NCraft security: what's protected, from whom, and what we found ourselves

NCraft has no server holding your data and no accounts to steal. But this design has risks of its own: every group member keeps a full copy, and your device holds your keys. Here is how it works, what it protects against, what it doesn't promise — and the honest results of our security audit.

Identity

• Identity key — Ed25519, derived from 24 words (BIP-39 word list). The words and the key never leave your devices; we never receive them.
• Device key — P-256 in secure hardware: Secure Enclave on Mac, TPM on Windows. The private half never leaves the chip.
• A device is a certificate signed by your identity key. A revoked device loses the right to act on your behalf in every group.
• Identity fingerprint — 20 characters in five groups (100 bits). Others recognise you by it and by your key pattern when comparing.
• Your own device is added only after comparing six digits on two screens.
• No passwords, sessions or sign-in — nothing to guess or intercept.

The 24 words, the backup and getting your identity back

• Backup of the 24 words. A device that holds the identity key keeps the 24 words, together with the signed list of your devices, in your platform's password storage: on a Mac and an iPhone in iCloud Keychain, on Windows in Windows Credential Locker (with a Microsoft account and password sync on, Windows may sync it to your other computers; with a local account it stays on this one). NCraft for Android keeps no backup in the cloud. We never receive the backup.
• A new device. "I already have an identity": if a backup is found — "Restore identity"; you can also add the device from another one of yours; and if neither a backup nor a device is left — enter the 24 words. Your previous devices are then revoked as lost, and the manager of each of your groups invites you back into it. Groups and history come from your other devices and from the members, not from the backup.
• The price of the backup. Anyone who can open your iCloud Keychain or your Windows account can use the backup to take your identity. Protect these accounts as you protect the words.
• Forget identity — with a tick box that also deletes the 24-word backup, on by default. The backup is shared by your devices on that account: if you untick the box, it stays, and a device that still holds the key saves it again.
• Owner return (macOS, iPhone, Windows and Android). An owner who lost all their devices can take the group back too: an admin, the successor or, if there is neither, any member invites the owner who came back with the words. Members see the return in the group; whoever made the invitation can "Withdraw" it before the date. After a waiting period (the one set for the successor, or 7 days) the new device joins as owner provisionally: until the return is final (the previous devices accept it, or 30 days pass) it cannot remove members, change rights or the successor, or delete the group. Any of the owner's previous devices that still works can answer "Not me — refuse".

Devices: approval, revocation and expiry

A device certificate lasts 400 days. The core starts renewal with 60 days or less remaining and warns with 30 days or less remaining. There is a 7-day grace period after expiry; an expired certificate cannot act as the group arbiter. Renewal preserves the identity and device keys rather than creating a new person.

Device revocation is signed with the identity key. If the device does not hold that key, the 24 words can be entered for the operation. The words prove the identity; they do not recover group history by themselves. During its first day, a new device has restricted owner management actions. Approval by an already trusted device can lift that period. Other devices verify revocation and approval rather than trusting a local button alone.

Encryption key rotation

Your own MLS leaf encryption key is updated through a signed request and a group commit. The core checks the 30-day interval; the date survives restarts and rollback, so sleeping does not restart the clock. This rotation does not change the record signing key, certificate or identity: historical signatures remain verifiable. Rendezvous keys and the signing key are separate keys, not a single shared rotation.

Change group keys

Owners and admins can "Change group keys" — on macOS, iPhone, Windows and Android. The group's meeting and notification keys change: the old ones stop working, and members receive the new ones on their own. This removes no one from the group: to cut off a lost device, revoke it with "Revoke device"; to leave yourself, use "Leave group".

These statements describe verified source code. Native macOS and iOS shell verification remains a separate step; publishing source code does not mean a public app release.

What is encrypted

What the server sees

NCraft uses three rendezvous servers — asia.ncraft.live, eu.ncraft.live and ru.ncraft.live — only so devices can find each other and open a direct connection. A device connects to whichever server answers first; the servers exchange only rendezvous tags and invitation windows with each other, never content, so devices on different servers can still find each other.

• They see: your IP address, packet sizes and timing, short-lived random tags.
• They don't see: who you are, which groups you're in, any content. They hold no keys; the tags are derived from a group key the server doesn't have.
• They keep this in memory for seconds to minutes (a presence record lives 90 s), never write it to disk and don't log requests; only aggregate counters without addresses remain.
• Calls, group data and files never go through our servers: a file comes from the device of a member who has it.
• A group's own relay (TURN), if its organiser set one up, sees the IP addresses of the group's connections and encrypted traffic. We don't control such servers.
• A device you connect to directly learns your IP address, as with any peer-to-peer connection.
• Notifications on macOS. If you allow notifications, a member's device can wake your Mac through our server and the Apple Push Notification service. The server sees the push address and the time of sending, can't read the payload (it never contains message text) and stores nothing. NCraft for Windows shows notifications only while it is running.

Signing in to NCraft sites

The sites ncraft.live and *.ncraft.live can ask the browser to identify itself (a 401 answer with WWW-Authenticate: NB). NCraft answers on its own, without asking: it signs the challenge with the device key and repeats the request. The site learns your identity key, fingerprint and device number — nothing else.

• A private tab and a device without an identity don't answer.
• Other sites never get your identity: the list of addresses is built into the core.
• A closed section of our site remembers the sign-in with a cookie for up to 12 hours; changing the service secret ends every sign-in at once.
• Available on macOS, iPhone, Windows and Android.

Threat model — who we defend against

1. An outsider on the internet or on the network path — can't read or alter data: everything is encrypted and signed.
2. A rendezvous server operator (including us) — doesn't know who talks to whom and sees no content.
3. A stranger on your local network — can't slip into pairing or an invitation without matching six digits.
4. A malicious group member — sees what was shared in the group (as in any shared workspace), but must not control your browser, read your disk or break the group. This is the hardest class, and where the audit found the most (see below).
5. Malware running as your user — not fully defended against: it sees what you see. We reduce the damage (Windows Hello before showing the 24 words, device key in the chip) but make no promise.
6. A stolen device — locked and with disk encryption (FileVault / BitLocker) it doesn't give up data without the sign-in password. Unlocked — same as 5. Revoke a stolen device from another of yours.

What NCraft does not promise

• To delete from others what they already received. "Delete for everyone" removes the record from the group, but a copy a member already saved can't be recalled.
• To change your identity key after the 24 words are stolen: a different key is a different person. Keep the words safe.
• To hide your IP from the other party on a direct connection.
• To protect you from websites: sites get what any browser sends them. The exception is NCraft's own sites: the browser identifies you to them by itself (see "Signing in to NCraft sites").
• To scan files you receive: NCraft has no antivirus of its own. It warns you before a program, and on macOS and Windows a saved file carries the system's download mark — Gatekeeper, SmartScreen and your antivirus check it from there.

Security audit (2 October 2026)

Several independent auditing agents reviewed the core, both apps, the protocol, the rendezvous server, the bot and the build; each finding was then checked separately "against the code" and "as an attacker".

150 confirmed, 125 not fully verified, 1 refuted. Many entries duplicate each other — different auditors found the same issue (all three critical entries are one issue).

Key findings

• Remote-command rights were too broad by default. A group member could use a remote command to reach files on another member's disk and see their tabs. Fixed (Windows 0.35.2–0.35.4, shared core): disk access is a separate dangerous right, off by default, and even when granted it refuses network and system paths and never overwrites files; tabs are visible only to people you allowed personally; a group policy can only narrow rights; a command is accepted only over its own group's channel.
• Validation of incoming journal records — signatures and binding, "delete for everyone", identity facts in mail, call signals, page addresses from members. Fixed in core slices 3 and 4a (journal v2).
• Rendezvous server and transport — denial-of-service resilience. Fixed.
• Build and supply chain — dependencies weren't pinned. Fixed: Cargo.lock, --locked builds, pinned NuGet packages, hardening flags in the Windows build (Windows 0.35.3).
• Windows app — page addresses, the page agent bridge, find in page, nb:// links, remote control, full screen. Fixed (Windows 0.36.0); the matching macOS slice is published.
• Rights when group membership changes (who may change membership and ownership). In progress — the fix is under review (6 Oct 2026).
• Not closed as of 6 Oct 2026: signed device revocation, races between concurrent membership changes, post-compromise security (PCS); the Windows installer isn't Authenticode-signed yet; storage of the 24 words on the first device (Windows).

Source checkpoint on 8 Oct 2026: signed device revocation and rotation of your own MLS leaf encryption key are implemented and tested in the core. This updates the 6 Oct status above; it is not a claim of complete protection after device compromise. Native macOS and iOS acceptance remains separate.

As of 20 Oct 2026 no platform keeps a copy of the 24 words in a file on the device: the identity key is in NCraft's encrypted database, and the backup of the words is in the platform's password storage (see "The 24 words, the backup and getting your identity back").

We aren't publishing the full report yet: it contains findings that are still open.

Report a vulnerability

Write about vulnerabilities to support@ncraft.live; about abuse — to abuse@ncraft.live.