protestchat is a TypeScript-based encrypted messaging application designed to function without internet connectivity, cellular towers, or servers. Built in response to cellular jamming deployed during protests in Delhi in July 2026, the app enables phones to communicate directly with each other over Bluetooth mesh networking, allowing messages to be sent and received even when traditional mobile networks are unavailable or deliberately blocked.
The core architecture consists of a native Bluetooth layer that functions as a dumb byte pipe, handling only advertisement, discovery, connection, and byte transmission without implementing chat logic, storage, or cryptography at that level. This design choice concentrates security-critical code into a single implementation rather than spreading it across multiple layers. The routing mechanism uses an epidemic model rather than addressed routing tables, meaning every phone carries and offers every unexpired envelope it has seen to every peer it encounters. The recipient is determined by who can decrypt the message, not by explicit addressing. This approach provides the property that a captured phone reveals nothing about communication patterns, though it does consume more battery and bandwidth.
The application supports four distinct messaging modes. Everyone nearby mode broadcasts to any phone in range, including those running the app who are not contacts. Channels operate on a passphrase system with no owner, admin, or kick functionality, deliberately avoiding the privilege escalation vulnerabilities found in similar systems. Groups use fan-out encryption with one separately sealed copy per member, capped at fifteen people due to bandwidth constraints of the radio medium. Direct messages are encrypted for a single recipient. Channels have no rekeying problem because there is no shared group key, though a leaked passphrase ends the channel entirely.
The repository is written primarily in TypeScript with native modules for Bluetooth Low Energy communication. The mesh engine in mesh.ts accepts transport and storage by injection, allowing the entire system including relaying, deduplication, hop limits, channels, and fan-out to be tested via npm test without requiring actual radio hardware or phones. The project uses Expo for the React Native framework but requires development builds rather than Expo Go because custom native Bluetooth code cannot be loaded through Expo Go.
Android builds successfully and compiles against play-services-nearby, though the project ultimately abandoned Google Nearby Connections in favor of owning the radio outright. iOS development is currently blocked due to Google Nearby Connections only supporting Wi-Fi LAN on iOS rather than Bluetooth Low Energy, and lacking CocoaPods support. The custom BLE implementation uses CoreBluetooth on iOS and BLE GATT on Android. A significant security improvement from owning the radio is the ability to rotate the advertising identifier every fifteen minutes from fresh cryptographically secure random bytes, with no name or key material advertised at all, preventing the stable BLE identifier from becoming a tracking beacon.
Testing is partially automated through npm test for cryptography, channel keys, wire format, and mesh logic including relay, deduplication, hop limits, fan-out, and store-and-forward functionality. However, the actual radio discovery of peers cannot be tested in simulators or emulators and requires two physical phones in the same room. The manual testing protocol involves cutting network connectivity entirely, introducing phones in person to establish trust, verifying cryptographic fingerprints, and then testing message delivery, offline queuing, relaying through intermediate phones, and the various messaging modes.
The threat model and several features remain unimplemented, including background relaying on iOS, Double Ratchet forward secrecy, image support, Argon2id for channel passphrases, passphrase strength enforcement, synchronized group membership, Sybil and flood resistance, duress PIN and decoy mode, and reproducible builds. The project has not undergone independent security audit.
