Livara Proof Lab: Run the checks yourself.
Local encryption demonstrations and APK hash comparison
Five checks you can try in your browser. Compare the Android file with the published digest, generate keys, encrypt a message and test tamper rejection. These are local demonstrations, not an audit of Livara’s complete protocol or a certification of the app.
Current verification target: 0.2 (74) · livara-beta-android-0.2.apk
Your lab progress
0% of checks completed
0 of 5 checks completed on this device.
Instrument 01 · Build identity
Is this file ours?
This bench compares the SHA-256 digest of your selected file with the published digest for Livara 0.2 (74) for Android. The file is hashed locally without being uploaded. A matching digest checks agreement with this reference; it is not an independent security audit.
- File
- livara-beta-android-0.2.apk
- Size
- 60.0 MiB
- Minimum
- Android 8.0+
Prefer your own tools? You should not have to trust this page either.
sha256sum livara-beta-android-0.2.apkshasum -a 256 …certutil -hashfile … SHA256Instrument 02 · The sealing
Watch a message become unreadable.
Two identities are generated in your browser when you press the button. They agree on a secret over P-256 ECDH without it ever existing on the wire, stretch it through HKDF-SHA-256, and seal your text with AES-256-GCM. What comes back is what a relay would actually hold.
Instrument 03 · Identity
Compare key fingerprints.
A fingerprint is a short, readable stand-in for a public key. It is how you notice that the person you have talked to for a year suddenly has a different one. Press it a few times.
Instrument 04 · Silence
Confirm none of this phoned home.
Your browser records resource requests in its resource timeline. This tool counts the requests recorded after the page loads; that is not a comprehensive network audit. To check local operation, disconnect after the page finishes loading and try the demonstrations again.
After the checks
What this page cannot prove.
A verification page that claims to settle everything is just a longer advertisement. Here is the exact edge of what you have established.
- The APK bytes you selected match the digest published on this site
- The browser demonstrations behave as displayed on your machine
- A single altered bit is refused, not silently accepted
- The identities you generated have comparable fingerprints
- None of these checks required our servers
- That the server stores no routing metadata — it does, for delivery and sync
- That broadcast channels are private — they are public by design
- That this bench audits the complete LVR1/LGS1 protocols or certifies the app’s security
- That an unlocked phone in someone else's hand is protected
- That future releases are pre-verified — check the digest on every build
| What it is | Direct 1:1 | Compatible private groups | Channels |
|---|---|---|---|
| Message text | Post-Quantum E2EE (LVR1) | End-to-end sealed (LGS1) | Public broadcast channels |
| Text edits | Post-Quantum E2EE (LVR1) | End-to-end sealed (LGS1) | Public broadcast channels |
| Photos, video, files, captions | Post-Quantum E2EE (LVR1) | End-to-end sealed (LGS1) | Public broadcast channels |
| Who you talked to | Routing metadata only | Routing metadata only | Public broadcast channels |
| When you talked | Delivery timestamps only | Delivery timestamps only | Public broadcast channels |
| Your password | Never leaves your device | Never leaves your device | Never leaves your device |
| Your private keys | Never uploaded unencrypted | Never uploaded unencrypted | Never uploaded unencrypted |
Questions
The ones people actually ask.
How do I check that a Livara APK has not been tampered with?
Compute the downloaded APK’s SHA-256 digest here or with your own tools and compare every character with the published digest. Do not install the file if they differ. A match checks agreement with that digest; it cannot establish authenticity if both the file and digest were replaced.
Does the Proof Lab send anything to Livara's servers?
The demonstrations run locally and your selected APK is not uploaded. The page itself must load first. After loading, you can disconnect and try the demonstrations again. The displayed request counter is not a comprehensive network audit.
Is the encryption demo the real Livara encryption?
It runs real P-256 ECDH, HKDF-SHA-256 and AES-256-GCM, the primitives Livara uses, but it is not the complete LVR1 or LGS1 protocol. LVR1 also has a classical double ratchet and an ML-KEM-768 epoch ratchet; LGS1 has signed sender chains distributed inside LVR1. The lab proves the primitives and tamper rejection, not the whole composition or an external audit.
What happens if someone changes one byte of an encrypted message?
The AES-256-GCM authentication tag fails and the receiver rejects the message outright. It never shows a corrupted or partially decrypted version. Seal a message below, flip a single bit, and watch the decryption be refused.
Install order
Checked it? Then install it.
Hash comparison is one check, not a guarantee of app security. Obtain the file from the official source and consider the limitations described above.
0.2 (74) · 60.0 MiB · Android 8.0+