The transport is replaceable, but the protocol is young
CryptoLayer puts an encrypted application protocol above whatever carries the bytes. Its main README is Russian, with a full English translation and a separate English architecture guide. Messages pass through application, presentation, transport, and transition layers. Those layers compress and encrypt content, split it into chunks, wait for acknowledgments, sign packets, and turn bytes into ordinary words before handing them to a module. The messenger or file system is treated as an untrusted wire.
That split is the interesting part. A transport module can target Telegram, VK, Discord, HTTP, a cloud drive, Bluetooth, or something more eccentric, provided somebody implements the module interface. CryptoLayer then owns delivery state and the cryptographic envelope. It is also a lot of protocol machinery to trust, especially in a repository with roughly 2,225 source lines and 6 tests.
A working client needs four pieces beyond the core library
The documentation does not present a single pip install followed by a ready chat window. It tells developers to add CryptoLayer and a separate modules repository, install a module interface from GitHub, generate combined requirements and hidden imports, and implement UIProvider callbacks. A 256-word dictionary is needed because WordCoder maps each byte to a word. The selected module supplies the real send and receive operations.
Application code must also choose a data directory, pass a password, display status, receive messages, handle ping timeouts, and ask the user to approve a peer signature. Messenger modules can request a login, password, phone number, port, address, or API key through their declared credentials. That design is flexible, but it moves product work into the adopter’s code.
What happened when we ran it
Our sandbox installed commit d12adf6 in 44 seconds. The Python environment added 45 packages and occupied 62 MB on disk. The build completed in 4 seconds, and pytest finished in 16 seconds with 6 passed and 0 failed. Pip-audit reported 0 known vulnerabilities in the installed dependencies.
The run did not prove message confidentiality, interoperability, or reliable delivery over a real messenger. We used an unprivileged Debian container with 3 CPUs, 8 GB of RAM, and no secrets. No live transport account was connected, no two-party session crossed a hostile channel, and no cryptographic audit was part of the test command.
The open security warning outweighs the clean test result
Open issue 18 documents flaws found against v1.6.3 and tells users not to protect real correspondence or confidential data with that version until the architectural problems are fixed. It lists man-in-the-middle exposure during initial key exchange, a short verification fingerprint, file-path handling, unauthenticated message handling, and transport logic errors. Several linked fixes were merged, and v2.0.0 specifically changed key derivation and the signature fingerprint.
The warning remained open and was updated on August 25, 2026. An open pull request also describes a handshake deadlock where a malformed service packet can advance state before the core accepts it. That is active repair work, which is better than silence, but it does not establish that every audit finding is gone. A security product has a higher bar than passing its own functional suite. Independent protocol review is the missing evidence.
Identity checking depends on a separate trusted channel
CryptoLayer generates signing keys, exchanges public signatures, and remembers known peers in encrypted local files. On first contact or after an identity change, both people are expected to compare displayed signatures through another route, such as a phone call or an in-person meeting. The documentation says this check cannot be skipped. After approval, incoming packets require valid signatures and the peers exchange ECDH public keys for message encryption.
That workflow resembles trust on first use, with a manual check doing the work a certificate authority or established identity system might do elsewhere. The safety of the session therefore depends on the surrounding UI explaining the check, users completing it correctly, and local identity state remaining available. If the storage password is forgotten, the documentation says the data directory must be deleted.
Packet volume can be a transport liability
The custom transport layer splits data into chunks, sends acknowledgments, retransmits missing pieces, and emits availability checks after 30 seconds without incoming packets. Open issue 34 asks for a reduced mode because one user message currently causes many underlying packets. The issue notes that some channels could treat that traffic as suspicious and block an account. This is a concrete drawback when the carrier is a consumer messenger rather than a socket you control.
WordCoder adds another unusual tradeoff. Replacing every byte with a dictionary word may get payloads through simple text filters, but it expands the content and does not make it ordinary human conversation. Teams should inspect module behavior and the carrier’s terms before using an account this way.
Recent fixes show activity, not settled security
GitHub recorded 252 stars, 6 combined issues and pull requests, and a last push on August 24, 2026. Release v2.0.0 landed the same day. Recent issues produced fixes for initialization timing, stream reassembly, node ID validation, key exchange, and English documentation. The open and closed activity shows people are testing the design rather than leaving it untouched.
For learning, that pace is attractive: problems are specific, code changes are visible, and our 44-second install makes inspection cheap. For confidential communication, fast protocol repair can be a reason to wait. Use the repository to study the design or prototype over a disposable channel. Do not make another person’s privacy depend on it until the remaining warning is resolved and an independent reviewer has examined the current protocol.