End-to-end encryption
Messages, calls and files can only be read by those taking part in the conversation. On our servers, they remain encrypted.
Security & privacy
What you write stays between you.
3berg Privat Chat encrypts your conversations from device to device. Our servers see only what they need to deliver them.
At a glance
How 3berg protects you
Forward secrecy
Even a key stolen later will not open earlier conversations.
Key verification by QR code
When you meet, scan each other’s codes. After that, no one can slip in between unnoticed.
No phone number
Your identity in 3berg is not tied to a number or an email address.
Address book optional
You decide whether 3berg matches your address book. Without matching, you add contacts by code.
Deletion after delivery
Once a message has arrived, it is deleted from the server.
Notifications without content
No message content passes through Apple’s or Google’s push services.
Encrypted on the device
Your chats are stored in encrypted form on the phone itself, too.
Data-minimal
Who writes to whom, and when, is none of our business. That is why 3berg creates as little metadata as possible.
Step by step
How end-to-end encryption works
Between your device and the other person’s, your message is never readable anywhere.
- 1
Keys are created on your device
During setup, the app generates two keys. Your contacts may know the public one. The private one never leaves your device.
- 2
Encrypted before it leaves your phone
Your message is encrypted on your own device with the other person’s public key. Whatever goes out onto the network is gibberish to everyone else.
- 3
The server only passes it on
Our servers deliver the encrypted message and delete it as soon as it has arrived. They cannot read it, because they don’t have the key.
- 4
Readable only by the recipient
Only the other person’s device decrypts the message, with their private key. Thanks to forward secrecy, the keys change regularly. Anyone who steals one later still cannot get at old conversations.
Transparency
What our server knows – and what it doesn’t
It doesn’t know
- What you write, say or send
- Your private keys
- Your phone number – we don’t need it at all
- Your address book, unless you switch on matching
- The content of your notifications
Needs for a moment, then forgets
- Who an encrypted message is to be delivered to
- The encrypted message, until it is delivered
- An empty signal to Apple or Google, so your phone wakes up
After delivery, the message is deleted.
Fending off attacks
No one in between
Encryption only protects you if you write with the right key.
In a “man-in-the-middle” attack, someone poses to each side as the other. Key verification by QR code protects against this. Scan each other’s codes when you meet. If they match, no one is in between.
And if the authorities ask?
We cannot hand over content, because we cannot read it ourselves. The private keys are only on your devices, and we deleted delivered messages long ago.
Your device is part of it
Every app is only as secure as the device it runs on. Keep your operating system up to date, lock your phone with a good passcode, and only install apps from the official stores.
Open source code. Independently audited.
The source code of 3berg Privat Chat is public, and independent experts have examined the app for security vulnerabilities. So you don’t have to trust us – you can check for yourself.
View source code
Read audit report
Here too
Technical security of this website
You can check every point in your browser’s developer tools.
ConnectionHTTPS with TLS encryption and HSTS. This means your browser only ever connects in encrypted form.
Content Security PolicyScripts, styles, images and connections are only allowed from 3berg.app itself; injected code is blocked.
Protection against embeddingOther sites cannot embed 3berg.app (
frame-ancestors 'none'). This prevents clickjacking.Further headers
X-Content-Type-Options: nosniff, Referrer-Policy: no-referrer, Cross-Origin-Opener-Policy: same-origin; camera, microphone and location blocked via Permissions-Policy .Cookies & trackingNo cookies, no analytics or advertising services, no fingerprinting.
Third-party contentNone. Fonts, images and scripts come exclusively from 3berg.app.
contact formAll input checked on the server, at most 16 KB per request, at most 5 requests in 10 minutes, spam trap, IP address not stored.