The Double Ratchet, Explained Simply

The double ratchet is the algorithm that quietly re-keys your conversation after every single message, which is why a modern encrypted chat can stay safe even when one key is stolen. Explained simply, the double ratchet combines two moving parts — a Diffie-Hellman (DH) ratchet and a symmetric-key ratchet — to give a conversation two properties that a single fixed key never can: forward secrecy and post-compromise security.

If you have already read what end-to-end encryption is, you know how a message gets locked so only the recipient can open it. The double ratchet answers a harder question: what happens to yesterday's and tomorrow's messages if today's key leaks?

Why one key per conversation isn't enough

Imagine two people share one secret key and encrypt every message with it forever. It works — until the key is exposed. A stolen phone, a compromised backup, a subpoena, or malware, and suddenly the attacker can decrypt the entire history and everything sent from that point on.

The fix is to stop reusing keys. Instead of one key for the whole chat, the double ratchet derives a fresh key for each message and throws the old ones away. Old keys can't be recovered, and new keys are constantly refreshed with material the attacker doesn't have. That is the whole idea; the two ratchets are just the mechanism that makes it practical.

The design comes from the Signal Protocol (originally the Axolotl ratchet) and now underpins the encryption in several mainstream apps — Signal itself, and WhatsApp, whose message content uses the Signal Protocol.

The two ratchets

A "ratchet," like a socket wrench, only turns one way. Once it clicks forward, it can't click back. Both ratchets here are one-way by design: they let you move forward to new keys but never backward to old ones.

The symmetric-key ratchet

The symmetric-key ratchet is a chain of keys produced by a key derivation function (KDF) — a one-way function.

• You start with a chain key.
• To send a message, you feed the chain key into the KDF. Out comes a message key (used to encrypt this one message) and a new chain key (used for the next message).
• The message key is deleted right after use.

Because the KDF is one-way, someone who steals the current chain key cannot run it backward to recover earlier message keys. Every message that already went out stays locked. This is where forward secrecy comes from: compromise today does not unlock the past.

But the symmetric ratchet alone has a limit. If an attacker grabs your current chain key, they can keep running the KDF forward and follow along with future messages. The chain heals nothing on its own. That is the job of the second ratchet.

The Diffie-Hellman ratchet

The DH ratchet injects brand-new randomness into the conversation on an ongoing basis.

Each side carries a temporary DH key pair (a "ratchet key") and attaches its current public key to the messages it sends. Whenever you receive a message carrying a new ratchet public key from the other person, you:

1. Perform a fresh Diffie-Hellman calculation with their new key and yours, producing a new shared secret.
2. Mix that secret into a root key, which in turn seeds new sending and receiving chain keys.
3. Generate your own new ratchet key pair for the next round.

Each DH exchange folds in entropy that an attacker who compromised the old keys simply does not have. Even if someone captured your keys earlier, once a new DH round completes that they didn't observe, they're locked back out. This self-healing property is post-compromise security (sometimes called future secrecy).

Put together: the symmetric ratchet turns fast (once per message) and protects the past; the DH ratchet turns slower (as the back-and-forth continues) and repairs the future.

Forward secrecy vs. post-compromise security

These two guarantees are easy to confuse. Here is the plain-English split:

Property	What it protects	Which ratchet provides it
Forward secrecy	Past messages stay safe if a current key leaks	Symmetric-key ratchet (one-way KDF chain) + deleting used keys
Post-compromise security	Future messages become safe again after a leak	DH ratchet (new shared secret mixed in each round)

A short way to remember it: forward secrecy protects backward in time, post-compromise security protects forward in time. You want both, which is exactly why the design uses two ratchets rather than one. There's a fuller walkthrough of the first property in forward secrecy, explained.

Where the double ratchet fits in the bigger picture

The double ratchet does not run a conversation from nothing. Something has to establish the first shared secret between two people who may never have been online at the same time. That job belongs to an initial key agreement — historically X3DH (Extended Triple Diffie-Hellman) in the Signal Protocol, and more recently PQXDH, which Signal adopted to add a post-quantum layer to that first handshake.

Once the handshake sets up the starting keys, the double ratchet takes over and keeps them moving for the life of the chat. Think of it as: the handshake opens the door, the double ratchet keeps changing the locks.

How Graphite uses the double ratchet

Graphite is an end-to-end-encrypted messenger by PrivacyPortal, and forward secrecy in Graphite comes from a Signal-style double ratchet — the same two-ratchet idea described above. Around it, Graphite layers a few things worth being precise about:

• The message encryption itself uses NaCl/libsodium X25519 sealed boxes, so only the intended device can open a message.
• A hybrid post-quantum layer based on ML-KEM-768 sits alongside the classical key exchange, hedging against a future where quantum computers threaten today's elliptic-curve math. (Signal has likewise moved toward post-quantum key agreement with PQXDH; the direction of travel across serious messengers is the same.)
• There is no account to compromise. Graphite has no phone number and no email — your identity is a 12-word recovery phrase generated on your device, and the server holds no account at all. The relay stores only sealed ciphertext, keeps it for at most seven days, and deletes it after delivery; it never sees plaintext, keys, or your recovery phrase.
• Tor by default hides your IP and network for signaling and messages, so the metadata around a conversation is protected in addition to its contents.

The takeaway: the double ratchet is what makes a stolen key far less catastrophic than it sounds, and Graphite pairs that with a design where there's very little sitting on any server to steal in the first place.

The short version

• The double ratchet gives each message its own key and constantly refreshes those keys.
• The symmetric-key ratchet (a one-way KDF chain) delivers forward secrecy — your past is safe if a key leaks.
• The DH ratchet (fresh Diffie-Hellman each round) delivers post-compromise security — your future heals after a leak.
• It's the standard behind Signal and WhatsApp's message encryption, and it's the ratchet Graphite uses too.

---

Try it for yourself. Graphite is a free public beta on Windows, Android, and the web — no phone number, no email, no logs. See how a modern double-ratchet messenger feels at graphite.chat.