.
Where is my data stored, and how do I delete it?
On your device, only. The identity private key lives in the iOS Keychain; the recipient list lives in a SwiftData store inside the App Group container shared with the iMessage extension. Nothing is uploaded to any server the developer runs. Full details are in the privacy policy.
To delete everything: tap Reset identity in Settings, or uninstall the app. Both wipe the local state. Re-installing afterwards starts fresh with a brand-new identity.
Reporting bugs
If something looks wrong, please describe what you did, what you expected, and what actually happened. A screenshot or screen recording helps a lot. Send it to nettrash@nettrash.me; we'll respond as soon as we can. Please do not include your private key, encrypted envelopes, or anything you'd consider sensitive — bug reports should be reproducible without those, and we'd rather you not share them.