Share anything. Encrypted for whoever you choose.
Cipher Station is a self-hosted protocol for post-quantum, end-to-end encrypted content over IPFS. Run your own station, own your identity, and build your own clients.
Post-quantum by construction
Content is wrapped with ML-KEM-768 and requests are signed with ML-DSA-65 — NIST FIPS 203/204. Traffic captured today can't be decrypted by a future quantum computer.
Self-hosted, no platform
Run a personal station on a Raspberry Pi or your Mac. Your keys never leave your device; IPFS peers only ever see ciphertext.
A permanent identity
Your IPFS Peer ID is your address forever. Followers resolve it via IPNS even if your IP, network, or tunnel URL changes.
One identity, many clients
Cipher Station is a protocol, not an app. Photo sharing, file storage, anything — every client shares the same encryption and social graph.
Follow a post from your device to your followers
Every post is encrypted before it leaves you, stored on IPFS as ciphertext, and unlocked only by the people you authorize.
1. Encrypt
A fresh 32-byte key encrypts the file with XSalsa20-Poly1305 before anything leaves your device.
blob = SecretBox(post_key).encrypt(file)A quantum-safe envelope around every post
ML-KEM is a key-encapsulation mechanism, so Cipher Station uses the standard KEM-DEM construction to wrap each post's symmetric key for each recipient. Step through it:
Generate the post key
post_key = random(32)Every post gets its own fresh 32-byte symmetric key. The content itself is sealed with XSalsa20-Poly1305 (NaCl SecretBox) — already quantum-resistant.
Generate a key, encrypt a file, decrypt it back — right here
This runs the exact ML-KEM-768 + SecretBox envelope Cipher Station uses, entirely in your browser — nothing is uploaded. Make a keypair, encrypt a file (≤ 20 MB), then download the bundle and key and recover it on the Decrypt tab.
You decide who reads — and it's fail-closed
Follow requests land as Pending and receive nothing until you approve them. Every post declares its own audience.
A stranger wants to follow your station.
Broadcast to everyone you've approved. New followers are re-wrapped in on approval.
- Who can read
- You + all allowed followers
- Encrypted
- Yes
- Envelopes
- 1 per allowed follower + you
{ "post_cid": "Qm…", "audience_mode": "all", "encrypted": true }A station of your own, in one command
One script sets up IPFS, your post-quantum identity, services, and a public HTTPS URL. On macOS you even get a menu-bar app.
git clone https://github.com/CharliePetch/cipher-station.git
cd cipher-station
chmod +x install.sh
./install.sh- ✓Any systemd Linux — auto-detects apt / dnf / pacman / zypper (amd64 / arm64 / armhf)
- ✓Installs Python 3.11+, IPFS (Kubo), and cloudflared
- ✓Creates systemd services for IPFS, Cipher Station, and the tunnel
- ✓Bootstraps your identity, opens ufw/firewalld, sets a daily backup timer
- 283 949just now · expires 4m51s
- 610 0272m ago · expires 2m44s
Cipher Station stores everything on the InterPlanetary File System — open, content-addressed, peer-to-peer storage. Your IPFS Peer ID is your permanent address.
From the bookshelf
A few books on encryption, surveillance, and the quantum world that shaped how we think about Cipher Station.
Dark Wire
The inside story of Anom — the encrypted phone the FBI secretly ran. A gripping case for why who controls the keys decides everything.
Find itSeizing the Enigma
How the Allies broke Enigma in the Battle of the Atlantic — the human stakes of cryptography, and why cipher strength is never academic.
Find itWhat Is Real?
The unfinished quest to understand quantum mechanics — the physics beneath the 'quantum' threat that post-quantum cryptography answers.
Find itA protocol you can build on — with a real client to copy from
CipherVault is a Google-Drive-style client built on Cipher Station. Pair a device, sign requests with ML-DSA, read a manifest, open envelopes, publish a post — all documented end to end.