How to use ANCROM

Step-by-step guides for pairing contacts, stealth mode, decoy screen, duress PIN and emergency wipe.

Contents

Add Contact via QR Add Contact via Code Add Contact via Link Stealth Mode Decoy Screen Duress PIN Emergency Wipe Coming from Signal or Wire FAQ
Contact Pairing

Add a Contact via QR Code

Both phones need to be in the same room. Takes about 30 seconds.

Both people must add each other.Person A scans Person B. Person B scans Person A. Only then can you message each other. Scanning in person also verifies the other person's security key.
Person A
ScanMy QR
Shows QR to Person B
My QR tab - show to Person B
B scans
A's QR
Person B
ScanMy QR
Nickname: Alice
camera - point at A's QR
Scan tab - nickname - scan A - Add contact
then swap
Person B
ScanMy QR
Shows QR to Person A
My QR tab - show to Person A
A scans
B's QR
Person A
ScanMy QR
Nickname: Bob
camera - point at B's QR
Scan tab - nickname - scan B - Add contact
Both tapped Add contact - you can now message each other
Secure key exchange happens automatically in the background
Not working?

One side probably did not complete the last step. Both must tap Add contact - not just one person.

Contact Pairing

Add a Contact via Code

Use this when you are not in the same room - for example during a phone call. One code adds you to each other. Takes about a minute.

No trusted channel needed

The code works once and expires after 10 minutes. Our relay never sees its secret part, and anyone who tries to interfere gets a single guess - a chance of about one in a billion. If someone overheard the code and got in first, you would not see the same number on both screens. That's why the last step matters.

1
Both: open the Code tab
Open Add Contact, switch to the Code tab and enter a nickname for the other person.
2
Person A: create a code and read it out
Tap Create code. The code has ten characters, for example:
7K4M-9Q2-XT8
Read it out to your contact and keep this screen open until you are done.
3
Person B: enter the code
Type the code under Enter a code and tap Pair. Upper or lower case and the dashes don't matter.
4
Both: compare the number
Both phones now show a six-digit number. One of you reads it out, the other compares. Tap Same number only if it matches - the contact is then saved and becomes verified as soon as the secure connection is set up, just like after a QR scan. If it differs, tap Different and create a new code together.
Not working?

Keep ANCROM open on the pairing screen on both phones until the number appears. If the code has expired, create a new one. If your phone says the code was already used, someone else may have entered it: tell your contact right away to tap Different, then create a new code together.

Privacy Features

Stealth Mode

Change the app icon so ANCROM appears as Calculator, Notes, or Weather on your homescreen.

iOS will briefly notify you when the icon changes

This is required system behavior by Apple and cannot be suppressed. The notification disappears automatically.

1
Open Settings
Tap the Settings tab in the bottom navigation bar.
2
Scroll to Stealth Mode
Find the Stealth Mode section. Choose from Calculator, Notes, or Weather in different color variants.
3
Choose an icon
Tap your preferred style. The homescreen icon changes immediately. To revert, tap ANCROM (Original).
4
Hide the original app
Long-press the ANCROM icon, move it into a folder on a back page of your homescreen. Only the disguised icon remains visible.
Tip: Create an iOS Shortcut with a custom name

Open the Shortcuts app, tap + then Open App, select ANCROM, tap the three dots, rename to "Calculator", then Add to Home Screen. This lets you set any name for the shortcut on your homescreen.

Privacy Features

Decoy Screen

When enabled, ANCROM opens as a fake app on launch. Only your secret unlock code reveals the real app.

You must set a Stealth icon first

The Decoy Screen only works when a Stealth icon (Calculator, Notes, or Weather) is active.

1
Choose a Stealth icon
In Settings, select Calculator, Notes, or Weather. The decoy screen will match this icon.
2
Enable Decoy Screen
Scroll to the Decoy Screen section and toggle it on.
3
Set your unlock code
Enter a secret code and tap Save Unlock Code. Remember this code - you need it every time you open the app.
How to unlock - by decoy type
Calculator
Type your unlock code as a number on the calculator, then press
1337 =
Notes
Tap the New Note entry at the bottom, type your unlock code, then press Return
mysecret Return
Weather
Tap your unlock code digit by digit on the number pad at the bottom of the weather screen
4 2 1 9
Security

Duress PIN

A secondary password that silently wipes all data when entered. Designed for situations where you cannot refuse access.

This action is irreversible

Entering the Duress PIN permanently deletes all contacts, messages, and your identity. There is no recovery.

1
Open Settings - Duress PIN
Scroll to the red Duress PIN section in Settings.
2
Set a PIN (6+ characters)
Enter a PIN that is different from your regular password. Never share this PIN.
3
Tap Save Duress PIN
The PIN is stored securely on your device only. If someone forces you to unlock, enter this PIN. The app silently wipes everything and restarts empty.
Security

Emergency Wipe

Instantly and permanently destroy all data with a single code - no password required.

1
Open ANCROM
You will see the password entry screen.
2
Enter the emergency code
Type the emergency wipe code in the password field:
0000
3
Confirm twice
After the second confirmation, all contacts, messages, your identity, and your password are permanently deleted. This cannot be undone.
Comparison

Coming from Signal or Wire

Straight answers for people who already use an encrypted messenger.

I already use Signal. Why would I need ANCROM?
Signal protects your messages very well on the way. ANCROM adds protection for your account and your phone: no phone number and no SMS code that could be phished to take over your account, a duress PIN that silently wipes your data and leaves an app that looks freshly installed, an emergency wipe code at login, and a disguise as a working calculator. If none of these risks applies to you, Signal may be all you need.
Is ANCROM more secure than Signal?
Not across the board, and we won't claim it. Both use a Double Ratchet with forward secrecy and post-quantum key exchange, and both keep adding post-quantum protection while a conversation runs - ANCROM renews an ML-KEM-1024 key every 50 messages or 24 hours. Both hide the sender from the server: ANCROM seals every message to the recipient, so the relay only sees the anonymous mailbox it is delivered to. Signal is clearly ahead in maturity: the Signal Protocol has been studied by independent researchers for years, while ANCROM has not been independently audited yet. ANCROM is ahead where your phone or your identity is the risk: no phone number, no SMS code, duress PIN, emergency wipe and calculator disguise.
How is ANCROM different from Wire?
Wire needs an email address, has a user search and today focuses on organisations - including a version approved by Germany's BSI for classified information, which ANCROM does not have. ANCROM needs no email, has no directory (contacts only by QR code, link or one-time code) and adds duress PIN, emergency wipe and calculator disguise. ANCROM is built in Germany; Wire is a Swiss company with servers in Germany and Ireland.
Can I keep using Signal or Wire?
Yes. ANCROM works fine next to Signal or Wire: everyday chats stay where they are, and conversations that must not be found on the phone move to ANCROM.
Can I bring my Signal or Wire contacts?
No - on purpose. ANCROM never reads your address book. You add each contact by QR code, link or one-time code, which is also how you verify that you are really talking to them.
Has ANCROM been independently audited?
Not yet. ANCROM's encryption - the ANCROM Protocol - uses only standardised building blocks - ML-KEM-1024, ML-DSA-87, ECDH and ECDSA on P-384, AES-256-GCM and SHA-384 - and no self-made cryptography. An independent audit is planned; we will publish the results here.
FAQ

Frequently Asked Questions

What happens if I forget my password?
There is no password recovery. Your password is the only key to your data. If you forget it the data is permanently inaccessible.
Can I use ANCROM on multiple devices?
Not at this time. ANCROM is designed for single-device use. Your identity and keys live exclusively on your device.
What happens if my contact is offline?
Your message is encrypted and delivered to our relay right away - your contact's phone has prepared keys for this in advance. The relay keeps it for up to 24 hours until your contact's phone fetches it. If your contact is still on an older ANCROM version, the message waits encrypted on your phone and is sent automatically once they have updated.
Can ANCROM be compelled to hand over messages?
We could only hand over what our relays hold at that moment: encrypted messages that have not been delivered yet (at most 24 hours old), the anonymous mailbox addresses they are sent to, and public keys. We cannot decrypt any of it, and none of it contains a phone number, email address or name. Delivered messages are deleted from the relay immediately.
Is pairing by code safe if someone listens to the call?
Yes, as long as you compare the number at the end. The code alone is not enough to sneak in unnoticed: if an eavesdropper uses it first, your contact's phone reports the code as already used and shows no number to compare - so tap Different on your phone and create a new code together. Our relay only sees the first part of the code, which tells it where to meet; the secret part never leaves your phones. Each code works once and for 10 minutes.
Why do we have to compare a number?
The number is calculated on each phone from the keys you just agreed on. It only matches if your two phones really talked to each other directly. Comparing it takes a few seconds and is what makes a contact added by code verified.
What does "Not verified" in a chat mean?
The conversation is encrypted, but you have not yet confirmed that the security key really belongs to your contact. Tap the note to compare the security number, or scan your contact's QR code in person. Contacts added by code become verified as soon as the secure connection is set up after you compared the number. If a contact's key ever changes unexpectedly, ANCROM stops sending to them and warns you.
What does Perfect Forward Secrecy mean?
Every message is encrypted with its own key (Double Ratchet), and each key is deleted after use. Someone who obtains a key later cannot decrypt earlier messages. After a compromise, protection is restored automatically as soon as both devices have exchanged new keys.
If I uninstall and reinstall can I recover my account?
No. Uninstalling ANCROM permanently destroys your identity and all data. There is no cloud backup. This is by design.
Does ANCROM work without internet?
You need an internet connection to send and receive messages. Reading already-delivered messages stored on your device works offline.