About Orbit
Orbit is a small, independently operated messenger that hands the cryptography back to your browser. It draws its visual cues from the late-90s ICQ aesthetic — the flower, the statuses, the contact groups, your own Orbit number — but everything underneath is modern: text, files, voice, and video, all end-to-end encrypted, with the server holding only ciphertext.
What we built
- Username-only registration. No phone numbers, no email harvesting. You get a unique Orbit # like it's 1999.
- Automatic end-to-end encryption: your browser generates a P-256 keypair, conversations use ECDH-derived AES-GCM keys, and safety numbers let you verify there's no one in the middle.
- WebRTC voice and video that routes peer-to-peer wherever possible — with an encrypted relay fallback so calls connect even across cellular networks. The server only relays signaling.
- Encrypted file and image delivery, including offline pickup, all kept as ciphertext on the server.
- Web Push notifications for messages, files, and incoming calls — payloads never contain message content, or even filenames.
- An optional encrypted Key Vault that backs up your private key across devices, protected by a passphrase only you know.
Who runs it
Orbit is operated by a single individual as a personal project, hosted on equipment we control. There are no employees, no investors, no advertising network embedded anywhere. If you have a question or report, the contact details are in the privacy policy.
Why it exists
Most modern messengers either trade your metadata for a free service or paywall the features that should be table-stakes. Orbit takes a different angle: a small surface area, a stack you can audit by reading the source files in your browser, and a privacy posture where the server can't read your messages, even if it wanted to. There's also a specific reason involving push notifications and phone forensics — read "Why did you make Orbit?" in the FAQ.
Honest limits
This is not Signal. It is a single-process Node app with a SQLite database, run by one person. There is no formal security audit, no bug bounty, no SLA. If your threat model is a nation-state, use something built and reviewed for that. If your threat model is "I would like a private messenger that doesn't sell my contact list," Orbit is for you.