Open protocol · Self-hosted

Share anything. Encrypted for whoever you choose.

Cipher Station is a self-hosted protocol for post-quantum, end-to-end encrypted content over IPFS. Run your own station, own your identity, and build your own clients.

Run a station →Read the fundamentals
ML-KEM-768ML-DSA-65IPFS + IPNSEnd-to-end encrypted

Post-quantum by construction

Content is wrapped with ML-KEM-768 and requests are signed with ML-DSA-65. Traffic captured today can't be decrypted by a future quantum computer.

Self-hosted, no platform

Run a personal station on a Raspberry Pi or your Mac — your keys never leave your device, and IPFS peers only ever see ciphertext.

A permanent identity

Your IPFS Peer ID is your address forever. Followers resolve it via IPNS even if your IP, network, or tunnel URL changes.

One identity, many clients

Cipher Station is a protocol, not an app — every client shares the same encryption and social graph.

What is IPFS?
How it works

Follow a post from your device to your followers

Every post is encrypted before it leaves you, stored on IPFS as ciphertext, and unlocked only by the people you authorize.

1. Encrypt

A fresh 32-byte key encrypts the file with XSalsa20-Poly1305 before anything leaves your device.

blob = SecretBox(post_key).encrypt(file)
Access control

You decide who reads — and it's fail-closed

Follow requests land as Pending and receive nothing until you approve them. Every post declares its own audience.

Follower
◎alice
no relationship
Your station
you
0 allowed followers

A stranger wants to follow your station.

Broadcast to everyone you've approved. New followers are re-wrapped in on approval.

Who can read
You + all allowed followers
Encrypted
Yes
Envelopes
1 per allowed follower + you
{ "post_cid": "Qm…", "audience_mode": "all", "encrypted": true }
Cryptography

A quantum-safe envelope around every post

Each post's key is wrapped per recipient with ML-KEM-768 — and you can run the exact envelope in your browser. Nothing is uploaded.

Step 1 / 4

Generate the post key

post_key = random(32)

Every post gets its own fresh 32-byte symmetric key. The content itself is sealed with XSalsa20-Poly1305 (NaCl SecretBox) — already quantum-resistant.

post_key32 B
Envelope wire format (hex-encoded)len ‖ kem_ct ‖ sealed
len
kem_ct
sealed

Make a keypair, encrypt a file (≤ 20 MB), then download the bundle and key — recover it on the Decrypt tab.

1 · Keypair
2 · Choose a file (≤ 20 MB)
Read the cryptography deep-dive
Run your own

A station of your own, in one command

One script sets up IPFS, your post-quantum identity, services, and a public HTTPS URL. On macOS you even get a menu-bar app.

Linux · terminal
git clone https://github.com/CharliePetch/cipher-station.git
cd cipher-station
chmod +x install.sh
./install.sh
  • ✓Any systemd Linux — auto-detects apt / dnf / pacman / zypper (amd64 / arm64 / armhf)
  • ✓Installs Python 3.11+, IPFS (Kubo), and cloudflared
  • ✓Creates systemd services for IPFS, Cipher Station, and the tunnel
  • ✓Bootstraps your identity, opens ufw/firewalld, sets a daily backup timer
Cipher Station Running
IPFS Gateway Live
Cloudflare URLhorn-netscape…trycloudflare.com
Peer ID12D3KooW…CUYzL
Recent pairing PINs
  • 283 949just now · expires 4m51s
  • 610 0272m ago · expires 2m44s
Storage2.4 GB of 10 GB
Build on Cipher Station

A protocol you can build on — with a real client to copy from

CipherVault is a Google-Drive-style client built on Cipher Station — every step documented end to end.

View on GitHub ↗Build a clientBrowse the API