Download Kryfo 0.6.0

Almost everyone: arm64-v8a.

Not sure? Take arm64-v8a. If Android says it is not compatible, take armeabi-v7a. x86_64 is for emulators and Chromebooks.

Almost every phone

arm64-v8a

kryfo-0.6.0-arm64-v8a.apk · 88.7 MB

Download

SHA-256 of the file604cd7badd763f675e227a82844565c08e170d31b54c0ce8aae4b1939bcd3b86

Every ARM phone, one file

universal

kryfo-0.6.0-universal.apk · 165.7 MB

Download

SHA-256 of the filee0744504a396741a32853ee134b3b45fbd69182feed2883a2ea6751cdba06168

Older phones

armeabi-v7a

kryfo-0.6.0-armeabi-v7a.apk · 82.8 MB

Download

SHA-256 of the file1f538463356c3f175a7a9be138e289cffaea8db762173644c180664f8e876fc6

Emulators, Chromebooks

x86_64

kryfo-0.6.0-x86_64.apk · 94.5 MB

Download

SHA-256 of the file17ed58cc414190afdb68766736437f39daeb2c1714f635141100eb9012b3555c

Files come straight from kryfo.app and work in Tor Browser. Android warns about installs from outside the Play Store: allow it for your browser or files app, then open the file again.

Have Kryfo from Google Play? Update it there, or back up, uninstall and restore to switch.

On a computer: early betas.

Built from the same release. Use it alone, or link it to your phone in Settings.

Windows 10 and 11 · beta

Windows

kryfo-0.6.0-windows-x64-setup.exe · 38.9 MB

Download

SHA-256 of the fileab6544bd0c62c0af98b41c97414cfe6c01222f39519f03f7aae988da25562f46

Linux · beta

Linux

kryfo-0.6.0-beta-linux-x64.tar.gz · 45.8 MB

Download

SHA-256 of the file0f604274bae7c175cfc1bf857fe44dfdf22a41d2913ee941b95deb9f498da254

The Windows installer is not signed yet, so SmartScreen says Windows protected your PC. Check the file, then choose More info and Run anyway. Closing the window keeps Kryfo in the tray.

Which Windows files we sign and who approves them: the code signing policy.

On Linux, unpack the file and run ./install.sh. It installs for your user, without root. ./install.sh --remove removes it and keeps your messages.

The Linux beta needs glibc 2.38 or newer: Ubuntu 24.04 or newer, Debian 13, Fedora 39 or newer.

Make sure it is really ours.

Either check catches a changed file: the checksum, or the signing key.

Where to get Kryfo

Only install Kryfo from Google Play, F-Droid, the GitHub releases page or kryfo.app. Copies elsewhere, like APK mirrors such as openapk.net, are not ours, even when they look the same.

Packages from kryfo.app, GitHub and F-Droid carry the signing key below. On Google Play, Google signs with its own key.

The checksum

On a computer, compare the file's SHA-256 with the one above it.

# Linux
sha256sum kryfo-0.6.0-arm64-v8a.apk
# macOS
shasum -a 256 kryfo-0.6.0-arm64-v8a.apk
# Windows (PowerShell)
Get-FileHash kryfo-0.6.0-arm64-v8a.apk

The signing key

Every build of Kryfo carries the same key. Its fingerprint:

SHA-256 signing fingerprint 10:92:8A:61:64:2C:5C:C4:71:A9:98:69:E2:EA:4E:2D:4D:70:02:6E:79:7D:FB:A4:8C:0F:30:6B:5B:34:73:DB

With the Android build tools on a computer:

apksigner verify --print-certs kryfo-0.6.0-arm64-v8a.apk
# Signer #1 certificate SHA-256 digest:
# 10928a61642c5cc471a99869e2ea4e2d4d70026e797dfba48c0f306b5b3473db

On the phone, an app like AppVerifier shows the fingerprint. Android refuses any update signed with another key.

These packages are the reproducible build of commit 61b14390: rebuilt from source, they match byte for byte, apart from the signature.

Post-quantum chats, on your computer too.

Security fixes. 0.6.0 carries every one since 0.3.0. Update when you can.

Post-quantum encryption. New chats between 0.6 phones use PQXDH and SPQR. Older chats switch over once both sides update.

Linked devices. Link a computer and choose what comes over. Hidden chats stay on the phone.

Invite anyone. Invite links open a page that explains Kryfo. A public @name is optional. Pair codes have eight digits.

In your chats. Profile photos, typing indicators over Tor, screenshot blocking in groups, and files in Note to self.

Offline translation. On your phone, never on a server. Language packs download once, over Tor.

Big files. Up to 50 MB, sealed so our files service can't read them, and gone after a week at most. Transfers resume.

Safer on the phone. PINs are tied to the security chip, photos, voice notes and files are encrypted on the phone, and a stranger's request shows only text until you accept.

Hindi and Polish. Kryfo is in 17 languages now.

Coming from 0.5. Chats keep working. A contact on 0.5 must update before you can add each other.

Known issue. Offline translation works for one language at a time. Restart Kryfo to translate another. A coming update fixes it.

The full list is in the changelog.

New versions, on their own.

Obtainium watches this page and installs new versions straight from kryfo.app. No store, no account.

Install Obtainium from obtainium.imranr.dev or from F-Droid.

Tap Add app and paste https://kryfo.app/download, or tap the button below on the phone.

Pick arm64-v8a, or set the APK filter to arm64-v8a (or armeabi-v7a) so it picks for you.

Install. Obtainium offers each new version, and Android takes it only with the same signing key.

On a computer. Windows: run the new installer over the old one. Linux: quit Kryfo, unpack the new file and run ./install.sh again. Your chats stay. Kryfo checks daily over Tor, or at once with Check now in Settings, About.

Built by F-Droid

Get it on F-Droid

Built from source by F-Droid and published only when it matches ours, with the same key. So it updates a copy from here, and the other way round, a little after we release.

View on F-Droid

Google Play

On Google Play

Kryfo is on Google Play from version 0.6. The same app is here and on F-Droid too.

Get it on Play

Kryfo 0.6.0

Almost everyone: arm64-v8a.

On a computer: early betas.

Make sure it is really ours.

Where to get Kryfo

The checksum

The signing key

Post-quantum chats, on your computer too.

New versions, on their own.

Get it on F-Droid

On Google Play