End-to-end encrypted. The server sees only sealed envelopes — never your content.
X25519 key exchange + XChaCha20-Poly1305. The server is a blind relay — it cannot read your messages.
Instant delivery via persistent WebSocket. No polling, no delay. With exponential backoff reconnection.
Android (Kotlin), iOS (Swift), Web (TypeScript), Python, Go, Node.js, PHP. All with E2E built in.
FCM/APNs as empty doorbell — actual content fetched via encrypted channel. Works offline.
Single Go binary, 512MB RAM. Your data stays on your server. Full control.
Fully auditable code. No proprietary dependencies. GDPR documentation included.
Generates X25519 + Ed25519 keypair. Private key stays on device (Keystore/Keychain). Public key sent to server.
Fetches device public key. ECDH + HKDF derives shared secret. XChaCha20-Poly1305 encrypts the message.
Receives sealed envelope. Delivers via WebSocket or queues for polling. Cannot read the content.
ECDH with own private key + sender's ephemeral key. Derives same shared secret. Decrypts message.
# Python from aeu_push import AeuPush push = AeuPush('apk_xxx', 'aps_xxx') push.send('aeu_device_token', 'Hello World!') # E2E encrypted automatically
| AEU Push | FCM / APNs | |
|---|---|---|
| E2E Encryption | Built-in | None |
| Server reads content | Never | Always |
| Self-hostable | Yes | No |
| Google/Apple dependency | Optional wake-up only | Required |
| Open source | Yes | No |
| GDPR compliant | By design | Requires DPA |
| Works without Play Services | Yes | No |