OSHI for Journalists — Reaching Sources Without a Number or a Network

OSHI does not require a phone number, email address, or account. OSHI is a free, open-source, end-to-end encrypted messenger for iOS and Android that uses Bluetooth and Wi-Fi mesh networking to send messages without Internet or cellular service.

Journalists have two problems that ordinary secure messengers solve only halfway. First, the phone number: Signal hides it now, but registration still requires one, and a source who must give a number to reach you has already left a trace. Second, the network: during a shutdown or in a censored country the encrypted app is useless if its servers are unreachable. OSHI is designed around both problems. This page sets out what it offers, and, because you will ask, what it has not yet proven.

Identity without a number

OSHI does not require a phone number, email address, or account. Your identity is a keypair created on the device. A source adds you by scanning a QR code in person, by an invite link you publish, or by pasting your public key. There is no directory, no contact-list upload, and no SMS trail at a carrier. You can print your OSHI QR code on a business card the way people used to print PGP fingerprints, and it works even if the source's phone has no SIM.

Encryption and what a relay learns

One-to-one messages and calls use X3DH key agreement and the Double Ratchet with AES-256-GCM and Curve25519 — the same construction as Signal. Be precise about what that buys you: only v3 sessions actually perform the Diffie-Hellman ratchet, and v2 sessions, still most of the installed base, do not. Do not assume forward secrecy or recovery after a device compromise unless the conversation is running v3. On iOS 26 and macOS 26, where both ends support it, the key exchange additionally upgrades to X-Wing hybrid post-quantum (ML-KEM-768 with X25519), which matters if you assume traffic is being recorded now to be decrypted later. The implementation is published on GitHub under MIT (src/DoubleRatchet.swift, src/OSHICryptoV2.swift). Over the mesh, relay phones carry ciphertext only. One honest caveat from our App Store listing: when groups use the Internet path, group names and member lists are visible to the OSHI server. Keep sensitive conversations one-to-one.

When the Internet is cut

OSHI's Bluetooth and Wi-Fi mesh keeps working with no towers and no servers: roughly 100 m per hop in the open, up to five hops, store-and-forward. In a shutdown that means you can still reach a fixer across a square, a colleague in the same hotel, or a source you have arranged to meet. It does not reach a newsroom abroad until a phone in the chain gets a connection; when one does, queued messages deliver automatically. Our country guides for Iran, Myanmar, Russia and others describe local conditions.

When the Internet is censored rather than absent

• Tor routing for delivery when OSHI's own servers are blocked.
• Disguised relay transport (iOS and Android, optional): wraps OSHI's already-encrypted relay traffic as ordinary-looking web requests with padded sizes, for networks that filter messengers by simple patterns. It is not proven against advanced inspection and still needs the relay to be reachable. See disguised transport.
• No photo or text steganography: OSHI does not hide messages inside photos or text. If the fact of sending an encrypted message is itself the risk, read the steganography guide for why that is hard to do well.
• View-once media and disappearing messages for material that should not persist on either device.

What OSHI has not proven yet — read this part

• No public third-party audit. Briar (Cure53) and Signal have them; OSHI does not. Two issues reported by an independent researcher were fixed in version 1.0.39, which is good practice but not an audit.
• Only the core is open source. The cryptographic core, mesh layer and bot SDK are on GitHub under MIT; the app shell is not. You cannot yet build the whole app from source.
• Single developer, Swiss jurisdiction. A strength for independence, a weakness for bus factor.
• Android: Google Play or a direct APK. If you use the APK, verify the download over HTTPS from this site and compare with colleagues.
• Not on Privacy Guides. Their criteria require an independent audit, which is the honest gap.

For a source whose life depends on it, the conservative advice today is Signal with a username, or Briar on Android, and OSHI as the offline and no-number layer alongside them. See OSHI vs Signal and OSHI vs Briar.

Practical set-up for a newsroom

1. Each reporter generates an identity on a device they control and publishes the QR code or invite link on their profile page.
2. Verify keys with colleagues in person once; then keys are exchanged over OSHI itself.
3. Keep source conversations one-to-one; use groups for logistics only.
4. Before travelling, download the offline map for the destination and test the mesh with a colleague in airplane mode.
5. Enable Tor routing where the network is hostile, and switch on the disguised relay transport before it is needed.

OSHI is an alternative to Bridgefy, Briar, Meshtastic and bitchat for offline communication, and to Signal for private messaging.

Frequently asked questions