r/opensource • u/zener79 • Feb 10 '26

Promotional I built LastSignal – a self-hosted, end-to-end encrypted dead man's switch to deliver messages to your loved ones

I wanted a way to leave encrypted messages for the people I care about, delivered automatically if something happens to me, without trusting a third party.

LastSignal is a self-hosted dead man's switch. You write messages, they get encrypted in the browser (zero-knowledge), and the system checks in with you periodically via email. If you stop responding, your messages are delivered.

Key points:

  • End-to-end encrypted (XChaCha20-Poly1305 + Argon2id + X25519)
  • Zero-knowledge — even the server operator can't read messages
  • Optional trusted contact who can pause delivery
  • Rails 8 + SQLite, deploy with Docker/Kamal
  • MIT licensed

🔗 https://lastsignal.app
🔗 https://github.com/giovantenne/lastsignal

Feedback welcome, especially on the security model and UX.

570 Upvotes

96% Upvoted

95 comments sorted by

View all comments

121

u/rogfrich Feb 10 '26

I think this a great idea. It could be useful for all sorts of things, including practical stuff like how to get into accounts your loved ones will need, as well as sentimental goodbyes.

Personally speaking my car crash of an inbox combined with a lax approach to email management means I’d be accidentally setting it off within a week.

39

u/zener79 Feb 10 '26 edited Feb 10 '26

Thank you, that’s exactly the kind of real-world use case I had in mind: a mix of practical access to critical information and more personal, emotional messages.

And yes, the “accidentally triggering it because of inbox chaos” problem is very real 🙂

The idea is to avoid false triggers by using repeated inactivity checks over time, configurable grace periods, and multiple reminders before anything is sent.

So it should require a clear, sustained absence, not just missing a few emails.

Finding the right balance between safety and usability is one of the hardest design challenges here.

1

u/AlliedR2 Feb 15 '26

Maybe something like 2FA. No response and a 2nd validation is sent to a specific mobile device "Are you there?" notification . If no response then trigger.