AES-256-GCM

AES (Advanced Encryption Standard) is the encryption itself. It’s the US government standard, used by banks, HTTPS websites, iMessage, FaceTime and Apple’s FileVault disk encryption. Transmitter uses it with a 256-bit key, the strongest standard size.

GCM (Galois/Counter Mode) is how AES is applied to each packet. As well as scrambling the packet, it adds a seal (the “tag”). Any packet that’s altered or faked on the way is detected and thrown away, so the sound and picture can’t be tampered with.

Keys and password

X25519 is how the two ends agree a fresh 256-bit key each time they connect, without the key ever crossing the network. FaceTime, Signal and TLS 1.3 use the same key exchange.

Your password is turned into key material with PBKDF2 (50,000 rounds) and mixed into that key, so without the password the stream can’t be unlocked.

Connecting by code: the two ends find each other through Transmitter’s own server, swapping their addresses encrypted with the code and password. The server can’t read them, and the sound and picture never pass through it. They go directly from the studio to the viewer.

Hardware Acceleration

All of it comes from Apple’s own encryption libraries (CryptoKit and CommonCrypto), which use the hardware encryption built into Macs, iPads and Apple TVs. That’s why it adds no noticeable delay.