Where your phrase lives (spoiler: not on our servers)

Every page on this site makes the same claim: your phrase never touches a server. There is nothing to breach and nothing for anyone, including me, to read.

That’s a big claim for a security product to make, and you shouldn’t have to take it on faith. So this post explains, in plain English, where your phrase actually lives, how your family all see the same three words at the same moment without a server in the loop, and why the honest list of things we cannot do is the strongest evidence we have.

The short version

Your phone doesn’t fetch the phrase. It computes it.

If you use an authenticator app for your online banking or email, you’ve seen the trick: a six-digit code that changes every 30 seconds, on your phone, even in airplane mode. Nobody is texting you those codes. Your phone and the bank agreed on a secret once, and from then on both sides independently compute the same numbers from that secret plus the clock.

SafePhrase is that idea, pointed at people instead of services. Instead of numbers for logging in, it’s three words for proving a familiar voice is really the person you love. Two-factor authentication, for humans.

How the words are made

Under the hood, each circle shares one secret. Every 60 seconds, each member’s phone combines that secret with the current time window and runs it through HMAC-SHA256, the same standard, battle-tested cryptographic primitive behind the authenticator codes above (the standard is called TOTP, RFC 6238, if you’d like to look it up). The result picks three words from a fixed list of 512.

A few details we sweat so you don’t have to:

• The time windows are aligned to a universal clock reference, not your timezone. A phone in Devon and a phone in Sydney compute the same words at the same instant.
• The word list is exactly 512 entries, a power of two, which means every word is chosen with exactly equal probability. No word is ever even slightly more likely than another, which matters if you’re trying to stop someone guessing.
• Knowing past phrases tells you nothing about future ones. That’s the guarantee HMAC-SHA256 gives: without the secret, predicting the next phrase is computationally infeasible. It’s why we use a standard cryptographic primitive rather than something home-made.

Where the secret lives

On your phone, in the operating system’s secure storage, the same hardware-backed vault that protects your saved passwords. Not in our database. Not in a backup we hold. Not anywhere we can reach.

This is the part that surprises people: our server genuinely does not have your circle’s secret. This isn’t a policy promise (“we pinky-swear not to look”). It’s an architecture. You cannot leak what you do not hold.

So how does your Mum get the same secret?

Fair question, because the secret does have to travel once, when someone joins the circle. Here’s how it makes the trip without us ever seeing it.

When you invite someone, their copy of the secret is encrypted on your phone with a fresh one-time key. The encrypted copy passes through our server, because it has to reach them somehow. But the key that unlocks it travels only inside the invite link itself, and that part of a link never gets sent to our server. We deliver a locked box; the key goes separately, directly, from your phone to theirs. At no point can we open the box we’re carrying.

The same principle covers the Apple Watch: the secret reaches your watch directly from its own paired phone, over Apple’s device-to-device channel. Our servers aren’t in that conversation either.

What a breach of SafePhrase would actually get

Worth spelling out, because “we take security seriously” is what everyone says right up until the incident report.

If someone stole our entire database tomorrow, they would get the boring plumbing of an app: accounts, circle names, who’s in a circle with whom. What they would not get is a single phrase or a single circle secret, because neither exists on our side, and the encrypted invite copies are useless without keys we never held. The attacker could not compute anyone’s words. The thing SafePhrase protects would survive a total breach of SafePhrase. That’s the property we designed for.

And since the comparison gets made: some “proof of human” proposals want to solve deepfakes by scanning your iris or your voice. We hold no biometrics at all. Your face and voice stay yours; the phrase does the proving.

The one thing both phones must agree on

No servers on the critical path means the phrase works offline by design. There’s no phrase server to go down, no sync to fail, nothing to time out mid-crisis. The only thing your phone and your Mum’s phone must agree on is the time.

So the app quietly compares your device clock against a trusted reference when it can, and if your clock is wrong enough that the words would mislead someone, it tells you so and hides the phrase rather than showing words that won’t match. We’d rather be honestly unavailable for a minute than confidently wrong on a real call.

What we can’t do (on purpose)

The flip side of holding nothing is that there are things we simply cannot do, and we’d rather tell you now than surprise you later:

• We can’t read your phrase. Ever. Neither can anyone who compromises us.
• We can’t recover a circle’s secret for you, because we don’t have it. If a phone is lost or someone leaves the circle, the fix is rotation: a trusted member’s phone generates a fresh secret and shares it with the people who should still have it. Every old copy simply stops matching.
• We can’t quietly “fix” a wrong clock or stretch the timing window to paper over problems. A longer window would be a bigger target, so we keep it short and tell you the truth instead.

Every one of those limitations is the zero-knowledge design working as intended. A company that could do those things for you is a company holding something worth stealing.

Why this matters for a family product

The scam that started all this worked because it attacked the one channel families trust most: a familiar voice. The fix couldn’t be another account to breach, another database of family relationships waiting for a leak, another company asking you to trust it with the keys.

So the design rule was simple: the phrase belongs to your family, full stop. It’s computed on your phones, stored in your pockets, and spoken across your kitchen tables and phone calls. We built the machinery that makes it identical on every phone in the circle, and then we got out of the way.

That’s where your phrase lives. Everywhere it needs to be, and nowhere it doesn’t.

If you haven’t set yours up yet, here’s how to do it properly, and here’s SafePhrase when you’re ready.