Local-first architecture
The app generates and stores its working identity and encryption keys locally on the device. It works without a Hide My Text account, email address, phone number, or Hide My Text messaging server.
Contact pairing
Build 1.8.4 pairing uses libsodium's X-Wing KEM, which combines X25519 and ML-KEM-768, together with an additional X25519-derived secret in Hide My Text's custom pairing composition. The result establishes the initial local secure relationship.
The signed response is bound to the exact invitation, role, protocol version, suite, and expiry. A consumed invitation is recorded locally to reduce accidental reuse.
The hybrid pairing layer strengthens the initial contact relationship. Safety-phrase comparison adds a clear person-to-person identity check before trust is confirmed.
Content protection
Hide My Text uses authenticated encryption built with libsodium primitives, including XChaCha20-Poly1305. Direct protected text and file payloads bind sender, recipient, identity, session, counter, and ratchet context so unauthorized changes are detected during reveal.
The app's protected Copy action requests iOS local-only clipboard handling with a 30-second expiration. Revealed temporary files are confined to the app's protected temporary area until the user chooses to save or share them.
Safety phrase verification
The invite and response establish the cryptographic relationship. Comparing the safety phrase through a separate trusted method confirms the contact identity before selecting Trust.
App access controls
Hide My Text requires an iPhone device passcode to create and open its encrypted local vault. Face ID or Touch ID is optional and may be used for App Lock when available, with the device passcode as fallback. The additional App Lock prompt is user-configurable, while the iPhone device passcode remains required. When App Lock is enabled, build 71 allows a 90-second background grace period before locking.
Keep the iPhone passcode enabled to preserve access to the device-only vault key. The recovery phrase and latest encrypted backup provide the recovery path when moving to a new device or rebuilding the local vault.
Recovery and exported backups
The recovery phrase recreates the local identity. An exported encrypted backup carries supported contact, group, and broadcast-list records for a broader restore. The app restores contacts and destination members as Pending so users can verify trust again.
Store the recovery phrase offline and keep the encrypted backup in a separate secure location controlled by the user.
Put local control into practice.
Protect sensitive text and supported files before sharing them through the apps you already use.