Ricochet Refresh

What Ricochet Refresh is

Ricochet Refresh is a free, open-source messenger for private and anonymous instant messaging on Linux, macOS, and Windows. It uses Tor circuits to connect clients directly. On startup, it creates a Tor Onion Services v3 hidden service on the user's computer, and the resulting address serves as that person's identity. To start a conversation, users add one another's hidden-service addresses to their contacts. The maker says communications are end-to-end encrypted by default and describes the messenger as metadata resistant, meaning others do not know who users talk to or what they say. Secure file transfer is included. No account registration is required: account data stays locally on the user's computer, and the maker says no servers host user data. The project began in 2014, and its source code is available for inspection and development. The maker says updates are released roughly monthly when upstream dependencies publish security updates; releases are GPG signed, with SHA256 sums provided. The maker also warns that timing attacks could theoretically reveal an anonymous user's identity, though not message contents, and says privacy or anonymity cannot be guaranteed. It encourages users to assess their own risks and exposure.

Who it suits

Ricochet Refresh may suit whistleblowers, activists, and journalists seeking private messaging, as well as others who want a free, open-source messenger. It is for people comfortable exchanging Tor hidden-service addresses to start conversations and assessing their own privacy risks.

Getting started

1. Visit the Ricochet Refresh website.
2. Get the app for Linux, macOS, or Windows.
3. Start the app to create a Tor hidden-service address on your computer.
4. Add another person's Ricochet Refresh hidden-service address to your contacts to start a chat.
5. Check the maker's GPG signatures and SHA256 sums for release verification.

Verdict

Choose Ricochet Refresh if you want free, open-source messaging with Tor-based identities, local account data, and secure file transfer. Look elsewhere if you need guaranteed anonymity; the maker warns that timing attacks could expose identity and advises users to evaluate their risks.