Night Drop

Releases

• Sep 27, 2026 0.1.25
  ## Stays reachable on fast connections After running for a while on a fast connection, Night Drop could become unreachable: contacts' messages stopped arriving directly, and it took minutes (or forever) to come back online after a restart. The cause was in how the Tor library learns its circuit-build timeout. It learns only from the connections that succeed, so on a fast link the timeout kept shrinking — to about half a second — until ordinary connections were being abandoned. Each abandoned connection counted against the Tor entry relay it used, and once enough had, that relay was disabled for good. With none left, the app could not publish its address at all. The timeout now has a two-second floor, which stops the spiral without slowing anything down. If your app has been slow to come online, this release fixes it going forward. ## Also

  More…

  - **A stalled connection can no longer freeze delivery.** If a Tor connection stopped moving mid-transfer, sending and receiving could stop until the app was restarted. Connections that make no progress for 60 seconds are now dropped and retried. - **Offline messages are stored on the relay once**, not twice. The relay was being counted twice under two names, doubling both the copies and the mail checks. - **An unopened burn message that expires now leaves a marker** ("Burn message expired unopened") instead of vanishing silently. - **Donations**: Bitcoin, through a silent payment address (each payment lands at a fresh output, so donations cannot be linked to each other or to the address), and Zcash. ## Verifying Every binary is signed with the release key and listed in `SHA256SUMS`, itself signed. See `SECURITY.md` for the full verification steps; `nightdrop-signing-key.asc` is attached.
• Sep 22, 2026 0.1.22
  ## Tor over WebTunnel, when the network blocks it If your network blocks Tor, Night Drop can now use a **WebTunnel bridge**: Tor carried inside ordinary HTTPS to a normal-looking web server. Add one under **Bridges** — now reachable *before* you create an identity, which is when you are most likely to need it. Previously the editor sat behind the home screen, which you could only reach with a working identity, which needed a working Tor bootstrap. **What this is tested against, and what it is not.** It is tested against a network that blocks Tor by address, with a control confirming direct Tor could not build a single circuit; and against an intrusion-detection system carrying 52,311 public signatures, over a thousand of them for Tor, which raised nothing and saw only ordinary TLS. It has **never been run from inside a country that filters this way**, and public tooling is a far weaker adversary than a national firewall. One property is not disguised at all: the **shape** of the traffic. A connection that pulls tens of megabytes while sending very little does not look like reading a web page, however ordinary the handshake is. If being identified as a Tor user is itself dangerous where you are, do not rely on this alone. ## Fixes - Repeatedly tapping reconnect could leave the app offering to set up a new identity **over an existing one**. Launching is no longer re-entrant, and creating an identity now refuses to displace saved data unless the recovery screen asked for it. - The sealed onion key now travels with the state file it unseals, so recovering a set-aside identity keeps its `.onion` address instead of coming back on a new one.

  More…

  - A native library that fails to load reaches the error screen instead of leaving the splash on screen for ever. ## Verifying Every binary is signed with the release key and listed in `SHA256SUMS`, itself signed. See `SECURITY.md` for the full verification steps; `nightdrop-signing-key.asc` is attached.
• Aug 16, 2026 0.1.21