Nexa Beep

About

Nexa Beep is a zero-configuration local network messenger. From first launch to first conversation, a settings screen never appears: launch it and people on the same network show up in the list on their own, pick one and the conversation starts on the spot, and you can gather discovered users into a group to talk together in one room. It was built for the gap left by the Japanese IPMsg-style tools used on corporate networks for over 20 years: dated screens, Windows only, slow updates, and plaintext transfer.

Seven design principles run through the whole product. ① Launch = join (zero configuration) ② Automatic discovery with no prior registration, using multi-stage fallback even on corporate networks that block multicast ③ Direct P2P connections by default, with server routing optional ④ End-to-end encryption so that only the two devices can read the content whatever the route, with no exception for the relay server ⑤ Received files are never executed under any circumstances ⑥ Native code with no runtime dependencies, for minimal size and memory ⑦ The same screen on Windows (x64 · ARM64), macOS, and Linux, with all rendering drawn by the app itself. It uses neither OS widgets nor UI frameworks such as Qt, Electron, or WebView; 19 custom controls sit on its own rasterizer.

Identity is the device key fingerprint, not a name. On first connection, the Noise_XX handshake proves key ownership and the key is fixed as a trust pin (TOFU), after which trust continues only for that same key. Trust does not move to a different key even if the name is the same, and a new key with the same name is revealed by a name conflict mark. If you need certainty, check fingerprints with /fingerprint, compare them over another channel such as by phone or in person, and promote the contact with /verify. The default display name is the host name with anything that looks like a real name stripped out, so real names are not broadcast in plaintext on the LAN.

If you have two or more PCs, the multi-device identity added in v0.2.15 removes approvals between them. Turn on a handle (a short public name) and pairing secret in Settings › User and enter the same values on your other PC, and the two PCs recognize each other as "My device" without approval or fingerprint verification. They establish a Noise XXpsk3 sibling session with a PSK derived from the pairing secret, prove membership inside the session, and the user key is replicated automatically from the one created first. On the same LAN they meet without a server; on different networks they meet through pairing rendezvous on a managed server, where the server knows only the meeting point. If you lose a device, rotate the user key to revoke everything except this PC, change the secret, and re-link; on your contacts' side, the old ID carries over to the new ID automatically. Since v0.4.0, messages sent from your other devices also appear in conversations on this device and a contact's multiple devices collapse into one conversation. Since v0.5.0, a device that was off receives missed conversations (by default the latest 200 lines per conversation · text only · limits configurable since v0.6.0) and read status from sibling devices when you turn it on. All of this synchronization happens only inside encrypted sessions between sibling devices and nothing is stored on the server.

Files are not trusted, whoever sent them. Every file must pass a 4-step gate: negotiation (agreeing on eligibility, receive policy, size, and speed) → quarantine (the original is not unpacked but kept in Quarantine, sealed as .beepq) → scanning (extension and magic byte checks, zip structure inspection without extraction, and on Windows an AMSI scan by the installed antivirus) → release after approval (a person must approve before it goes to the Downloads folder, with hash re-verification, execute bit removal, and an OS quarantine mark). The app does not execute received files, does not open links automatically, and does not extract archives automatically. Image parsers are not linked into the main program at all; images are decoded only in a separate isolated process. The transfer itself is streamed, so even 10GB-class files are not loaded into memory; it resumes if interrupted, and you control it with ⏸▶✕ inside the bubble.

Conversations can be 1:1 or shared group chats. In a group, all members see the same room, the source of truth is the roster signed by the owner, and even if you are on the roster, the room appears on your screen only after you accept. Each message gets delivered and read dots. The chat window opens even when the contact is off, so you can view history and send messages, and waiting messages are delivered the moment the contact appears (v0.6.0). You can pick a bubble to reply to, click the quote to return to the original, and drag to select and copy bubble text (v0.7.0). If you set your status to Offline, you disappear from other people's lists and make no connections at all (v0.6.0). You can block contacts you do not want to receive from for a period you choose; message and connection floods are stopped automatically for a short time; and first messages from strangers can be held until you accept them (v0.8.0). There are also message priorities and announcement broadcasts, sending images by pasting from the clipboard, a bubble right-click menu, and / commands in the input box, plus a CLI terminal client (--chat-live) that lets you take part with only a terminal.

No plaintext is left on disk. Chat history, quarantined received files, PII such as email and phone, the profile image cache, and trust pins are all encrypted in the same sealed envelope (ChaCha20-Poly1305, with domain-separated keys per file type), and a measured audit on 2026-08-21 confirmed 0 plaintext. However, the JSON files created by the settings window's Export and Edit JSON (v0.7.0) are plain text and contain the pairing secret as is (email and phone are excluded), so take care when storing or sharing them. Deleting a conversation discards its data key (crypto-shredding), so the remaining bytes become random noise. Data is created only in the data/ folder next to the executable, so it can be carried around as a portable app, and the identity key is backed up and restored in settings.

Contacts not on the same LAN, such as home and office, are reached through the relay server nexa-beepd. Switch Server mode in settings to Managed and click [Test] once to register with the official default server (beepd.sosomlab.com). What goes up to the server is not the original public key but a rotating rendezvous ID that changes daily, so the server cannot build a user directory; only someone who already knows a contact's fingerprint can compute that day's ID, so strangers cannot find you. Connections go rendezvous → UDP hole punching → relay fallback, and on any route the Noise_XX end-to-end session is established only between the two devices. The server sees only the envelope (the fact of a connection, byte counts, and times) and stores nothing. A real NAT connection between home (Mac) and office (Windows) was demonstrated on 2026-08-22, and the server is a 651KB static binary with 0 external dependencies, so anyone can run their own.

Being lightweight is a gate, not a promise. CI checks build size ≤10MB per target · idle resident memory ≤30MB · 0 runtime dependencies; measured values are about 3.9MB build size (v0.8.0) and about 25MB idle resident memory (macOS · based on pre-release verification of v0.7.0; Windows is lower). Every commit passes with 0 clippy warnings and 4 CI jobs (lint · 3-OS tests · cross builds · budget gate), and records are kept of Windows↔macOS 2-PC real-device testing (message, file, and profile round trips · large cross transfers · resume), 3-identity group real-device testing, and 10-minute automated network measurement (0 excess traffic).

It does not hide what it cannot prevent, either. TOFU in principle cannot detect a man in the middle at the very moment of first contact (fingerprint comparison is the mitigation); discovery can fail entirely on corporate wireless networks with client isolation or IGMP snooping (manual address registration is the fallback); and "Scanned (nothing detected)" is only the verdict of the installed antivirus, not a guarantee of safety. History does not follow you across devices, and with the relay, the server cannot see content but does learn the metadata of "who, with whom, and when". Because the app is not yet code-signed, SmartScreen and Gatekeeper warnings appear. Labels are managed on the principle that if the UI claims a guarantee not on this list, that is a bug.

Distribution covers 5 targets (Windows x64 · ARM64, macOS x64 · ARM64, Linux x64) × 2 channels of installer and portable (15 assets, including Linux .deb and .rpm, plus SHA256SUMS), published automatically when a tag is pushed. Homebrew and the Linux APT/DNF repositories (pkg.sosomlab.com) update automatically with each release, while Chocolatey (0.6.0) and winget (installer 0.6.0 · portable 0.6.1) follow after review. Under the PolyForm Noncommercial 1.0.0 license, personal and non-commercial use is free, and commercial use requires a separate paid license (contact kiros33@sosomlab.com). Since v0.3.0, a commercial license file can be installed from Help › License…, and no features are locked with or without a license.