What is lastsignal?

LastSignal lets you write encrypted messages for recipients and proves you're alive through periodic email check-ins. If check-ins stop, messages are delivered automatically. All encryption happens in the browser using Argon2id (256 MB) for key derivation and XChaCha20-Poly1305 for message encryption — the server cannot access plaintext or private keys. Features include trusted contacts who can delay delivery, per-recipient delivery delays, recovery codes for emergency stop, and a complete audit trail. It runs as a Ruby on Rails 8 application with SQLite, deployed via Docker Compose or Kamal. No hosted service exists; users must provide their own SMTP provider for email delivery. The project is MIT-licensed with no paid tiers.

Should you self-host lastsignal?

lastsignal scores 49/100 on selfhost.directory (how scoring works) and ranks #46 of 78 in Security. It has 759 GitHub stars.

There was no stable release in the past 12 months, so check the repository's recent activity before you rely on it.

Setup is moderate: expect some configuration beyond a single command. It is MIT-licensed and written mostly in Ruby.

Its closest alternative on selfhost.directory is pentagi (83/100, 32 648 stars). It scores higher overall, so compare the two before you pick. See lastsignal vs pentagi side by side.

Features

Audit Trail
Client-side encryption
Email allowlist
End-to-end encryption
External keep-alive webhookAdd-on for automations, not a replacement for email-first model
Flexible check-in timing
Passwordless magic link login
Per-recipient delivery delay
Recovery codes
Trusted contacts
Zero-knowledge architecture

FAQ

Can I self-host LastSignal?

Yes, that's the whole point. LastSignal is completely free and fully self-hosted. All you need is a server with SSH access and a reliable SMTP provider.

Can I limit who can sign in?

Yes. You can allow only specific email addresses to request sign-in links, so the instance stays private.

Can I delay when recipients can access messages?

Yes. You can set a per-recipient delay (up to a year). The email goes out immediately, but decryption is blocked until the delay passes.

What is a Trusted Contact?

A Trusted Contact can confirm you are alive but temporarily unreachable after the final reminder. Each confirmation delays delivery by the amount you choose. They cannot read messages or access your account.

How do I know the encryption actually works?

The code is publicly available and auditable. Security researchers can audit the code, and users can independently verify the client-side encryption.

What if a recipient forgets their passphrase?

There's no recovery option — the passphrase is the only way to decrypt messages. Recipients may optionally add a hint, but this should be used with caution.

What happens if I lose access to my email?

You'll receive a recovery code when you first sign up. Store it safely — you can use it to stop message delivery even without email access.

Can the server read my messages?

No. Messages are encrypted in your browser before being sent to the server. The server only stores encrypted data and doesn't have the keys to decrypt it.

Do you offer hosting or consulting?

There is no managed service, hosting, or paid plan. You run it on your own server. Consulting help with setup, customization, troubleshooting, or deployment is available by emailing hello@lastsignal.app.

Is LastSignal a business or a managed service?

No. LastSignal is a self-hosted project you run yourself. There is no business model, no paid product, and no managed service. The authors do not host, operate, or monitor it for you.