For work where a leak is not an option.
Journalists, lawyers, executives, field teams — exchange messages, files, and calls under post-quantum end-to-end encryption. No phone number. No email. And if your device is gone, so is everything on it. By design.
60 seconds. No phone number. No email.
Trusted for work that cannot leak
City of Hats is built for people whose conversations carry real consequences.
Journalists & sources
A source taps your Phrase ID and reaches you encrypted — no numbers exchanged, and neither phone carries the other’s name.
Legal & investigations
Privileged conversations and case files move under sender-controlled locks — PIN, biometrics, GeoLock — and can be recalled or burned.
Executives & deal teams
M&A, board matters, negotiations — discussed on identities that exist only for the deal and disappear when it closes.
NGO & field operations
Coordinate in difficult environments: no phone numbers to harvest, view-once briefings, and calls that never expose an IP address to the other side.
Enterprise & partner exchange
Two organizations needing one channel they both trust — contracts, audit evidence, incident data, customer records. Not email. Not a shared drive. Encrypted end to end, with access you can revoke after the handoff.
Privacy for everyone
You don’t need a dangerous job to want conversations that belong only to you.
Don’t trust us. Check us.
Security claims are cheap. Here is what you can verify — and what we deliberately cannot do.
No recovery. That’s the feature.
Lose your device and your messages are gone — there is no backup vault, no recovery email, no support desk that can restore your account. Nothing exists for anyone to seize, subpoena, or force out of you. Get a new phone, create a new Hat, keep going.
Learn More →Warrant canary
A regularly updated public statement that changes if we are ever compelled and gagged. Watch it — don’t take our word for it.
View the canary →Named cryptography, not adjectives
X25519 + ML-KEM-768 hybrid key agreement feeding a Double Ratchet. AES-256-GCM. Fresh keys for every call. Group keys rotate on every membership change.
Learn More →Key transparency log
Identity keys are published to a signed, append-only log that your app verifies and cross-checks with your peers. A swapped key becomes evidence, not a secret.
Learn More →Calls never expose your IP
There is no peer-to-peer mode to leak your location to the other side. Every call is relayed with end-to-end encrypted media — by architecture, not by a setting you have to find.
Learn More →How we compare — on facts
| Capability | City of Hats | Signal | Telegram | |
|---|---|---|---|---|
| Phone number to sign up | Never | Required | Required | Required |
| Burnable pseudonymous identities | Unlimited Hats | No | No | No |
| Post-quantum key agreement | Yes — ML-KEM-768 hybrid | Yes | Not yet | No |
| Message recovery path | None — by design | PIN-based recovery | Cloud backups | Everything on their cloud |
| Per-message security controls | 11 modes — view-once, GeoLock, NFC, watermark, recall… | Limited | Limited | Limited |
| E2EE on by default, everywhere | Yes — including groups & calls | Yes | Yes | No — Secret Chats only |
| Controlled sharing after you hit send | Yes — 11 modes on every message and file: view-once, recall, GeoLock, biometric, NFC tap, PIN-sealed, invisible watermark | Disappearing messages only | View-once & delete-for-everyone | Self-destruct timer (Secret Chats) |
Comparison reflects publicly documented behavior of each app’s default configuration at the time of writing.
11 security controls no other messenger offers
You stay in control after you hit send. Every message and file carries sender-side locks the receiver cannot strip.
| # | Mode | Description |
|---|---|---|
| 1 | View Once | Self-destructs after a single view |
| 2 | Recall | Pull it back anytime, even after delivery |
| 3 | Sealed File | PIN-locked; share the code on your terms |
| 4 | Unlock Content | Recipient pays to access |
| 5 | Verified Eyes Only | Requires biometric face liveness verification |
| 6 | GeoLock | Only viewable from an approved location |
| 7 | Voice Lock | Recipient must pass voice verification |
| 8 | Hold to Reveal | Must physically hold the screen to read |
| 9 | Certified Send | Opens in a Protected Viewer with cryptographic proof of who opened it and when |
| 10 | Hat Tap to Unlock | Recipient must tap their NFC Hat to view the file — physical presence required |
| 11 | Invisible Watermark | Marks the file with the viewer’s identity — if it leaks, the trail points back to who opened it. |
View Once
Self-destructs after a single view
Recall
Pull it back anytime, even after delivery
Sealed File
PIN-locked; share the code on your terms
Unlock Content
Recipient pays to access
Verified Eyes Only
Requires biometric face liveness verification
GeoLock
Only viewable from an approved location
Voice Lock
Recipient must pass voice verification
Hold to Reveal
Must physically hold the screen to read
Certified Send
Opens in a Protected Viewer with cryptographic proof of who opened it and when
Hat Tap to Unlock
Recipient must tap their NFC Hat to view the file — physical presence required
Invisible Watermark
Marks the file with the viewer’s identity — if it leaks, the trail points back to who opened it.
Cyber intelligence inside your conversations
No dashboard. No separate login. Just type a command in the chat.
-
Risk scoring and exposure analysis
-
Credential detection across security databases
-
Carrier verification and SIM swap detection
-
IP reputation with VPN/proxy/Tor detection
-
Results delivered as self-destructing secure reports
Get started in 30 seconds
No phone number. No email. No sign-up form. Watch how to create your first anonymous Hat identity and start a secure conversation.
Sixty seconds to your first secure conversation
Create a Hat
Pick a Phrase ID — a memorable phrase like “the grass is green.” No phone number, no email, nothing that names you.
Share your Phrase
Say it, print it, or hand over an NFC card. Anyone who has it can reach you encrypted — and nothing else about you.
Talk, send, burn
Message, call, and share files under your security modes. When a conversation should stop existing, burn the Hat.
More than a messenger
Visual experience builder
Design branded, secure micro-apps — menus, forms, guides — without writing code.
NFC & QR access
A tap or a scan onboards a guest or teammate into a secure channel. No app download required.
Live translation
Speak your language; they read theirs. 17+ languages inside end-to-end encrypted conversations.
Running a hotel, clinic, school, or team?
The same security architecture powers branded guest and staff experiences.
Straight answers
Can City of Hats read my messages?
What happens if I lose my phone?
Do I need a phone number or email to sign up?
What is a warrant canary?
How much does City of Hats cost?
Your first Hat takes 60 seconds.
No phone number. No email. Nothing to recover — by design.
Available on
Free forever. Premium features available.