How Howl encrypts your DMs and calls
A while back I posted Howl here and said I would get technical if people asked. I got a few messages and asks so I figured to make a post about it.
What is encrypted end to end
Your DMs, group DMs, file attachments, DM voice and video calls, voice channels, stages, and screen shares. For all of these, our server stores and relays data it cannot read. There is no toggle and no secure mode to remember. It is on for every DM, every time.
What is not encrypted:
Server text channels. Moderators cannot moderate what they cannot read, so community channels work the way they do everywhere else.
How it works:
DMs use MLS (RFC 9420), the IETF's open standard for encrypted group messaging. Discord uses MLS too, but only for voice calls. Their messages sit on their servers as plain text. We use it for the messages.
Who holds the keys
You do, by default. Your key vault is sealed with your password plus a recovery key we show you once. We keep nothing that can open it. Lose both the password and the recovery key and your history is gone. The app tells you so at setup.
If that scares you, you can opt into server recovery instead. Then we keep a copy of your keys and can rescue a forgotten password. The cost is that, that key for decryption is on our servers. The setting also mentions this directly so theres nothing misunderstood.
I have seen “fail closed” thrown around on this sub from AI and the normal person probably has no clue what that actually means, a quick run down is basically, if something fails to perform its function (in our case encryption) then the action fails rather than working in a way that the person is unaware of.
If encryption is not ready, the app blocks the send. It never falls back to plain text. A hacked server cannot downgrade an encrypted DM to a plain one, because the client refuses to go backward.
Reporting: if you report a DM, your own client decrypts that one message and sends it to our moderators. Reporting is something you trigger, not something we do.
Check my work
Again Howl is open source so all code is public, so you do not have to take my word for any sentence above.
Repo: https://github.com/Howl-LLC/Howl
Happy to answer technical questions in the comments, same as last time.