Hey Product Hunt 👋 I'm Gabe, the solo dev behind IronSeal. I built this because of one thing that always bugged me: almost every "encrypted" messaging app shows you everything in plaintext the second you open it. If someone grabs your unlocked phone, your whole history is right there — and in a lot of apps, the company running the servers can technically read your messages too. IronSeal works diﬀerently: 🔐 Zero-knowledge. All encryption happens on your device. The server only ever stores ciphertext,I literally can't read your messages, even if I wanted to or was compelled to. There's no master key and no backdoor. 👁 Biometric-gated decryption. Messages stay encrypted at rest. They only decrypt after you pass Face ID / a passkey — so an unlocked, stolen phone still doesn't spill your conversations. 💥 Tamper response. If someone keeps failing authentication, the messages can self-destruct (configurable: e.g. 3 strikes → purge) and both people get alerted in real time that an unauthorized attempt happened. 📝 Text-only on purpose. No file sharing. Almost every major messaging-app exploit of the last few years came through file handling (image/PDF/video parsers). I removed the entire attack surface. Under the hood: ECDH P-256 + AES-256-GCM, a fresh ephemeral key per message for forward secrecy, 256-byte message padding, passkeys (WebAuthn), and a hash-chained audit log. Django + Next.js, all crypto via the Web Crypto API. Honest about the limits, too: I can see metadata (who messaged whom, and when), just never content. It's not a full Double Ratchet yet, and there's no independent audit yet — I'd rather say that plainly than overclaim. It's free at https://ironseal.app. I'll be here all day — genuinely want your hardest questions, especially on the crypto and the threat model. 🙏

IronSeal

Encrypted messages that self-destruct if forced open

Encrypted messages that self-destruct if forced open