Built to be verified, not believed.
Esper's security is not a promise in a policy. It's architecture you can read, defaults you can't weaken by accident, and a threat model that says out loud what it does not cover.
Private by design, not by promise.
Your screen is yours. Esper is engineered so that nobody else, including us, could ever see it.
Keys, not passwords
Each device proves who it is with a key that never leaves it, shown as words you can read aloud. There is no password to steal, guess or phish. That entire attack surface simply doesn't exist.
Quantum-safe from day one
Every connection combines classical and post-quantum key exchange, and it never quietly falls back to anything weaker.
A memory-safe core
The engine is written in Rust with unsafe code forbidden, and the protocol is fuzz-tested around the clock.
Nothing to phone home to
The build itself proves no server address is hidden in the app. You never have to take our word for it: anyone can open the code and check.
You always know when someone's watching
Software that can watch a screen must make being watched obvious. While a session is running, the shared machine always shows:
A visible indicator the other side cannot hide or turn off.
A panic key that ends every session and locks the screen, instantly.
Any new permission is asked for on your screen, never granted silently.
A session log that stays on your machine. There's nowhere else for it to go.
Encrypted end to end. Always.
Every session is sealed between your two devices, on every path. It's not a setting: there is no toggle and no mode where it's off. Nothing in the middle can ever read a byte.
What Esper defends against. And what it can't.
A security page that only lists strengths is marketing. Here is the whole picture, stated plainly.
Defended, by design
- Anyone listening on the network, on any path. Every byte between your machines is encrypted end to end.
- A hostile broker or relay, including your own. Middle machines forward sealed data and learn only that two keys talked.
- Password attacks of every kind. There are no passwords, so there is nothing to guess, stuff, or phish.
- A device whose key suddenly changes. Esper refuses the connection loudly. There is no “continue anyway” button.
- A compromised vendor. There is no vendor infrastructure, no account database, and no update server to poison.
Outside the model
- Malware already running on one of your machines. Nothing an app does can outrun a compromised operating system.
- A device you paired and granted permissions, used within those permissions. Scope grants carefully and revoke freely.
- Someone with physical access to an unlocked machine.
- Traffic analysis. Packet sizes and timing can leak coarse activity patterns. Padding is on the roadmap, and we name it rather than gloss it.
Knowing what a tool refuses to promise is how you decide to trust it. Anything not listed as defended should be treated as not defended.
Found something? Tell us quietly.
Report vulnerabilities privately through GitHub security advisories. Fixes ship fast, advisories are published once users are safe, and reporters are always credited.