Ghost Chat

Ghost Chat is the messenger that puts PGP encryption on top of Nostr's federated transport — two-stack architecture where the relay sees only ciphertext, the user's identity is a PGP keypair (not an account), and there are no servers in the trust path beyond the publicly-knowable Nostr relay set. Part of the kyc.rip ecosystem (first-party, alongside the kyc.rip swap aggregator and the broader walls.rip product family). Listed at Grade A · editor's pick because it occupies a slightly different point on the privacy-messenger landscape than SimpleX or Matrix — minimal infrastructure, structural censorship-resistance via Nostr, and PGP-native identity for users who already manage keys.

Background. Ghost Chat is built by the kyc.rip team (the curator's own engineering side, listed transparently here as first-party — see /transparency for the editorial-vs-product separation policy). Source available at the public repo (verify the LICENSE file at the repository before treating as fully open-source vs source-available); downloads for macOS, Windows, Linux desktop apps plus an online web client at walls.rip/comms. Part of the kyc.rip ecosystem launched around 2026-03 alongside walls.rip privacy tooling — Ghost Mail, Dead Drop, SMS Wall, and Ghost Chat were rolled out as a coherent privacy-comms stack. The product is positioned as the messaging surface of that stack.

What you trust. Two-layer trust architecture: (1) Nostr relays handle federated transport — any user can run a relay, the network is permissionless, and a censoring relay is simply routed around. (2) PGP / ECC-25519 handles content encryption + identity — your PGP keypair *is* your identity; there is no account, no recovery email, no password. Lose the key, lose access. What the relay sees: ciphertext, sender pubkey, receiver pubkey, timestamp — not message content. What the relay doesn't see: anything decrypted; the content is encrypted client-side before the relay ever touches it. Multi-relay resilience: clients can subscribe to multiple relays simultaneously; one relay going down or refusing to carry a message doesn't break the conversation as long as another relay accepts the publish.

Operational specs. Platforms: macOS / Windows / Linux desktop (signed installers from walls.rip), plus a web client at walls.rip/comms for users who don't want to install. No-JS web client path supported (rare for a messenger — most rely on heavy JS clients). Identity: PGP keypair, ECC-25519 curve, generated locally in the client; export to clipboard / file backup. Encryption: payload-level PGP encryption before publish; only the recipient's matching private key decrypts. Relay network: defaults to a curated set of well-known Nostr relays plus the kyc.rip-operated relay set; user can configure additional relays. Open-source: source repository public; reproducible build path documented for users who want to verify the binary matches the source.

Philosophy. Ghost Chat's editorial differentiator is minimum-infrastructure messaging. SimpleX runs its own SMP queue servers, Matrix runs Synapse homeservers — both involve infrastructure-as-trust-surface. Nostr is just "publish encrypted text to a relay, anyone can subscribe with the right key." That makes the architecture genuinely smaller — fewer moving parts to trust, fewer pieces of operator infrastructure to compromise. The trade-off: less feature-rich UX (no group chat at SimpleX's scale, no voice/video, no file sync to multiple devices automatically), but a meaningfully simpler trust model. For users who already use PGP and find SimpleX's queue model conceptually heavier than they want, Ghost Chat is the structurally lighter pick.

Grade rationale. Grade A and editor's pick reflect: minimum-infrastructure trust model (Nostr relays + PGP); open-source codebase with reproducible builds documented; no-account / no-email / no-phone signup; PGP-keypair-as-identity architecture; multi-relay resilience; no-JS web-client option; first-party transparency disclosure (listed openly as kyc.rip ecosystem product); no observed reliability issues or governance incidents during the ~3-month observation window since launch (2026-03). Last verified 2026-05-13. Re-evaluation trigger: xmr.club will reassess this grade at the 6-month operational mark (~2026-09-22) or earlier if a third-party security audit ships, whichever comes first. Note: as a first-party product, Ghost Chat is held to a higher disclosure bar than third-party listings — the curator's editorial separation from product development is documented at /transparency. Grade A on a young product is editorially defensible by the architectural-simplicity argument (Nostr + PGP is structurally smaller than competing trust models); we acknowledge the short observation window explicitly and commit to the re-evaluation.

Useful when. You already manage PGP keys and want a messenger that uses them natively rather than adding a separate identity layer. You want minimum-infrastructure messaging — fewer moving parts than SimpleX, fewer servers than Matrix. You're already in the Nostr ecosystem and want a private-messaging client that fits that protocol. You want a web client that works without JavaScript (Tor "Safest" level compatible). You're censorship-evading and want the multi-relay resilience that Nostr provides. You want a messenger from a project you can audit end-to-end (open source + the curator's own product, so accountability is direct).

Caveats. PGP-keypair-as-identity means key management is on you — lose the key, lose the conversation history + identity. This is harder than "remember a password." Relay metadata is observable — relays see sender pubkey + receiver pubkey + timestamps; they don't see content but they do see who-talks-to-whom by pubkey. For metadata anonymity, route through Tor (Nostr-over-Tor is supported by most relays) or use the SimpleX queue model instead. Smaller ecosystem than SimpleX or Matrix — fewer contacts likely already use it; you'll be onboarding people one at a time. Feature-gap trade-offs — by design, to keep the infrastructure surface minimal: no native voice/video calls (text + attachments only — use Signal / SimpleX / Element for voice), no group chats beyond small rooms (no Telegram-scale thousand-member groups), no multi-device sync (each install holds its own conversation state). First-party product disclosure — Ghost Chat is built by the kyc.rip team; the editorial decision to include it here is documented under /transparency. If you object to first-party listings on principle, treat this as an FYI rather than a recommendation; if you weigh accountability + auditability higher than strict separation, the listing is appropriate.