The same end-to-end encryption as the phone apps — not a reimplementation, the same source compiled for the desktop. No phone number, no account, no email. It does not carry the mesh, the radio link, the disguised relay transport or the post-quantum key agreement described elsewhere on this site. The notes below say exactly which parts of OSHI stay on the phone.
Things that will surprise you otherwise. None of them is hidden inside the app.
These builds are not code-signed yet, so SmartScreen shows “Windows protected your PC”. Signing requires a certificate whose private key lives on dedicated hardware, and we do not have one. Until we do, every download here triggers that screen. Compare the SHA-256 below if you want to check what you got.
There is no way to import an existing identity in this release yet. The desktop client generates its own key and its own address, so your phone’s conversations will not appear here, and this client has a different address to give people.
Elsewhere on this site you will read about X-Wing (ML-KEM-768 + X25519) hybrid post-quantum key agreement. That is real, and it is iOS 26 and macOS 26 only, and only when both people in a conversation run a build that supports it. The desktop client has none of it. Its sessions are X25519 + Double Ratchet + AES-256-GCM — strong today, and not what protects you against traffic recorded now and decrypted after a quantum computer exists.
The offline mesh and the radio link are what keep OSHI working without internet on a phone, and the optional disguised relay transport is phone-only too. None of the three works on desktop. The mesh and LoRa carry a message format this client cannot read, and the disguised transport is not built into it. A desktop OSHI needs the Internet and the relay.
There is no push notification system on desktop. The client polls the relay, so closing the window stops delivery and the poll interval is the delivery delay.
The app carries this same list on a screen called “What this client will not do”.
A checksum is not a signature: it proves the file matches what we built, not who built it. It is what an unsigned distribution can offer.
Get-FileHash .\OSHI-Desktop-Setup.exe -Algorithm SHA256sha256sum oshi-desktop-amd64.deb| File | SHA-256 |
|---|---|
| OSHI-Desktop-Setup.exe | ecea05bbe754a0f64a0526332948a70118a57bca50a869f84343e87a05e4aa4d |
| OSHI-Desktop.msi | 04fde41e81491c14cfba926c62c146c16bc1a6accb0b636843bc69115a0219b8 |
| oshi-desktop-amd64.deb | 531ff8be8eb3b28a67ed3184b0ea9fdb7b2aac074d8e1704924ff894eec75d6d |
| oshi-desktop.x86_64.rpm | d421a4b273711f46f228312f4f95dc6a129152ba044294fbdd2d24a92a6995c8 |
| Windows |
Run the .exe. When SmartScreen appears, choose More info → Run anyway — that warning is about the missing signature, not about the file being damaged. It installs for your user only, so it does not ask for administrator rights. |
|---|---|
| Debian, Ubuntu | sudo apt install ./oshi-desktop-amd64.deb |
| Fedora, RHEL | sudo dnf install ./oshi-desktop.x86_64.rpm |
| Where it lives |
Your account and messages are kept in %APPDATA%\OSHI on Windows and ~/.local/share/oshi on Linux. The master key is held by the operating system — Windows DPAPI, or your Linux keyring. |
| Uninstalling |
Windows: Settings → Apps → OSHI. Linux: apt remove oshi-desktop. Your messages stay in the folder above; delete it to remove them. |
Short answers. Each one matches what the rest of this page says.
Yes. It is free and open source under the MIT licence — no subscription, no ads, no paid tier. The cryptographic core is the same code published on GitHub.
Windows 10 and 11, 64-bit. It bundles its own Java runtime, so there is nothing else to install. There is no 32-bit and no Windows-on-ARM build.
Because the installer is not code-signed yet. SmartScreen shows that warning for any unsigned program, whatever it contains. Choose More info → Run anyway, or check the SHA-256 on this page against your download first.
No. The current release has no identity import, so the desktop client generates its own key and its own address. It is a separate OSHI account, with a different address to give people.
No. The offline mesh, the LoRa radio link and the disguised relay transport are phone-only. The desktop client needs the internet and the relay, and it receives only while the window is open.