Obsidian, the messenger that cannot read your messages

Field notes

The project uses MLS, identified on the page as RFC 9420, rather than a proprietary encryption protocol, and says its Windows and Android clients share a Rust core. Account recovery has two paths: a 55-character code intended for paper storage, or a password that unlocks a sealed server-side copy of the key. The stated server-visible metadata includes envelope size, delivery timing, recipient address, username fingerprints, and last device activity.