Every app asks you to trust them.
We let you verify us.

When WhatsApp says your messages are encrypted, you believe them. When your health portal says your records are secure, you believe them.

But every one of those services sends you the code that handles your encryption keys. If they wanted to read your data, they could serve modified code that copies your keys. You'd never know.

Every release of GrayPress is hashed, signed, and registered on the Algorand blockchain. The record is immutable and public.

Your browser checks the crypto JavaScript against the on-chain record. If someone modified the code — even us — your browser detects it and refuses to decrypt.

When you publish private content, your browser encrypts it before sending. The server receives opaque ciphertext. It stores what it cannot read.

When someone you've shared with opens the page, their browser decrypts it using their own key — unlocked by their fingerprint. The server never sees the plaintext.

The server tells you your friend's public key is X. You encrypt for X. But X is actually a key the server controls. Classic man-in-the-middle.

GrayPress registers every public key on Algorand. Your browser fetches the key from both the server AND the chain. If they disagree, encryption is refused.

Your handle is a living process on the BEAM virtual machine — the same technology that runs WhatsApp's infrastructure for 2 billion users.

Publish pages, send messages, make calls, share files — all through your handle. Sign in with your fingerprint. No passwords.

The signing key lives on an air-gapped machine. The verification record lives on a public blockchain. The browser checks independently.

No single entity controls all three. The developer signs. Algorand stores. Your browser verifies. Just like Certificate Transparency — but for the code that handles your keys.