All content is untrusted
Message text, display names, links, avatars and attachments are hostile input, before and after decryption. The interface renders them as inert text: no HTML, scripts or automatic link previews.
Matrix desktop client · Rust · GPL-3.0
A Matrix client designed to withstand targeted attacks.
Persephone is a Matrix chat client for Windows, Linux and macOS, written in Rust. It is designed to pair with Merovingian, a security-first Matrix homeserver, and it is built to work with any homeserver that follows the Matrix standard. It's made for everyone, but engineered to withstand a targeted attack, not just everyday threats. Every message, name, link and image is treated as hostile, even after it's decrypted.
Not ready for use.
Persephone is in active development. On Windows, test builds sign in, sync, send and
receive encrypted messages and images, and verify contacts, against test servers. Linux
and macOS support is being built. No release has been published yet, and no security
control has had an independent review. Do not use any part of it for real conversations.
01 / Scope
What the first release is meant to do
One account
Sign-in to a single Matrix account with a password. Other login methods are not decided yet.
Rooms and history
Room list and message history, using Sliding Sync with a classic sync fallback.
Text and images
Text and images. Sent images lose their location and other metadata; received images load only when you ask.
Encrypted chats
End-to-end encrypted rooms, emoji verification, key recovery, and a pause when a contact's identity changes.
Persephone is tested against both Merovingian and Synapse, including a server without Sliding Sync, and its encrypted chats are also tested with Element Web.
02 / Security
Security approach
The design assumes a capable adversary who may target one user directly. Most of these controls are built and tested on Windows; Linux and macOS are in progress, and none has had an independent review.
Cryptography stays in the SDK
Matrix encryption is handled by the maintained Matrix Rust SDK with explicitly selected features, never reimplemented by the client and never moved into the web view. ADR-0002
Images decode in a sandbox with no network
Image decoders run as WebAssembly inside a separately contained worker process. The module can call only four host functions for its input and output, so it cannot reach sockets, files, clocks or other processes, whatever the operating system allows. ADR-0003
TLS 1.3 only
Every connection requires TLS 1.3. Older protocol versions are refused.
Rust owns the logic
The web view is only the interface. Sessions, keys, storage and Matrix traffic live in a separate Rust core process, behind a narrow, validated command boundary.
Defence in depth
No single bug should be enough. Hostile content has to get past several independent layers before it could reach keys, the network or the rest of the system.
03 / Architecture
Architecture
Three trust zones. Arrows are the only paths data takes.
04 / Roadmap
Roadmap
Work on several milestones runs at once, but each is complete only when it meets its own security and compatibility goals on every platform. No milestone is complete yet, and there are no dates.
- P0
Feasibility and key decisions
In progress.
- P1
Application scaffold
Built on Windows; Linux and macOS launch in progress.
- P2
Protected storage and media handling
In progress.
- P3
Login, rooms and history
Working on Windows; some cases still to test.
- P4
Encrypted messaging
Passes its tests on Windows; manual checks, Linux and macOS remain.
- P5
Image messaging
Working on Windows.
- P6
Hardening and accessibility
Started.
- P7
Release readiness
Started: signed release builds are being set up. Includes an independent security review.
05 / Progress
Progress
As of 24 October 2026.
Working on Windows
In test builds against Merovingian and Synapse test servers: password sign-in, the room list and history, encrypted messages, emoji verification of devices and contacts, key recovery, the pause on a changed identity, and sending and receiving images. Encrypted messages also work with Element Web.
Next
Linux and macOS support, signed release builds, keyboard and screen-reader checks, and an independent security review. The full status is in the development plan.
06 / Source
Source and licence
Source code
Development happens in the open. The repository holds the desktop application, its tests and the design records.
Licence
Persephone is free software under the GNU General Public License v3.0.
Architecture decisions are recorded in the ADR index.