Trust is a checklist, not a feeling.
Every messenger on earth says it is encrypted. Almost none of them hand you an instrument and invite you to check. This page is the instrument. Work down it and, by the end, you will not have taken a single sentence on this site on faith — including this one.
0% verified
0 of 5 checks completed on this device.
Is the file in your downloads folder our file?
An APK is just bytes, and bytes can be swapped anywhere between our server and your phone — a hostile network, a mirror site, a helpful friend with a modified build. There is exactly one way to know: take the fingerprint of the file you actually have and compare it to the fingerprint we published. Drop your download below. It is read in slices, hashed on this device, and never leaves it.
- FILE
- livara-chat-1.7.8-73.apk
- SIZE
- 172.9 MB
- MINIMUM
- Android 7.0+
Prefer your own tools? Run sha256sum livara-chat-1.7.8-73.apk on Linux, shasum -a 256 on macOS, or certutil -hashfile … SHA256 on Windows. You should not have to trust this page either.
Watch a message become unreadable
Two identities are generated in your browser the moment you press the button — call them Ada and Bo. They agree on a secret over P-256 ECDH without that secret ever existing on the wire, stretch it through HKDF-SHA-256, and use the result to seal your text with AES-256-GCM. What you get back is what a relay would actually be holding. Read it for as long as you like.
Two keys should never look alike
A fingerprint is a short, readable stand-in for a public key. It is how you notice that the person you have been talking to for a year suddenly has a different key. Press the button a few times: every identity this browser generates gets its own fingerprint, and none of them collide.
Confirm that none of this phoned home
A privacy claim you cannot audit is a slogan. Your browser keeps its own record of every request a page makes; this lab snapshots that record when it opens and shows you how many requests it has made since. The honest answer should be zero. The better test is to turn your network off and run everything above again.
Turn off Wi-Fi and mobile data, reload nothing, and use every instrument on this page again. They will all still work, because none of them ever needed us.
What this page cannot prove, and will not pretend to
A verification page that claims to settle everything is just a longer advertisement. Here is the exact edge of what you have established by working down this page.
- The APK you hold is bit-for-bit the build published here
- The cipher suite behaves exactly as described, on your machine
- A single altered bit is refused, not silently accepted
- Distinct identities produce distinct, comparable fingerprints
- None of these checks required our servers to be involved
- That our server does not log who you message, and when — it does
- That group and channel content is hidden from us — it is not
- That your own device is free of malware reading your screen
- That a future release will behave like this one — check every build
- That this page is honest, if you never verify anything on it yourself
| What it is | Direct 1:1 | Groups & channels |
|---|---|---|
| Message text | Sealed on your device | Server can read it |
| Photos, video, files | Encrypted before upload | Server can read them |
| Captions and edits | Sealed on your device | Server can read them |
| Who you talked to | Server knows | Server knows |
| When you talked | Server knows | Server knows |
| Your password | Never leaves your device | Never leaves your device |
| Your private keys | Never leave your device | Never leave your device |
The ones people actually ask
How do I check that a Livara APK has not been tampered with?
Download the APK, then use the Proof Lab on this page to compute its SHA-256 digest in your own browser and compare it, character by character, to the digest published beside the download. The file is never uploaded — the hashing runs entirely on your device. If the two digests differ, the file is not the build published here and should be deleted rather than installed.
Does the Proof Lab send anything to Livara's servers?
No. Every instrument runs locally using primitives your browser already ships. The page counts its own network requests using the browser's resource timeline and shows you the number, so the claim can be checked rather than trusted. You can also disconnect from the network and run every instrument again.
Is the encryption demo the real Livara encryption?
It is the classical half of it, run for real: P-256 ECDH, HKDF-SHA-256 key derivation and AES-256-GCM authenticated encryption, exactly as the shipped client uses them. The shipped client additionally encapsulates an ML-KEM-768 secret and mixes it into the same HKDF step. No browser exposes ML-KEM natively, so that half is described here rather than simulated. Saying so is the point of this page.
What happens if someone changes one byte of an encrypted message?
The AES-256-GCM authentication tag fails and the receiver rejects the message outright. It does not show a corrupted or partially decrypted version. You can trigger this yourself in the Proof Lab: seal a message, flip a single bit, and watch the decryption be refused.
Checked it? Then install it.
Not before. That order is the entire recommendation, and it applies to every app you install, not only this one.