Yak · self-hosted team messaging · walkie-talkie first
Self-hosted team messaging with a walkie-talkie built in, end-to-end encryption, and every message cryptographically signed. Your infrastructure. Your brand. Your data.
aes-256-gcm · ed25519 signed · push-to-talk · your own servers
The problem
Yak
Everything you need
Walkie-talkie built into every channel. Hold to talk, release to send. Real-time voice with a waveform.
AES-256-GCM with X25519 key exchange. Messages are encrypted on your device. The server never sees plaintext.
Every message signed with Ed25519. Tamper-evident hash chains prove message integrity and ordering.
Your logo. Your colours. Your domain. Deploy Yak as your own product; your team never knows it is Yak.
Threads, reactions, mentions, file sharing, image previews, editing and deletion. Everything you expect.
Owner, admin, member, guest. Invite-only teams. Channel permissions. A full audit trail of every action.
Runs on Cloudflare Workers and Durable Objects. Fast everywhere. No origin server required.
Web, mobile, desktop. QR code device linking with per-device encryption keys.
Each device gets its own Ed25519 signing key and X25519 encryption key. Revoke one without affecting the rest.
The math
Slack Pro
$8.75/user/month
Billed annually
Annual cost for 50 users
$5,250
And growing every time you add someone
Yak
$0/user/month
Infrastructure cost only (about $5 to $20 a month on Cloudflare)
Annual cost for 50 users
~$120
Same price whether it is 10 or 10,000 users
You save $5,130 a year
White label
Yak was built from day one to be white-labelled. Swap the logo, change the colours, point your domain, and deploy. Your team, your clients, your community sees your brand. Not ours.
Logo, colours, fonts, favicon. All configurable.
chat.yourcompany.com. Full CNAME support.
No "Powered by" badges. It is yours.
Run separate teams on one deployment.
Illustrative brands. Same platform, different names.
Security architecture
Messages are encrypted on the device with AES-256-GCM before they leave your browser. The server stores ciphertext only. Even with full database access, messages are unreadable.
Your device sees:
"Parts are printing. ETA 2 hours."
The server sees:
a4f8e2c1…b7d9f3a6
Every message carries an Ed25519 signature and a hash-chain link to the one before it. You can verify who sent it, when, and that nothing was changed.
Get started
Pull the repo. Configure your brand colours, logo, and domain.
One command to Cloudflare. Workers, D1, R2, Durable Objects. Done.
Create your team. Send invite links. Members generate their own keys.
Chat, walkie-talkie, voice messages. All encrypted. All signed.
Stop paying per seat. Stop trusting third parties with your conversations. Deploy Yak on your infrastructure and take control.