Tox is not secure.
Jason Donnenfeld (of Wireguard fame) filed a very alarming issue about how obviously bad the handshake was implemented[1], and lead developer Andre Almeida (iphydf/noavarice) continued to downplay the severity in public, while fashioning exploits based on it inside his "Club Cyberia" Tox group to weaponize said issue.
Stay away from Tox.