Knit

What is Knit

Knit keeps nearby phones talking when nothing else is available — no internet, no cell service, no accounts, no servers. It forms an ad-hoc mesh directly over Wi-Fi Aware (NAN) and Bluetooth LE, running both radios at once. A message you send goes to every device in range, and each of those passes it on, so it leap-frogs across phones to people you were never in range of yourself. Duplicates are discarded, hop-count and TTL bound the flood, and a store-and-forward layer carries what a single flood misses to whoever comes into range later. Above all that sits an ordinary modern messenger: conversation list, bubbles, reactions, attachments.

Bridgefy, Briar, and Meshtastic go after the same problem. What Knit does differently is run two radios at once (Wi-Fi Aware + BLE) behind one transport seam, with no Google Nearby / GMS dependency and end-to-end encryption on direct and group messages — and it needs no hardware beyond an Android phone, though it will happily use a Meshtastic board if you have one.

At a glance

Contents

• Install
• How it works
• Use it when
• Features
• Calls
• On your watch
• Requirements
• Tech stack
• Build
• Running
• Testing
• FAQ
• Documentation
• Roadmap
• Security note
• Support Knit
• License

Note

Knit is a complete messenger: a "Nearby" public broadcast room, 1:1 direct messages, and multi-member group chats, with profiles (name / status / avatar), emoji reactions, @-mentions, photos, files, and voice notes. Direct and group messages are end-to-end encrypted — the body, mentions, and attachments are readable only by the people they were sent to, even though every message floods through other people's phones on the way. The public Nearby room is plaintext by design: a room with no fixed recipient set has nobody in particular to encrypt to. See the Security note.

📥 Install

Knit needs Android 10 (API 29) or newer — see Requirements. Both channels ship the same app; pick one and stay on it (see the note below).

• Google Play — open the listing (or search Knit in the Play Store app) and tap Install; updates arrive automatically.
• F-Droid — install the F-Droid client and search for Knit, or open the package page and tap Download APK. F-Droid rebuilds Knit from source and byte-compares the result against our published release, then distributes our signed APK verbatim — see the reproducibility contract.
• Direct APK — the same F-Droid-verified, self-signed universal APK is attached to every GitHub Release, for sideloading without any store. Alpha pre-releases appear there too, signed with the same key so they update in place; F-Droid skips them.
• From a nearby phone, no store or internet needed — an installed copy of Knit can hand itself to another device: Install offline in the app menu merges its installed splits into a universal APK, re-signs it on-device, and sends it over Quick Share or Bluetooth. Open the received file on the other phone and allow installing it.

Important

Play and non-Play installs carry different signatures and can't upgrade one another. Play App Signing re-signs the app with Google's key, so switching between the Play build and the F-Droid/APK/offline-shared build requires uninstalling first — which erases your local message history and identity key. The F-Droid, GitHub-Release, and offline-shared APKs all share one signature, so those three interoperate and update in place.

How it works

   ┌─────────┐   Wi-Fi Aware / BLE   ┌─────────┐   Wi-Fi Aware / BLE   ┌─────────┐
   │ Phone A │ ────────────────────► │ Phone B │ ────────────────────► │ Phone C │
   └─────────┘   send + relay        └─────────┘   relay (dedup)       └─────────┘
        │                                 │                                 │
   originates a           overhears & re-floods (jittered,          delivers — even though
   signed, encrypted      suppressed) — only carries ciphertext     A was never in its range
   frame once             it can't decrypt

Every message is a signed CBOR frame that relays forward byte-for-byte (they rewrite only TTL/hop-count), so the originator's Ed25519 signature survives every hop. A relay that can't decrypt or even recognize a frame still forwards it — an old build is never a black hole. See docs/ARCHITECTURE.md for the full protocol.

🧭 Use it when

Knit is built for situations where there's no reliable network but people are physically nearby:

• Off-grid & remote — hiking, camping, festivals, sailing, or anywhere without cell coverage.
• Disaster & emergency — earthquakes, storms, or outages that knock out cell towers and internet.
• Crowded venues — concerts, stadiums, and conferences where the cellular network is saturated.
• Privacy-sensitive — no servers, no accounts, no phone numbers; DMs and groups are end-to-end encrypted and identities are verifiable in person via safety numbers / QR codes.
• Censored or shut-down networks — communication that doesn't depend on any ISP or provider.

✨ Features

• Two radios at once, so there are more paths to you — Wi-Fi Aware (NAN) and Bluetooth LE both run behind a single MeshTransport seam (CompositeMeshTransport), with no Google Nearby / GMS. Knit advertises, discovers, connects, and floods with hop-count/TTL bounds and dedup; relays rebroadcast on a jitter with overhear suppression, so a dense cluster doesn't storm itself. A phone with only one of the two radios still meshes over that one. Where both phones support Bluetooth's long-range mode (Coded PHY), they find each other from further apart, and a link drifting out of range switches to it to stay up.
• Broadcast room, 1:1 DMs, and group chats — a conversation list and contact picker, message bubbles, relative timestamps, unread badges, and delivery ticks (✓ / ✓✓).
• End-to-end encryption with forward secrecy for DMs and groups — each message's body, mentions, and attachments are sealed with AES-256-GCM and authenticated with an Ed25519 signature, so relays only ever carry ciphertext. Between current builds the keys rotate: a DM session bootstraps from a signed prekey published in the peer's profile (X3DH-style, so the first message still needs no round trip) and rekeys as the conversation turns over, and groups run a sender-key ratchet on top of those sessions with each member driving their own chain. Message keys are dropped after use, so recorded ciphertext stops being readable once its epoch ages out. Peers on older builds fall back to the static-key scheme automatically. Identity keypairs are hardware-backed (AndroidKeyStore), advertised in profiles, pinned on first use (TOFU), and confirmable out of band via a safety-number / QR-code verification screen — or by trading contact links, which pins the same key without either of you needing to be in the room. What the app keeps on disk is encrypted at rest with SQLCipher.
• Store-and-forward delivery — a message whose recipient isn't in range is held in encrypted custody and re-offered when they (or a path to them) later come into range, so two phones that meet only briefly still backfill each other. A content-digest anti-entropy layer means an idle mesh does zero data-path work; a new message triggers a targeted sync only with the peers that need it.
• Photos, videos, files, voice notes, reactions, and @-mentions — send an image (GIF/JPEG/PNG/WebP), a short video (Knit re-encodes it to about 3 MB and keeps the first 61 seconds), any other file up to 8 MB, or a voice note held down in the composer. Files and voice notes are for DMs and groups, and the public room takes photos and videos only, so everything strangers see has been screened. In a group, @everyone mentions every other member at once. React with any emoji — the quick row learns the ones you actually use — and mentions raise their own notification. Attachment bytes are content-addressed and pulled on demand instead of riding the flood (encrypted ones by ciphertext hash, so dedup and pull are unchanged), and reactions converge across the mesh (last-writer-wins), sealed alongside delivery receipts in DMs and groups.
• Big files, phone to phone — a file too large to attach goes to one nearby contact from the menu in a direct message: the two phones raise a Wi-Fi Direct link between themselves for the transfer (up to 8 GB, measured at ~70 MB/s between two Pixels) and tear it down after. The bytes never ride the mesh and are never held in custody; the chat keeps a record of the hand-off, and the file lands in the other phone's Downloads.
• Voice calls — call a contact from their profile or the top of your chat. Someone nearby is reached over a Wi-Fi Direct link with no Internet at all, someone further off over the Internet, and when there's no live path the call becomes a walkie-talkie over the mesh. See Calls.
• Search everything you have — the magnifier at the top of the chat list finds a chat, a contact, or a message by what it said, from an on-device full-text index. Open a hit and its chat lands on that message. A stranger's message request stays out of the results until you accept it.
• See what your phone did for the mesh — tap the nearby count above the chat list for Your mesh: messages your phone passed along or handed straight to the person they were for, what it is carrying right now, and how many people it has met. Every number is counted on the phone and stays there, apart from the totals the watch app preview reads from it.
• Kilometres of range from a Meshtastic radio, if you want them — pair a LoRa board over Bluetooth and the Nearby room and your 1:1 messages get a hop measured in kilometres instead of metres, shared by every phone meshed with yours: one board extends the whole group. LoRa spends speed to buy that distance, so the board carries small frames only — group chats and attachments keep to the phone mesh or an optional relay — and a message that a Wi-Fi or Bluetooth link already delivered never spends airtime on the radio. Nothing leaves over LoRa until you pair a board.
• Link previews and shared locations, each opt-in — paste a link and your phone fetches the page's title and picture and sends them with the message, so the people you send to never contact the site. Fetching one shows that site your IP address, which is why it's off until you turn it on. The pin beside the paperclip reads your position once, between the tap and the send, and puts it in the message as a geo: line the other phone opens in any maps app — the only place the app ever reads where you are.
• Profiles — display name, status, and avatar flooded across the mesh; avatars transferred as files (re-pushed only when they actually change) and shown next to messages. Supporters can switch on a small badge on their photo, which every phone checks offline before it draws it.
• Backup and restore — your identity, contacts, groups and messages go into one encrypted file, locked by a recovery key Knit shows you once. Restore it on a new phone from the welcome screen. A backup belongs on one phone at a time, and if the same one turns up on two, each phone says so and offers to sign out there.
• On-device content moderation — abusive-text and explicit-image (NSFW) filtering that runs entirely offline (no network, no server): a deterministic profanity filter, a bundled TFLite toxicity text classifier, and a bundled TFLite NSFW image classifier. In the public Nearby and Meshtastic rooms, abusive text and explicit images and videos are blocked on send; DMs, groups and the commons are never checked on the sender's phone. Everything received, in every conversation, is collapsed/blurred behind tap-to-reveal (receiver-side enforcement is what actually protects a user in a mesh), under the receiver's own toggle, with one-tap block-sender. Your own avatar and group photos are screened when you set them. See docs/CONTENT_MODERATION.md.
• Messaging-style notifications with per-context channels (Nearby, groups, DMs) and a separate channel for mentions. A reaction to one of your messages notifies you too.
• Always-on background mesh via a foreground service, kept healthy by a heartbeat alarm, significant-motion re-scan, and radio-availability recovery; prompts to disable battery optimization. The mesh notification can pause Knit for 15 minutes or an hour so another app can have Bluetooth, and the mesh comes back by itself. Low-power mode in Settings turns Wi-Fi Aware off to save battery, and switches on by itself under Battery Saver: Bluetooth keeps you on the mesh, so messages still arrive while photos and files take longer.
• Offline app sharing — hand Knit to a nearby phone with no store: the installed splits are merged into a universal APK and re-signed on-device (ARSCLib + apksig).
• Material 3 UI with a coral brand theme and full dark mode — following your phone, pinned to light or dark in Settings, or taking your wallpaper's colours if you turn those on (Android 12+). A message you start and don't send is still waiting in that chat when you come back, and the chat list shows it as Draft: until it goes.

📞 Calls

Knit can call your contacts too, one to one. Call someone your phone meshes with and you don't need the Internet. The two phones raise a Wi-Fi Direct link between themselves, the same kind a big-file transfer uses, and the call runs over it. For someone further away the call goes over the Internet: it rings as a sealed direct message through the mesh or your relays, and your voice goes straight to the other phone where the network allows it, or through a TURN server where it doesn't.

When neither path exists, Knit places a mesh call instead, which works like a walkie-talkie: hold the button to talk and your words stream across the mesh in small chunks, playing about a second behind you between neighbours. Nothing is stored, and no burst lands in the chat. A contact's profile has a Mesh call button too, for when you'd rather start one yourself.

Only the two of you hear a call. A live call's audio is encrypted with DTLS-SRTP under keys each phone checks against the other's Knit identity, so a TURN server relays only ciphertext. Walkie chunks are sealed like any direct message, and the phones that carry them can't read them. A live call does show each phone's IP address to the other, and Relay all calls in Settings → Calls hides yours by routing every call through a TURN server instead.

Calls register with Android as calls, so a Bluetooth headset, a watch or a car can answer and hang up, and the audio follows your headset. Each call leaves a line in the chat, like "Missed call · 9:15 AM". Knit can also write each walkie burst out as text while it plays, and caption the other person on a live call. The speech recognition runs on the phone, and the words are never sent anywhere. Its model is a one-time download from getknit.app that starts only when you tap for it.

⌚ On your watch

Knit is coming to Wear OS. The watch app shows who your phone can reach without you taking the p