3NUM Labs
Open infrastructure for private phone calls and messages.
Phone calls and text messages still ride on networks designed to be tapped.
We are building ATSMS: an open, end-to-end encrypted protocol that works with the phone numbers people already have, run by many independent operators rather than one company.
The problem
The phone network was built to be listened to.
Lawful intercept is a back door.
Carrier networks carry interfaces for court-ordered wiretaps. In 2024 the Salt Typhoon intrusion used those same systems to listen to calls and read texts at several US carriers. The interface cannot tell a court from an attacker.
A phone number can be stolen.
A SIM swap moves your number to someone else's phone with a phone call to a carrier. Every account that resets a password by text message goes with it.
Nothing proves who is calling.
Caller ID and SMS carry no proof of origin. That is why phishing works: a real message from your bank and a fake one look the same, because neither can prove where it came from.
None of this is fixable inside the legacy network. It has to be replaced from underneath, and it has to stay reachable from the old network while that happens. That is the whole design brief.
What we build
Three layers. All of them open, except the last.
ATSMS: the messaging core
End-to-end encrypted messaging and calls for AT Protocol identities. Specifications, record schemas, a TypeScript SDK, a reference relay and two reference clients. Adoptable on its own: an app adding encrypted DMs never touches phone numbers.
Phone numbers on top of it
Numbers bound to identities, Gateway Nodes that bridge to the legacy network, and an accreditation process for who may vouch for a number. Specified separately, on top of the core.
Operators who run it
Companies that run the nodes and sell service: phone plans, apps, screening. Haiven Mobile is the first. The reference nodes and the operator playbook exist so it is not the only one.
Better than what it replaces
What changes when the network is open and encrypted.
Each claim carries its limit. We would rather you read it here than find it yourself.
Private by construction
Every conversation is end-to-end encrypted with forward secrecy and recovery after a key compromise. Direct messages and groups use one mechanism, so neither is the weak one.
LimitThe cryptography has not had an independent security review yet. That review is a requirement before this carries traffic that matters.
No server orders anything
Most encrypted group messaging quietly depends on a server to decide whose change wins when two people act at once. ATSMS replaces that server with a protocol, so no company sits between you and the people you talk to.
LimitComfortable to about 25 devices per group. Larger groups add a group relay, which is a published proposal and not yet a finished part of the protocol.
Your number cannot be swapped away
A number on the network is bound to an identity that only your keys can speak for. A fraudulent port-out moves the number but cannot forge that binding, so the number goes dark instead of being hijacked.
LimitA call that bridges to an ordinary phone still crosses the legacy network on that leg, and the app always shows which kind of call you are on.
Identity you keep
Your identity is your AT Protocol DID, not a row in our database. Switch apps and your conversations come with you, because they were never the app's to hold.
The relay carries bytes it cannot read
Messages travel in sealed envelopes. The node in the middle stores and forwards them without learning who is talking to whom.
LimitA relay still sees the connecting IP address, timing and volume. Traffic analysis over enough time is a real attack and we do not defend against it.
Still reachable from any phone
When both sides are on ATSMS, the call or message is encrypted end to end. Otherwise it bridges through a Gateway Node to the ordinary phone network, and the app tells you which is happening.
LimitInbound calls from the phone network have been live since September 2026. Text-message bridging is designed and not yet built.
Open source
Everything you need to run it, in the open.
The protocol, the reference nodes and the reference clients are published under the Apache-2.0 license in the 3numlabs GitHub organization. The normative material lives on the protocol's own site.
A proof of concept, not a product. Nothing is published to npm, the cryptography is unreviewed, and the gateway code is not yet public.We publish what we know is broken.
- Apache-2.0
3numlabs/atsms
Encrypted group messaging on AT Protocol identities, with no server ordering anything. Specifications and TypeScript reference implementation.
- Apache-2.0
3numlabs/atsms-worker
Reference relay for ATSMS: store-and-forward for sealed envelopes on Cloudflare Workers. Carries bytes it cannot read.
- Apache-2.0
3numlabs/atsms-demo
Browser client for ATSMS: encrypted DMs, groups and calls, using the Bluesky account you already have. A proof of concept.
- Apache-2.0
3numlabs/atsms-cli
Terminal client for ATSMS: a small REPL over the @atsms/client SDK, short enough to read in one sitting.
Operators
A network with one operator is not a network.
Haiven Mobile, a company owned and operated by 3NUM Inc., is the first operator on the open stack. The reference nodes, the accreditation process and the operator playbook exist so that it will not be the only one.
Haiven Mobile
Your Safe Place to Talk.
Calls and texts without the junk; encrypted between members; a number that cannot be SIM-swapped.
haiven.mobile →
Operator · nextYour company
What an operator runs, how accreditation works, and where the playbook stands. We would rather hear from a second operator early than polish the playbook in private.
Run an operator →
Articles
Latest from 3NUM Labs
Your Private Messages Should Belong to You - Now They Can
Private group messaging that belongs to you, not to an app, on the AT Protocol identity you already have.
ATSMS Group Chat: End-to-End Encryption Without the Lock-In
Encrypted groups with no server ordering anything, built on BeeKEM, published with their open questions.
Introducing ATSMS
End-to-end encrypted messaging and calls for the AT Protocol identity you already have.
Build on it, run it, or audit it.
The specifications, reference nodes and clients are public. If you build on AT Protocol, run telecom infrastructure, or review cryptography, we would like to hear from you.