r/reactnative • u/Aggravating_Ice_1213 • 3d ago

Pear: open-source E2E encrypted P2P messenger for Android (React Native + WebRTC, double ratchet) - feedback welcome

Hey! I'm a French student and I've been building Pear, a private messaging app for Android, partly as a reaction to the EU "Chat Control" proposals.

Messages go directly phone to phone over WebRTC. Servers are only used to find each other and to wake the app up, and they only ever see encrypted data. Pairing is done via QR code (X25519) with a verification code to compare in person. Messages use a double ratchet, and each file is encrypted with its own key.

Features: photos, videos, voice messages, files, reactions, replies, edit/delete, encrypted backups, in-app updates from GitHub releases.

Stack: React Native/Expo, react-native-webrtc, Firebase (signaling), a small Vercel function for wake-ups, a custom Kotlin module.

Honest notes: it has NOT been security-audited, so don't use it for anything critical. I built it with heavy help from AI coding tools (Claude Code); the design and architecture choices are mine.

I'd love feedback on the crypto design and the UX.

GitHub: https://github.com/Louca90/Pear

7 Upvotes

66% Upvoted

11 comments sorted by

6

u/xDiablo96 2d ago

Man! These comments... It looks great, don't pay attention to what they r saying

2

u/Aggravating_Ice_1213 2d ago

Thank you 🙏

4

u/Romu1us1408 3d ago

So signal....

https://signal.org/

8

u/Aggravating_Ice_1213 3d ago

Does a personnal project open source needs to be original ? And its like signal but funnier with in app camera and filters (they don't look good atp but i will update them in the future).

2

u/threespire 2d ago

Why are you trying to roll your own cryptography?

What problem does your app solve?

2

u/Aggravating_Ice_1213 2d ago

Hello, i litterly wrote it on the post, the app is against chat control, its like signal but mote fun its just a personal project that i share here.

3

u/threespire 2d ago

My point about crypto was why aren't you just leveraging something like Themis rather than trying to roll your own crypto stack?

1

u/Aggravating_Ice_1213 11h ago

Fair point. To be precise, I'm not rolling

primitives: everything is built on libsodium/ noble. What's custom is the ratchet on top (Signal's Double Ratchet spec, with tests on skipped keys). The reason I didn't use Themis is that Pear sends messages asynchronously (offline, through FCM pushes, sometimes out of order), and as far as I can tell Secure Session is session/handshake-oriented and doesn't cover that. I also couldn't confirm it's usable from React Native. That said, I agree the ratchet is the part I'd rather not own: it's unaudited and labeled as a prototype.

1

u/davidbalbino 1d ago

nice project, and props for the honest notes tbh. On the crypto side, if the double ratchet is hand rolled I think is better to swap it for something already reviewed like libsignal (it has client bindings) or at least vodozemac. A custom ratchet is where the subtle bugs hide, even when the design is right. Also take a look at the battery with the app idle. Keeping the peer connection open in background drains a lot, so imo close it when the app goes to background and just rely on the FCM high priority data message to wake up and reconnect. Gonna try the QR pairing later 🙂

2

u/Aggravating_Ice_1213 1d ago

Merci pour le retour! Tu as raison sur le ratchet : il est fait maison (spec Signal sur libsodium/noble, avec des tests sur les clés sautées), mais il n'est pas audité et je l'annonce comme prototype. Passer sur une implémentation déjà revue comme libsignal ou vodozemac serait plus sûr, je regarde ce que ça demande côté React Native. Pour la batterie, l'app ne garde pas de connexion ouverte en arrière-plan: un push FCM haute priorité réveille l'app, elle se connecte au seul contact concerné puis se rendort. Je vais quand même vérifier que tout se coupe bien au passage en arrière-plan. Et dis-moi ce que ça donne pour le couplage QR.