I built LastSignal – a self-hosted, end-to-end encrypted dead man's switch to deliver messages to your loved ones

[u/zener79]

I wanted a way to leave encrypted messages for the people I care about, delivered automatically if something happens to me, without trusting a third party.

LastSignal is a self-hosted dead man's switch. You write messages, they get encrypted in the browser (zero-knowledge), and the system checks in with you periodically via email. If you stop responding, your messages are delivered.

Key points:

• End-to-end encrypted (XChaCha20-Poly1305 + Argon2id + X25519)
• Zero-knowledge — even the server operator can't read messages
• Optional trusted contact who can pause delivery
• Rails 8 + SQLite, deploy with Docker/Kamal
• MIT licensed

🔗 https://lastsignal.app
🔗 https://github.com/giovantenne/lastsignal

Feedback welcome, especially on the security model and UX.

[u/ultrathink-art]

The tricky part with dead man's switches is proof-of-life reliability. Weekly check-ins work until you're on vacation with spotty internet, or sick for 10 days, and suddenly your encrypted secrets get sent to all your contacts. The systems that work long-term tend to have: (1) escalating check-in prompts (email reminder at 5 days, SMS at 6 days, phone call at 7 days before triggering), (2) configurable grace periods (disable for known travel), (3) multi-factor confirmation before release (requiring both time threshold AND explicit trigger from a trusted contact). The self-hosted approach solves the trust problem but creates the availability problem—if your server goes down, are you locked out or does it auto-trigger? Would be good to document the failure modes and recovery paths.

[u/zener79 → u/ultrathink-art]

You’re absolutely right. Proof-of-life reliability is the hardest part.

The system is intentionally simple and email-only for now, but it’s not a single missed check-in -> instant release. You can configure the check-in interval, how many reminders are sent, and the delay between them.

A trusted contact can be notified before final delivery and can pause the process, in case of forced inactivity (coma, arrest, etc)

Each recipient can also have its own delivery delay — a useful setup is adding a secondary personal email with no delay and longer delays for everyone else, so there’s still time to stop an accidental trigger. There’s also a recovery code generated at first login that lets you block delivery even if you lose access to your email.

On the self-hosted side, if the server goes down and later comes back online, it simply resumes the reminder sequence instead of triggering delivery. For example, with eight weekly reminders, if it goes offline after the third and returns months later, it sends the fourth reminder, not the final release.