Verus Verify a claim Get Verus

Download

Verus for the Mac

Signed by Confrmo Ltd. It is checked by Apple, so it opens the way any other app does. Free to download, with nothing to sign up for before you can use it.

Download for Mac

Version 2.0, build 88. macOS 14 or later. One download for Apple silicon and Intel, about 3 MB.

On Windows? Verus for Windows is just below.

Download

Verus for Windows

An early release from Verus Communications Ltd. Our Windows code signing certificate is pending, so for now Windows does not recognise the publisher and warns you before it opens. Everything else about it is the same Verus.

Download for Windows

Version 1.1.0. Windows 10 or 11, 64 bit. About 110 MB.

Installing it

  1. Open Verus-Setup-1.1.0.exe from your Downloads folder. If your browser asks whether to keep the file, choose Keep.
  2. Windows says Windows protected your PC. That is the pending certificate. Click More info, then Run anyway.
  3. It installs for you alone, so it does not ask for an administrator password, and offers to open Verus when it finishes. It is in the Start menu from then on.

To remove it, go to Settings, Apps, Installed apps, find Verus and choose Uninstall.

Check it is ours before you open it

Until the certificate arrives, Windows cannot vouch for the publisher, so check the file itself. Open PowerShell and run:

Get-FileHash $env:USERPROFILE\Downloads\Verus-Setup-1.1.0.exe

The hash it prints must be exactly this:

E28A7B73C1C4EA52DCD1E0D7CC554AD8C4235D2D292663441B06D57EB17DD985

Anything else: do not open it, and tell us.

Newer versions

This build does not update itself. When the signed build is ready it will be here, and installing it over this one keeps your address and your chats.

Installing it on the Mac

  1. Open the file you have just downloaded. A window appears with Verus on the left and a shortcut to your Applications folder on the right.
  2. Drag Verus onto Applications. This matters more than it looks: an app opened from Downloads is run by macOS from a temporary read only copy, which causes problems that look like faults in the app.
  3. Open Verus from Applications. It starts straight away. There is no warning about an unidentified developer, because there is an identified one.

To remove it, drag Verus from Applications to the Bin. Nothing is left behind on the machine that you cannot see. Deleting the account itself is a separate thing, done from inside the app.

Check the Mac app is ours before you open it

Anybody can put a file on a website. You do not have to believe this one came from us, because macOS will tell you itself.

Open Terminal and run:

spctl -a -t exec -vv /Applications/Verus.app

Three lines come back. All three matter:

/Applications/Verus.app: accepted
source=Notarized Developer ID
origin=Developer ID Application: Confrmo Ltd. (ZBVD6TAXSZ)

accepted is macOS saying it will run it. Notarized Developer ID means Apple has scanned this exact build and issued a ticket for it, which is stapled to the file, so the check works with no network at all. Confrmo Ltd. (ZBVD6TAXSZ) is the team the certificate belongs to. That identifier is ours and it is the same one on every build we have published. A copy of Verus that returns anything else did not come from us.

Anything other than accepted, on a file downloaded from this page: do not open it. Tell us, because we would want to know within the hour.

The first time you open it

You are given an address. Not an account: there is no phone number to hand over, no email address, no name, nothing to confirm. The address is made on your machine and the keys behind it never leave it. The reason it works that way is here.

Nobody can reach you until you let them. To try it with somebody who is already on it, there is a code on the Try it page. To be found by a person who knows you, show them your own code or send them your link.

Being verified is separate, later and optional. It attaches a Confrmo checked identity to an address you already have, for the conversations where anonymity is not what you want. Both states are explained on the homepage.

How a newer version reaches you

The app asks this website whether there is a build newer than the one you are running, then tells you. It sends nothing about you or your machine when it asks: no identifier, no address, not even which version you have. The answer is a file anybody can read, so what it learns is only what a stranger could learn by visiting this page.

It does not replace itself while you are not looking. Doing that outside the App Store needs either a third party updater or a privileged helper installed on your machine. Neither belongs in an app that argues you should not have to trust it. So when there is a new build you are told, then you download it here the same way you did the first time.

The phone and everything else

The Mac, Windows and Android are the three you can install today. What each of the others is actually waiting on is said underneath rather than left as a date nobody has promised.

iPhone

Coming soon

SwiftUI and CryptoKit, no third party dependencies. Keys are held on the device, recording and mirroring are blocked, and a screenshot, which iOS gives no application a way to prevent, is detected and reported to the other person.

Mac

Download it

The same code as the phone rather than a second implementation, so a conversation can move between a laptop and a handset without either side being a different product.

Android

Get it on Google Play

Kotlin, with the ratchet, X3DH and request signing written against the same constants as the reference implementation rather than against a description of it.

Windows

Download for Windows

A separate build against the same protocol rather than a port of the phone, written in JavaScript against the same constants as the reference implementation. It holds its own keys and talks to the same deployment. Its signing certificate is pending, so Windows warns before it opens: how to get past that, and how to check the file is ours, is on the download page.

Android is on Google Play now. Private release means the app is built, running and in people's hands, without being in a public store yet, which is still where the iPhone build sits: it is with Apple for review.

Leave an email address on the homepage to be told the day the iPhone build opens. It is used for that and for nothing else.