WithinCells

Secrets within cells.

Deutsch · English · Español (Latinoamérica) · Español (España) · Français · Italiano · Nederlands · Polski · Português (Brasil) · Português (Portugal)

The password is on one device. You need it on another—without sending it to yourself through email, chat, or a cloud clipboard.

WithinCells transfers passwords, API keys, recovery codes, and other short confidential text to one explicitly selected device. Android, Linux, and Windows do not need an account, relay service, or shared network. Use a QR code or, where supported, an encrypted Bluetooth transfer between paired WithinCells devices.

WithinCells complements a password manager; it does not replace one. It is not a general file-transfer tool and cannot make a compromised target trustworthy.

Release channels

Product	Current version	Availability	Intended use
Community for Android	0.1.7	Public on Google Play	Private and professional use without organization management
Community desktop	0.1.5	Public preview	Evaluation with synthetic or low-risk test data
Team 0.2.x	0.2.1	Restricted internal Early Access	Two-device and organization testing; not a production release

These channels deliberately differ. A newer internal build does not make the public desktop preview production-ready.

Download

The current public desktop Preview is 0.1.5:

• Windows MSI and portable EXE
• Debian package
• RPM package
• All desktop releases

Choose the MSI for a normal Windows installation. The EXE is the portable Windows build. On Linux, choose the Debian package for Debian or Ubuntu and the RPM package for Fedora, RHEL-compatible systems, or openSUSE.

Android Community 0.1.7 is available from Google Play. Android APK files are not distributed from this repository.

Install on Linux

NixOS or Nix

The public repository contains a locked binary Flake for x86_64-linux. Run the desktop client without installing it into a profile:

nix run git+https://git.schukai.me/releases/within-cells.git

Install both the desktop application and bundled cells CLI into your user profile:

nix profile install git+https://git.schukai.me/releases/within-cells.git
cells version

The Flake downloads the public Debian artifact and verifies its fixed SHA-256 before extracting it for NixOS. It starts the packaged application through the Nix-provided Java runtime instead of patching the native jpackage launcher. It does not build or download the private application source code. The current Flake supports x86-64 Linux only.

For a declarative NixOS configuration, add the public repository as an input and install its default package:

{
  inputs.within-cells.url =
    "git+https://git.schukai.me/releases/within-cells.git";

  outputs = {nixpkgs, within-cells, ...}: {
    nixosConfigurations.my-host = nixpkgs.lib.nixosSystem {
      system = "x86_64-linux";
      modules = [
        ({pkgs, ...}: {
          environment.systemPackages = [
            within-cells.packages.${pkgs.system}.default
          ];
        })
      ];
    };
  };
}

Debian or Ubuntu

Download and verify the package before asking APT to install the local file:

curl -fL -o within-cells_0.1.5-1_amd64.deb \
  https://git.schukai.me/api/packages/releases/debian/pool/stable/main/within-cells_0.1.5-1_amd64.deb
echo 'a106b170071bfdded0ee086804d452b4c2829cceadcd4481637e1693229e5be8  within-cells_0.1.5-1_amd64.deb' | sha256sum -c -
sudo apt install ./within-cells_0.1.5-1_amd64.deb

Fedora, RHEL-compatible systems, or openSUSE

Download and verify the RPM:

curl -fL -o within-cells-0.1.5-1.x86_64.rpm \
  https://git.schukai.me/api/packages/releases/rpm/stable/package/within-cells/0.1.5-1/x86_64/within-cells-0.1.5-1.x86_64.rpm
echo '585e6783f33a9f3d951bc3f899d9e04ea567f02f1d090595dd23d4d95b323cdc  within-cells-0.1.5-1.x86_64.rpm' | sha256sum -c -
sudo dnf install ./within-cells-0.1.5-1.x86_64.rpm

On openSUSE, use sudo zypper install ./within-cells-0.1.5-1.x86_64.rpm for the final command. The package-registry pages linked above remain useful for inspecting package metadata and future versions.

Verify a download

Every release contains SHA256SUMS. Download it next to the installer and compare the digest before running the package.

Linux:

sha256sum -c SHA256SUMS --ignore-missing

Windows PowerShell:

Get-FileHash .\WithinCells-0.1.5.msi -Algorithm SHA256

The result must exactly match the corresponding line in SHA256SUMS. Each installer also has an SPDX SBOM and a platform build receipt in the release.

First transfer

1. Install WithinCells on both devices.
2. Open Devices on the first device and create a pairing QR code.
3. Scan that code on the second device. It immediately shows a response QR.
4. Scan the response on the first device. Both scans are required even for a one-way transfer: encryption and sender verification use different public keys.
5. Open the device details to review its full ID and security fingerprint.
6. In Send, select the paired target device, enter the secret, and create the transfer QR code.
7. Scan it with the target device and use one-time input where available.

Pairing is the trust decision. Scan pairing codes only from a device you can identify and whose screen you can see directly.

Safety notes

• Do not publish pairing or transfer QR codes, even though transfer payloads are encrypted. Avoid screenshots, recordings, and unnecessary photographs.
• Select the intended recipient before creating a transfer. Only that device should possess the private key needed to open it.
• Prefer one-time input or an explicitly authorized auto-type path. Clipboard delivery is a clearly marked fallback and can be observed by privileged software or clipboard history.
• “Retired after paste” means WithinCells will not offer that message again and records its message ID against replay. It does not revoke a static password at the service where that password is valid.
• An expired or retired message does not erase text that has already reached a destination application.

Open WC1 v2 protocol

The data format is public so that independent implementations can interoperate and the security design can be reviewed without access to the application source code.

Read WithinCells RFC 0001: WC1 wire version 2

WC1 is the protocol-family name. The current implementation emits and accepts only wire version 2 / suite 2, abbreviated WC1 v2. The stable QR/text prefix remains WC1:; WC2 would denote a different protocol family, not the second WC1 wire version.

WC1 v2 defines recipient-bound HPKE encryption, Ed25519 sender authentication, deterministic CBOR serialization, Base45 QR encoding, pairing offers, replay identifiers, expiry, and an optional BLE bearer. The specification is an independent public RFC, not an IETF publication.

The specification text is licensed under CC BY 4.0. The WithinCells application, name, artwork, and trademarks remain separately licensed.

Support and security

For ordinary help or reproducible defects, use the public issue tracker. Include the WithinCells version, operating system, expected result, and actual result. Never attach real secrets, state directories, pairing offers, private keys, or customer policies.

Report security vulnerabilities privately to security@schukai.com. Include the affected version, platform, reproduction steps, and impact, using synthetic test values only. General enquiries can be sent to hey@schukai.com.

The public repository contains release binaries and interoperability documentation. Application source code is not distributed from this repository.