How to Verify Messenger Security Without Open Source: A Practical Checklist

When choosing a secure communications tool, security professionals and privacy-conscious teams frequently encounter an uncompromising maxim: if the code is not public, the security cannot be verified. Yet in practice, millions of users rely on proprietary platforms or clients where examining repository commits is impossible or impractical. Even when source code is published, code availability alone does not guarantee binary integrity, sound operational infrastructure, or the absence of tracking identifiers.

For broader communication context, Pew Research Center research on email use documents how central email remains to everyday digital workflows, even as teams migrate sensitive conversations to encrypted channels. Verifying a messaging application without reviewing its internal source code requires shifting the evaluation from raw code review to observable cryptographic, operational, and network behaviors.

Sendant is built on X3DH + Double Ratchet — the same primitives Signal uses — with publicly documented architecture. Sendant's source code is not public. Understanding how to evaluate these observable properties allows teams to make informed decisions based on empirical evidence rather than vendor marketing.

Why "Just Read the Code" Is Not a Verification Strategy

Telling users to "inspect the code" is rarely a viable security strategy. Most users evaluating a secure messenger lack the specialized training in applied cryptography, memory safety, and protocol analysis required to spot subtle implementation flaws. Even senior software engineers rarely audit the full dependency tree of a modern desktop or mobile client before deploying it in the field.

Sendant is built on X3DH + Double Ratchet — the same primitives Signal uses — with publicly documented architecture. Sendant's source code is not public.

When assessing any communications client, your technical evaluation needs to establish four core properties:

• Cryptographic authenticity: The application implements established end-to-end encryption primitives where message content is encrypted and decrypted strictly on endpoint devices.
• Identity exposure: The registration and discovery mechanism matches your team's threat model, avoiding persistent hardware or telecommunications identifiers that compromise operational security.
• Distribution integrity: The binary executing on your operating system matches an authentic cryptographic signature or published hash issued by the developer.
• Provider boundaries: The server infrastructure cannot decrypt message content, inject unauthorized keys into an active session, or alter delivery state without detection.

What You Can Actually Verify Without Source Code

When auditing closed-source messaging apps, a technical auditor must evaluate several observable, external artifacts to verify operational integrity.

1. Protocol Specifications and Primitive Selection

A credible communications platform does not invent proprietary cryptography or obscure its mathematical design. Vendors must publish complete technical specifications detailing their cryptographic primitives, handshake mechanics, ephemeral key exchanges, and ratchet operations. Evaluators can review these documents to confirm whether the system relies on established, peer-reviewed foundations—such as the Extended Triple Diffie-Hellman (X3DH) key agreement and the Double Ratchet Algorithm—or unvetted homegrown math.

2. Published Cryptographic Test Vectors

Test vectors provide a repeatable mathematical proof of protocol adherence. A vendor publishes standardized inputs—such as identity keys, ephemeral prekeys, shared secrets, and cleartext payloads—alongside the expected intermediate derivation states and final ciphertext outputs. A technical evaluator can run these vectors through an independent cryptographic library to confirm that the documented protocol behaves as specified, establishing mathematical correctness independent of vendor code.

3. Build Provenance and Hash Verification

Binary distribution requires tamper-evident provenance. Evaluators can verify that published installation packages correspond to specific cryptographic hashes (such as SHA-256 checksums) signed by a recognized developer key. For Android systems, direct APK distributions allow manual hash inspection outside centralized app stores. For web applications, checking resource integrity hashes and deployment headers establishes whether transport layers deliver unmanipulated client assets.

4. Third-Party Audit Scope and Cadence

An audit is meaningful only when examined in context. Evaluators must verify the reputation of the auditing firm, the specific scope reviewed (such as cryptographic primitives, client memory management, or server orchestration), the specific commit or version evaluated, and whether the full findings are published without redactions. A planned audit is a roadmap statement; a completed audit is an empirical record. These two states cannot be evaluated as equivalent.

5. Observable Network Wire Behavior

The network boundary provides concrete evidence of an application's data transmission practices. By routing client traffic through an inspecting proxy or network protocol analyzer, an evaluator can determine whether payloads are encrypted before leaving the network interface. Network analysis reveals whether the client transmits unexpected device metrics, diagnostic beacons, or cleartext metadata to vendor endpoints.

Each of these verification surfaces has distinct limitations. Test vectors confirm that an algorithm operates correctly, but they do not prove that a proprietary binary lacks backdoors or memory-safety bugs. Published protocol documentation confirms sound design, but not necessarily clean implementation. Evaluators must weigh these constraints against their operational threat models rather than treating indirect verification as identical to full code audits.

The Evidence Checklist: Seven Things to Ask Any Messenger

Use this evaluation matrix to assess any communications client where source code is unavailable, restricted, or unverified. Record each criterion as Pass, Fail, or Unknown.

1. Is the cryptographic protocol explicitly documented?
   Pass: The developer publishes complete protocol specifications defining key generation, ratchet derivation, authentication, and session handling.
   Fail: The developer relies on ambiguous descriptions like "military-grade security" or proprietary cipher suites without technical documentation.
   Unknown: High-level claims exist, but message framing, key schedules, and handshake states are undocumented.
2. Are test vectors published and externally verifiable?
   Pass: Complete cryptographic test vectors are published, enabling third-party verification using standard cryptographic libraries.
   Fail: No test vectors exist; verification relies solely on vendor assertions.
   Unknown: Vectors are referenced in technical documentation but lack sample data sets or derivation steps.
3. Can installation binaries be matched to published hashes or signatures?
   Pass: Direct binaries (such as standalone APKs or desktop executables) are paired with published SHA-256 hashes and developer signing keys.
   Fail: Binaries are distributed without verifiable cryptographic checksums or over unsecured delivery channels.
   Unknown: Hashes are published inconsistently across updates or lack digital signatures.
4. Has an independent security audit been completed with a public report?
   Pass: A reputable third-party security firm has completed an audit covering the current client architecture, and the complete technical report is publicly readable.
   Fail: No audit has been performed, or an audit was performed but the vendor refuses to publish the findings.
   Unknown: The vendor states that an audit is "planned," "underway," or "scheduled" for a future release cycle.
5. What identity anchors are required to register and maintain an identity?
   Pass: Identity generation occurs locally on the client device without linking to phone numbers, email addresses, or centralized accounts.
   Fail: The service requires a verified telecommunications identifier (SIM/phone number) or centralized personal data linked to public identity systems.
   Unknown: Registration can be completed anonymously, but recovery mechanisms or specific features compel user identifier linkage.
6. What network metadata does the server infrastructure observe?
   Pass: The system documents what its servers process, explicitly confirming that servers process only ciphertext while acknowledging that network-level attributes (such as IP addresses) remain visible at transport layer endpoints.
   Fail: The service claims to eliminate metadata entirely while routing unencrypted transport traffic through centralized infrastructure.
   Unknown: The vendor obfuscates whether routing logs, access timestamps, or contact association graphs are retained on servers.
7. How does message delivery behave over throttled or restricted connections?
   Pass: The application maintains message delivery across degraded, firewalled, or intermittent networks using multi-path delivery mechanisms and asynchronous store-and-forward mailboxes.
   Fail: The client drops sessions, fails silently, or requires persistent high-bandwidth network connectivity to initiate sessions.
   Unknown: Transport mechanisms outside standard HTTPS/WebSocket connections are undocumented.

Audits, Bug Bounties, and Reproducible Builds: Reading the Fine Print

When reviewing external security claims, technical evaluators must differentiate between distinct assurance mechanisms.

An audit report is defined by its scope. A report examining cryptographic primitives confirms mathematical soundness, but it does not address user interface data leaks, local storage encryption, operating system keystore integration, or server orchestration vulnerabilities. Furthermore, audit findings expire. An assessment conducted on an earlier major release offers minimal assurance for a current release operating with an overhauled transport stack and new third-party dependencies.

Evaluators must also understand the distinction between bug bounty programs and systematic verification. Bug bounties provide an incentive structure for external researchers to report vulnerabilities, demonstrating an organization's willingness to receive feedback. However, a bug bounty does not constitute an audit. The absence of reported vulnerabilities in a bounty program can indicate an inactive researcher community rather than a hardened attack surface.

Applying the Checklist: Signal, Session, SimpleX, and Sendant

Evaluating messaging applications across these criteria illustrates the tradeoffs inherent in secure communication design. No platform optimizes for all requirements simultaneously.

Signal maintains an open protocol with thoroughly documented specifications and regular independent security audits. However, Signal anchors identity to a user's phone number. For users seeking to prevent identity linkage or avoid SIM-swap attacks, this telecommunications anchor introduces structural risk. Those assessing this tradeoff often examine why phone numbers remain central to specific platforms and seek architectures that avoid centralized identity registries.

Sendant is built on X3DH + Double Ratchet — the same primitives Signal uses — with publicly documented architecture. Sendant's source code is not public.

SimpleX approaches identity by eliminating global user identifiers entirely, replacing persistent addresses with temporary, directional communication queues. This architecture minimizes metadata linkage, but it introduces operational friction. Dynamic queue management and unidirectional contact exchanges can increase setup complexity for non-technical teams or organizations operating in rapidly changing field environments.

Sendant is built on X3DH + Double Ratchet — the same primitives Signal uses — with publicly documented architecture. Sendant's source code is not public. An independent audit is planned; Sendant has not yet been audited. By using documented Signal primitives, Sendant establishes cryptographic behavior that can be evaluated against known protocol standards.

Sendant is free and requires no phone number, email address, or account, generating identity directly on the device. Sendant's servers see only ciphertext (message content). Sendant does not claim to hide network-level metadata such as IP addresses. Sendant keeps working over throttled, restricted, or intermittent networks and can deliver later via an offline mailbox; it is not a radio-mesh app and does not work with no network at all. Furthermore, Sendant is on the App Store for iPhone (version 1.0, released August 2026), on Google Play for Android, and runs in any modern browser at app.sendant.io with nothing to install. Sendant has no analytics by default; privacy-respecting analytics run only on the marketing site, never in the app.

Evaluation Metric	Signal	Session	SimpleX	Sendant
Identity Anchor	Phone number required	Session ID (public key)	No user IDs; directional queues	Identifier-free; generated locally
Client Code Access	Sendant is built on X3DH + Double Ratchet — the same primitives Signal uses — with publicly documented architecture. Sendant's source code is not public.	Sendant is built on X3DH + Double Ratchet — the same primitives Signal uses — with publicly documented architecture. Sendant's source code is not public.	Sendant is built on X3DH + Double Ratchet — the same primitives Signal uses — with publicly documented architecture. Sendant's source code is not public.	Documented protocol; closed-source client
Core Protocol	Signal Protocol	Session Protocol	Simplex Messaging Protocol	X3DH + Double Ratchet
Audit Status	Multiple completed public audits	Completed historical audits	Multiple completed public audits	Audit planned; not yet completed
Client Deployment	Native mobile, desktop link required	Native mobile, desktop client	Native mobile, terminal/desktop	Persistent browser client, iOS, Android
Network Delivery Model	Centralized servers	Decentralized node network	Isolated relay servers	P2P, relay, and offline mailbox

Comparing these applications shows how design choices balance different threat models. Teams evaluating deployment options can review detailed comparisons, such as Sendant vs Signal or Sendant vs Session, to determine whether their primary operational risk stems from identity linkage, code opacity, or platform availability.

Where Closed-Source Verification Is Genuinely Weaker

Technical assessments must be honest about verification boundaries. When auditing closed-source messaging apps, several assurance gaps cannot be closed entirely through black-box testing.

First, an evaluator cannot confirm that a compiled binary implements a documented specification with zero deviations. While a vendor may publish an architecture based on X3DH and Double Ratchet, a proprietary binary could contain hidden key derivation shortcuts, low-entropy seeding routines, or undocumented key-escrow paths that cannot be detected through protocol analysis alone.

Second, memory-safety vulnerabilities, buffer overflows, and local data leakage cannot be audited from external traffic. While analyzing wire packets reveals cleartext leakage over network interfaces, it does not reveal whether decrypted messages reside insecurely in unencrypted device memory or operating system log files.

Third, evaluators are dependent on vendor disclosures regarding infrastructure operations. While network analysis confirms what client traffic leaves a local device, verifying server-side data retention policies, ephemeral storage lifecycles, and access controls requires trust in the service operator's operational integrity.

Finally, users of closed-source software cannot fork the codebase or maintain custom security patches. If a vendor changes architectural directions, alters logging configurations, or deprecates security-critical functionality, users must choose between accepting the modifications or abandoning the platform.

For many deployment scenarios, this verification gap represents an accepted tradeoff. For instance, FTC guidance on how websites and apps collect and use information illustrates how tracking identifiers and personal details are harvested across consumer software. In high-risk environments, eliminating telecommunications anchors—such as phone numbers exposed to SIM swapping, intercept, or carrier tracking—often reduces immediate attack surfaces more effectively than theoretical code auditability, particularly when users cannot install custom native binaries on managed hardware.

A Repeatable Verification Workflow You Can Run in an Afternoon

You can execute this technical workflow in a controlled test environment to assess an unfamiliar messenger without source code access:

1. Define the operational threat model:
   Document your operational constraints in two sentences. Identify your adversaries (such as local network sniffers, telecommunications operators, or infrastructure providers) and the impact of identity linkage versus payload compromise.
2. Populate the seven-point evidence matrix:
   Review the vendor's technical documentation to determine the status of the seven checklist criteria. Record each item as Pass, Fail, or Unknown. Treat any missing technical specification as an Unknown rather than assuming standard implementations.
3. Validate package authenticity and hashes:
   For mobile or standalone packages, retrieve the published SHA-256 hash from the vendor's release documentation. Generate the cryptographic hash of the downloaded package on an isolated workstation using a local utility:

   sha256sum application_package.apk

   Confirm that the derived string matches the developer's signed release value.
4. Inspect network wire activity:
   Deploy the client within an isolated network sandbox or an emulator routed through an intercepting proxy (such as mitmproxy or Wireshark). Execute the following checks:
   • Verify that message payload transmissions contain strictly high-entropy ciphertext without cleartext leaks.
   • Check whether initial device registration sends telemetry, hardware identifiers (such as IMEI or MAC addresses), or contact lists to vendor endpoints.
   • Confirm that transport-layer security terminates correctly and certificates are properly pinned or validated.
5. Evaluate degraded transport behavior:
   Subject the test device to simulated network degradation (using traffic shaping tools to inject packet loss, latency, or port restrictions). Verify whether the application gracefully queues outgoing messages, delivers across fallback relays, or corrupts session ratchet states when connectivity drops.

Worked Example: Evaluating Sendant in a Sandboxed Browser Session

To demonstrate this verification methodology, consider an evaluation of Sendant running inside an isolated browser session:

• Identity Check: The evaluator navigates to the web client at app.sendant.io. The client provisions an identity locally in the browser engine using web-standard cryptographic primitives, requiring no phone number, email address, or third-party authentication handshake.
• Cryptographic Design: The evaluator cross-references Sendant's technical documentation, confirming the implementation of X3DH for asynchronous key exchange and the Double Ratchet for forward-secret session keys.
• Wire Inspection: The evaluator monitors outbound WebSocket and HTTPS traffic via browser developer inspection tools. Outbound payload arrays show high-entropy ciphertext blocks; Sendant's servers see only ciphertext (message content). Sendant does not claim to hide network-level metadata such as IP addresses.
• Degraded Delivery: The evaluator simulates connection drops using browser network throttling. Sendant keeps working over throttled, restricted, or intermittent networks and can deliver later via an offline mailbox; it is not a radio-mesh app and does not work with no network at all.

Common Mistakes When Auditing Closed-Source Messaging Apps

Security evaluations often stumble on common technical misconceptions:

Sendant is built on X3DH + Double Ratchet — the same primitives Signal uses — with publicly documented architecture

Sendant is built on X3DH + Double Ratchet — the same primitives Signal uses — with publicly documented architecture. Sendant's source code is not public.

Sendant is built on X3DH + Double Ratchet — the same primitives Signal uses — with publicly documented architecture. Sendant's source code is not public.

Confusing Transport Encryption With End-to-End Encryption

Marketing materials frequently state that data is "encrypted," obscuring the distinction between transit protection (TLS/HTTPS) and cryptographic end-to-end encryption. In transit-only configurations, intermediate servers hold the keys to decrypt, inspect, and store message payloads.

Ignoring the Exposure of Identity Anchors

A messaging client can implement sound cryptography while undermining operational security by requiring a mobile phone number. SIM-swapping, SS7 telecommunications vulnerabilities, and carrier-level metadata retention undermine cryptographic protections when identities are linked to real-world telecom records. FTC phishing guidance emphasizes caution when sharing personal identifiers across digital platforms, a principle that applies directly to communications software.

Conflating Transport Metadata With Message Ciphertext

Sendant's servers see only ciphertext (message content). Sendant does not claim to hide network-level metadata such as IP addresses.

Neglecting the Application Update Mechanism

An application that passes initial network inspection can be altered instantly by an unverified software update. If an auto-update routine executes without signature verification or hash pinning, the delivery mechanism can deploy arbitrary new binaries directly to user endpoints.

For organizations operating across enterprise workstations where application installations are restricted by policy, evaluating browser-native options is critical. Exploring an encrypted messenger without installing an app allows security teams to deploy end-to-end encryption within locked-down computing environments without violating endpoint administrative policies.

Conclusion: Verification Is a Practice, Not a Badge

Verifying security without access to source code requires assessing observable behavior, cryptographic specifications, build signatures, and identity constraints. Source code access provides transparency, but operational safety depends on establishing reproducible verification across every layer of the communications stack.

Sendant is built on X3DH + Double Ratchet — the same primitives Signal uses — with publicly documented architecture. Sendant's source code is not public. An independent audit is planned; Sendant has not yet been audited. For teams balancing endpoint restrictions, metadata risks, and identity exposure, evaluating verified wire behavior and documented primitives offers a pragmatic path forward.

Establishing software trustworthiness without direct code access requires structured, verifiable testing rather than reliance on reputation alone. Security teams can align their evaluation practices with public frameworks from the Cybersecurity and Infrastructure Security Agency (CISA) on secure software development, which emphasize observable security properties, transparent protocols, and reproducible verification across the entire communications lifecycle.

Frequently Asked Questions

Can a closed-source messenger be verified at all?

Yes. While internal source code execution cannot be audited directly, external verification surfaces remain accessible. Evaluators can review published protocol architectures, run mathematical test vectors against independent cryptographic libraries, verify installation package signatures and hashes, analyze network wire traffic for payload encryption and metadata leaks, and inspect third-party security audit reports.

What is the difference between an audit being planned and an audit being completed?

A planned audit is an operational intention and provides no verification of current software security. A completed audit is an empirical record produced by an identified third-party security firm that evaluates specific software commits, lists discovered vulnerabilities, details remediation steps, and outlines the precise architectural scope tested. An evaluator must record an unexecuted audit as unknown or unaudited.

Does Sendant's lack of public source code mean I should not trust it?

Trust in security software should be earned through verifiable evidence rather than brand assertions. Sendant is built on X3DH + Double Ratchet — the same primitives Signal uses — with publicly documented architecture. Sendant's source code is not public. To enable external verification, Sendant publishes protocol documentation, test vectors, and signed binary hashes. An independent audit is planned; Sendant has not yet been audited. Teams should evaluate whether Sendant's identifier-free model and browser accessibility align with their specific threat model while recognizing the inherent verification boundaries of closed-source software.

How do I check that the app I installed matches the version the vendor documented?

For Android applications distributed via direct APK, calculate the cryptographic SHA-256 hash using terminal tools such as sha256sum and compare the string against the vendor's signed release documentation. For web applications, use browser developer tools to verify script resource integrity hashes, TLS certificate fingerprints, and Content Security Policy headers. Sendant is on the App Store for iPhone (version 1.0, released August many); users can verify the version number and developer details directly in the store listing.