Part 1: Messaging that doesn't need a platform
Part 1 of a series introducing Mesaĝkesto, a protocol for secure messaging between self-certifying identifiers.
A note on "messaging"
Throughout this series it means any digital communication between peers: email, chat, a calendar invite, a shared document, a photo album, a file drop, a task assigned to a colleague, a payment request. All of it is the same operation underneath — a piece of data, authored by someone, sent to someone else, and readable later. We generalise deliberately, because the problem generalises: your shared drive, your photo storage and your project tracker lock you in exactly the way your chat app does, using exactly the same mechanism — an account you don't own, holding data you can't move. Solving it for chat alone would just relocate the cage.
Pick your favorite messenger and try to leave it.
Not "stop using it" — leave it, and keep being reachable. Keep your name, your contacts, your history, your groups. Move to a different provider the way you moved phone number when you changed carrier. You can't. Not because of technology is bad — some of these apps have excellent cryptography and infrastructure — but because of something much more basic:
the thing that identifies you was issued by the service you are trying to leave.
Even our best case is a lease
Hold on to that comparison with phone number for a moment, because it's worth taking seriously. Number portability and your own email domain are the closest thing to identity portability that exists at scale, and they took decades of regulation and standards work to get. They are genuinely good. They are also where the ceiling of the current model becomes visible.
A phone number you "keep" across carriers is still not yours. It's an entry in a national numbering plan, allocated to a carrier and lent onward to you, for as long as you keep paying and nobody makes a mistake. Stop paying for a few months and it gets recycled to a stranger — along with, in practice, every account that treats it as proof of who you are.
Email is worse, and the “free-provider” case is barely worth arguing: @gmail.com is not your identifier, it's your section of theirs. Suspension takes the address, the archive and every account that used it for recovery in one motion, often with no human to appeal to. So you do the responsible thing and buy your own domain. This really is better — you can change mail hosts without telling anyone. But "buy" is marketing. You are renting a name from a registry through a registrar, on annual terms, subject to their policies, their disputes process, their national jurisdiction, their court orders, their errors. Domains are seized, suspended, lost to a lapsed card, lost to a compromised registrar login, transferred out from under their owners. Even at the very top of the market — where you own the infrastructure, run the servers and pay for the trademark lawyers — the name is still held at someone else's pleasure. And underneath all three sits the same quiet mechanism: it's a subscription, and the renewal price is not yours to negotiate. Keep paying, at whatever the number becomes, or the name goes away. Your carrier restructures its packages and the tariff you signed up for no longer exists; a registry decides renewals now cost several times what they did. There is no appeal, because nothing was breached, and no negotiation, because you have no position to negotiate from. You are one customer among millions and the counter is running.
And the price has nothing to do with the service being delivered. Two domain names cost the registry the same to operate — a row in a database, a few DNS answers — yet one renews for ten dollars a year and another is a seven- or eight-figure asset because somebody wants the string. The voice.com changed hands for thirty million dollars; short, obvious names like ai.com trade in the tens of millions. Registries formalise this: they mark desirable names "premium" and attach permanently elevated renewal fees to them, so the same service costs a hundred times more purely because of what the name is worth to you. Which means the exposure isn't only that your provider might raise the price — it's that anyone in the world can decide your name is worth more than you can pay. Let the renewal lapse by a week and you'll find out how that works in practice: expired names go to drop-catch auctions, where the highest bidder takes it. Not a court, not a dispute, not a policy violation — just someone with a bigger budget who liked your address. If your identity is a tradeable asset, you are permanently one auction away from losing it.
What makes it extraction rather than ordinary pricing is that the usual escape doesn't exist. When your internet gets expensive you switch supplier and get the same connectivity. When your name gets expensive, leaving means giving up the name — and the name is the thing you built everything on. So the pressure runs exactly backwards from a healthy market: the longer you hold an identifier and the more that depends on it, the less able you are to walk away, and the more safely it can be repriced. You did the work of making the name valuable; they hold the switch. That's not a customer relationship, it's a hostage negotiation with a payment plan.
And the reason this matters more than it sounds is that the identifier is the recognition. It's what your contacts have saved, what your peers type, what every other service treats as proof of you. It doesn't just address you — it anchors the whole graph of everything linked to you. Whoever can take it away can take all of it in one move: the contacts who can no longer reach you, the accounts that reset into someone else's hands, the reputation the name accumulated. That is a lot of consequence for a rental, and no amount of encryption is protecting any of it. We should notice how strange this is. The most portable identifiers we have ever built are ones we do not own, and every one of them has a party who can end your control of it without your consent. The problem was never that we picked a bad landlord. It's that a name issued to you by someone else always has a landlord.
The account is the lock-in
Messengers inherit that problem and then make it worse, because they don't even have the portability. Every mainstream one, however privacy-preserving, starts the same way: you prove you control a phone number, or you pick a username, and the operator creates a row — this identity exists, and it exists here. Your identity is now a sublease on a lease. It can be suspended, recycled to whoever gets your old number next, or simply dissolved when the company is acquired or shut down. And unlike a domain, there is no equivalent of pointing it somewhere else: the row cannot leave the building. End-to-end encryption doesn't touch this. E2E is a promise about the contents of your messages. It says nothing about who gets to decide that you exist, who sees whom you talk to, or what happens to twelve years of conversation when a service shuts down. You can have perfect forward secrecy and still be a tenant.
That's the structural problem. Everything else — the walled gardens, the failed interoperability mandates, the awkward "export your data" ZIP file nobody can import anywhere — follows from it.
What "platformless" means
Platformless is the inversion: you bring the identity, and the service becomes infrastructure. Two familiar systems each get half of this right, and it's worth borrowing from both.
First, your ISP (Internet Service Provider) carries your packets: it doesn't own your correspondence, doesn't decide who you are, and can be swapped for a competitor without notifying anyone you talk to. It is plumbing — and good plumbing is valuable, worth paying for, and completely replaceable. The second is postal (e.g. national post) service gets the other half, as we'll see in a moment.
Messaging can work like that, but only if three things are true at once:
Your identifier is created and controlled by you. Not assigned, not allocated, not looked up in anyone's table. There is no registry to renew it with, no dispute process that can reassign it, no billing failure that recycles it to a stranger. Nobody can issue it, because you didn't get it from anyone; nobody can take it, because there is no party holding it on your behalf.
The relay is blind. Think about how the post works. You hand over a sealed envelope; the carrier reads the outside, moves it, and delivers it. It could steam it open — physically nothing stops it — and the entire institution rests on the fact that it doesn't. Centuries of that discipline, backed by law and habit, are why the postal service is still the most universally trusted messaging system humans have built: you can write to anyone, anywhere, and the people carrying the letter are not part of the conversation. That norm is the right target, but "we don't look" is a promise, and promises scale badly — a courier can be bribed, digitised, acquired, or simply instructed differently by next year's management. So take the sealed envelope literally and go one step further: a relay shouldn't need to know what your messages say, who sent them, or who you're allowed to hear from. Not "promises not to look" — structurally unable to. Where the post earns trust, a protocol can remove the need for it. That includes the social graph, which is the piece end-to-end encryption conventionally leaves on the table, and which is usually the more valuable piece.
Conversations are portable by construction. Stay with the post a moment longer, because it gets something else right that no messenger does. A letter is yours. Once it arrives, it's in your drawer — not in the carrier's account system, not subject to their retention policy, not deleted when they restructure. The archive lives with the correspondents. And the network reaches everyone: no post office asks which provider the recipient is on, whether they run the same software, or whether the two companies have an interoperability agreement. You write the address, and it goes — across operators, across borders, to anyone. Digital messaging traded both of those away for convenience, and the trade was worse than it looked. Getting them back means the same shape: if every message is signed by its author and carries its own position in an ordered log (message is self-contained), then a conversation isn't state trapped inside a server. It's a document that all participants hold a copy of — the drawer, not the account. Any of them can rebuild it somewhere else, and the others can resync — no export tool, no migration assistant, no goodwill of the operator required. And because the address is your identifier rather than a provider's namespace, delivery works the way the postal address does: any box can route to any other, without a bilateral deal between the two.
Get those three and "switching providers" stops being a feature someone has to build for you. It becomes something the protocol makes uninteresting and by default available.
Introducing mesaĝkesto
Mesaĝkesto — Esperanto for message box — is a protocol for exactly this shape. The name is the design: it is a box, not a platform. A place where you leave something for someone, and where they come to collect it. It's worth being precise about why such a place has to exist at all, because "why do we need a server?" is the first question anyone asks. Physical goods have to be carried: a letter occupies one location at a time, and the postal network exists to move the object itself. Data isn't like that — it copies perfectly and travels at the speed of the link — so in principle two people could just send it to each other directly, and when both are online and reachable, that's exactly what should happen.
The trouble is that "both online at the same moment" is the exception, not the rule. Your phone is asleep, on a train, behind a carrier-grade NAT, out of battery, or simply not the device you'll read this on. Communication that only works when both ends are simultaneously connected isn't communication, it's a phone call — and every attempt to make purely peer-to-peer messaging pleasant has run aground on this. So somebody has to hold the message in between. Not carry it: hold it. That's the entire job.
That is what a box is. You find a place on the internet — any place, one that someone runs well and you can reach — and you leave the message there, addressed to its recipient and sealed so that only they can open it. It sits there, patiently, until they come and take it. The box operator is not a party to the conversation any more than a locker is a party to what's inside it. They are running a buffer, and buffering is honest, useful, unglamorous work worth paying someone to do properly.
A box does very little on purpose. It accepts signed messages addressed to identifiers it hosts, hands them out to whoever can prove control of that identifier, and forgets them according to a policy you agreed to. It doesn't own your name. It can't read your messages. It doesn't know your contact list. It has no opinion about your groups. Which is what makes boxes interchangeable. If your box is down, slow, overpriced, or shut off tomorrow, you find another one and tell people where it is — a signed update to your own identity, not a change of who you are. The messages already delivered are in your hands, not the operator's; the conversations are held by everyone in them; your name never mentioned the box in the first place. Losing a box should feel like losing a locker you'd already emptied: mildly annoying, not catastrophic. That's not a recovery feature bolted on afterwards — it's what's left over when the box is genuinely only a buffer.
Everything interesting happens at the edges, in the clients — which is where it should happen, because the edges are where the identity is. The three properties above map onto three ideas the rest of this series will unpack:
Self-certifying identifiers. Your identity is a key event log, not an account. It has history, it can rotate keys after a compromise without changing your name, and anyone can verify its current state without relaying on third party. This is KERI, and next post is a gentle introduction to why it matters for messaging specifically.
A relay that authorizes without identifying. The most surprising part of the design: a box can enforce "only my contacts may write to me" while holding no idea who your contacts are — because what it stores is a set of opaque tokens derived from a secret only you hold. It can check membership; it cannot enumerate.
Conversations as signed, ordered logs. Direct chats, groups and public broadcast feeds are the same primitive with different answers to "who may write" and "who may read". Because they're logs of signed events, they can be verified by anyone and rehosted by anyone.
Then the two questions you're already asking: can boxes talk to each other? (yes, and the routing is derived from the identity itself, so there's no server list to join, read: Part 6 ), and what happens when my box goes away? (you “keri on” ;), read: Part 7 ) All that and more would be cover in following posts.
What this doesn't fix
A short list, stated up front, because a protocol pitch that only lists wins isn't worth reading.
Metadata. Encrypted contents and an unnamed sender still leave an observer knowing that a box received something, roughly how big, and when. That's a real leak. There are known mitigations — rotating delivery addresses, padding to fixed size buckets, cover traffic — each with a real cost in battery and bandwidth.
Availability. A box you depend on can go down, and while it's down you're not receiving. Portability is the answer to permanent loss, not to Tuesday afternoon.
Key loss. When your name is your keys, losing your keys is serious. Rotation and delegation help a great deal; social recovery is a genuinely hard problem and it is not finished.
Adoption. Correct protocols don't win by being correct. Most people you want to talk to are somewhere else, which is why bridging to email and existing networks is part of the picture rather than a betrayal of it.
Why this is worth doing anyway
Because the alternative keeps failing in the same way. Every few years a messenger with genuinely good cryptography/ privacy/features arrives, everybody migrates, and five years later it is acquired, or it pivots, or it quietly changes its terms — and everyone discovers again that someone is holding them hostage. Identity you actually hold is not a feature you can bolt onto a platform. It has to be the starting point.
Next: Your identity is not an account — what a self-certifying identifier is, why it has a log, and why that log is what lets you survive a key compromise without losing your name.
