Hermes MVP · desktop

End-to-end encrypted DMs over Nostr, addressed by your .bch name instead of a public-key string. Same wallet is your identity — no email, no phone number, no company, no server that can delete your account.

Lives inside Theseus: open with the Hermes icon in the left sidebar, or Ctrl+Shift+E (E as in Ermis, the Greek spelling). Brand kit at /hermes/branding.

What ships today

The desktop MVP is live inside Theseus. Core messaging works end to end; polish and mobile follow.

Threaded chat live

Contact list on the left (search + unread badges), selected conversation on the right with bubbles + inline reply. Enter to send, Shift-Enter for newline.

Send & receive by name live

Type alice.bch — the client resolves on-chain, wraps NIP-17, publishes to the recipient's declared relays. Sealed-sender: the relay never sees who sent what to whom.

Address book live

Named contacts stored locally. Optional vCard import for existing address books — opt-in, nothing uploaded, you preview who gets added.

History on your device live

Messages persist to disk (per identity) so close-reopen keeps your threads. Unread marks survive restarts.

Mobile next

Shipping inside Ariadne mobile (same wallet seed, same Nostr identity, zero extra onboarding).

Tor transport planned

Relay traffic over the Tor exit Theseus already runs, so even connection IP leaves the relay.

The one idea that makes this different

Every existing Nostr client has the same wart: identity is npub1q8s7f3k… gibberish. The human-name fix — NIP-05 — resolves alice@example.com through a DNS domain and a web server. That is exactly the ICANN + server chain Silent Mode exists to escape. Decentralized messaging bolted onto centralized identity.

The Hermes pitch.
alice.bch publishes her Nostr pubkey as an on-chain record. Her name certificate is her verified, seizure-resistant identity. Message anyone by their .bch name — no phone number, no email, no ICANN, no company, no server that can delete your account.

How it works

  1. Your name owns your key. Register any name you like on the chain (or reuse one you already own), publish your Nostr pubkey to it as a new np record. The key is derived from the same wallet seed as the name itself, so one seed backs both.
  2. Find people by name. Type bob.bch. The client resolves it against the chain, pulls np (Nostr pubkey) and nr (preferred relays). No directory server involved.
  3. Send the message sealed. NIP-17 gift-wrapped DMs — the relay sees neither sender nor content, only that a wrap addressed to some pubkey exists. Route over Tor to also hide your IP; Theseus already can.
  4. The name shows, not the pubkey. Incoming messages reverse-resolve pubkey → name where possible, so your chat list looks like a normal chat list — not a wall of hex.

Where it will live

In Theseus desktop

A Messages panel inside the browser you already have. Routes relay traffic over Tor. Reuses the built-in wallet's seed as the messaging identity.

In Ariadne mobile phone

A Messages screen in the existing Android app. Same seed, same identity — you can message from either device without a linked-account handshake.

Where your history lives

Three modes, one toggle. The default assumes no cloud at all — every later option is opt-in, and none of them let anyone but you read your messages.

Local only default

The client keeps your message history on the device. Nothing else knows it exists. Same seed on Theseus and Ariadne gives you two-device redundancy for free — lose one, restore from the other. Lose both, history is gone. Signal's model, on purpose.

Silent Mode cloud backup opt-in

Toggle on and the client encrypts your message history with a key derived from your wallet seed, then backs it up to decentralized cloud storage on the Sia network. Only you can read it. Text messages only — no pictures, no video, no attachments.

Your own Sia account advanced

Prefer to own the storage yourself? Hermes sets up your own Sia account and routes your backups there instead. Same encryption from your wallet seed — and this time media backup is on the table too.

Honest boundaries

Messaging, not email

No Gmail interop — by design. A separate anonymous-mailbox product covers "sign up on services without leaking a real address."

Metadata resistance is good, not perfect

NIP-17 hides sender and content from relays. Relays still see the recipient pubkey, timing, and your connection IP unless you route over Tor. The UI will tell you when it's on.

Relays are Nostr's soft spot

A message lives only while some relay keeps it. Silent Mode runs one relay on the same anonymous VPS as the gateway, and writes to a few public relays for reach and redundancy.

Status: designed, not built. The full protocol design is in Hermes/DESIGN-hermes.md (mirror). Nothing to install yet — this page exists to say what is coming, and to make it possible to ask for updates in the messaging panel of a future Theseus or Ariadne build.