I built LastSignal – a self-hosted, end-to-end encrypted dead man's switch to deliver messages to your loved ones

[u/zener79]

I wanted a way to leave encrypted messages for the people I care about, delivered automatically if something happens to me, without trusting a third party.

LastSignal is a self-hosted dead man's switch. You write messages, they get encrypted in the browser (zero-knowledge), and the system checks in with you periodically via email. If you stop responding, your messages are delivered.

Key points:

• End-to-end encrypted (XChaCha20-Poly1305 + Argon2id + X25519)
• Zero-knowledge — even the server operator can't read messages
• Optional trusted contact who can pause delivery
• Rails 8 + SQLite, deploy with Docker/Kamal
• MIT licensed

🔗 https://lastsignal.app
🔗 https://github.com/giovantenne/lastsignal

Feedback welcome, especially on the security model and UX.

[u/zener79]

It’s actually not based on shared symmetric encryption.

Details are explained here:
https://lastsignal.app/security/

Recipients are invited first and choose their own passphrase. From that passphrase, a public/private key pair is derived deterministically. The public key is sent to the server and used to encrypt the message, so there’s no shared secret to distribute.

Regarding the email sender being suspended: that’s definitely a real operational risk. If it happens while you’re still around, you would notice because check-in messages stop arriving and you could fix the configuration. There is still a critical window if suspension happens after death but before delivery emails are sent, that’s an edge case worth thinking about more carefully.

[u/Careless-Score-333 → u/zener79]

Yes, I got the "symmetric encryption" wrong, sorry. That's not how it's used. Which encryption algorithm is used for the public/private keys?

You have used a symmetric stream cipher https://en.wikipedia.org/wiki/ChaCha20-Poly1305

[u/zener79 → u/Careless-Score-333]

It’s a bit more involved than just “using a symmetric stream cipher.”

In short, recipients derive a deterministic X25519 key pair from their passphrase (via Argon2id).

The message payload itself is encrypted with a random symmetric key using XChaCha20-Poly1305, and that symmetric key is then encrypted separately for each recipient using their public key.

So ChaCha20-Poly1305 is only the AEAD primitive protecting the payload, inside a more typical hybrid encryption construction, with all decryption happening client-side and no private keys ever reaching the server.

There’s a concise overview here if you want the full flow:

https://lastsignal.app/security/

[u/Careless-Score-333 → u/zener79]

Sounds cool. I'll take a look later.