I’ve been quietly working heads down on a new approach to truly private messaging over Nostr. It uses cryptographic MLS guarantees, with Nostr serving as the transport layer, identity layer, and envelope semantics for group messages, everything ephemeral and blended into the traffic.
This is almost ready! I’ll release it on Monday after polishing a few bugs to make it as solid as possible. Just sharing because I'm so excited to release this. Mark your calendars! 🚀
Login to reply
Replies (9)
CC @Gzuuus
So you are not using marmot?
No, they have been a great inspiration, and we are reusing some of their concepts. However, the motivation to start this project was directly the frustration of making Marmot work for groups of more than two people
Sounds like some inspiration taken from SimpleX as well!


SimpleX network: private message routing, v5.8 released with IP address protection and chat themes
Wasn't Marmot supposed to be good for huge gross specifically? I'm confused AF by all these privacy specs.
*groups
Oh yes, Simplex has been a great reference, as well as Signal, but we finally went with MLS since it is indeed the most portable, open, and scalable solution from our point of view.
MLS is well suited for large groups. Marmot uses MLS, but that doesn’t mean it scales in the same way, since some of the protocol’s conventions are shifted. Specifically, MLS requires strong coordination among all group members. This means that things like out-of-order messages, degraded network states, and similar issues break MLS. That’s why MLS deployments typically require a coordinator or delivery service to ensure group messages follow the strict ordering MLS demands.
Marmot, however, uses Nostr relays as both a dissemination layer and storage. Since there’s no delivery service or nothing ensuring that all members receive messages in the same order, all the coordination MLS requires must be handled client-side by each participant. Each participant must reach the same state to maintain group integrity. This means the complexity of keeping everyone on the same page scales with the group size.
For example, a group of two usually works without issues. A group of three requires that each member consistently lands in the same state, which is manageable under good hygiene and network conditions, meaning all relays in a set are online at all times, with no race conditions (e.g., one relay going offline while others don’t, you know classic nostr race conditions). But still three members can work under good conditions. But as you add more people, each new member increases the complexity of keeping everyone synchronized.
Anyway, sorry for the length 😅 I tried to explain myself as clearly as possible.
But in summary, MLS scales well for large groups but requires coordination. Without coordination, these scalability assumptions break down. I reached these conclusions after reading @Gzuuus ’s article on private communications over public infrastructure, as well as discussions with him. It was very helpful indeed
I hope this clarifies things! Please don’t hesitate to ask if you have any questions, these are complex technical details :)
Hehe wait for it! will be out soon