How our encryption works

The short version

1. 01

   Your browser makes a key

   When you create a room, your browser picks a random 256-bit secret. It never leaves your device except inside the link you share.

2. 02

   The key rides in the link

   The secret sits after the # in the link. Browsers do not send that part to servers, so it stays between you and the people you share the link with.

3. 03

   Everything is scrambled before it leaves

   Messages, photos, nicknames and the room name are encrypted in your browser. Our server stores and relays scrambled data, and deletes it when the room ends.

What our server can and cannot see

You can check this yourself. Press the eye button in a room to see What our server sees: the real scrambled messages as they arrived over the connection.

How it works, in more detail

• The room key is 256 random bits made with your browser's own secure random generator.
• From that key, your browser derives two separate values with HKDF: an AES-256-GCM key that encrypts and decrypts, and an access token. We store only a hash of the access token, so we can check who may connect but can never get back to the key.
• Each message is padded to a multiple of 256 bytes before it is encrypted, so its stored size says little about its length.
• The room address and the kind of content (message, room name) are bound into each encrypted message, so a stored message cannot be moved into another room or passed off as something else.
• If you add a password, it is stretched with PBKDF2 (600,000 rounds) and mixed into the keys. Without the password, even the full link cannot read or download anything. Wrong guesses are limited to 5 per minute per room.
• Photos are shrunk and re-encoded in your browser, which removes location, camera and time data (EXIF). Each photo is then padded to a multiple of 64 KB and encrypted with AES-256-GCM under a fresh key of its own. That key only travels inside an encrypted message, and the file name never leaves your device.
• Photos are stored as scrambled files in Cloudflare R2 storage in the EU, and only someone with the full link (and password) can download them. When the room ends, its photos are deleted. As a backstop, a cleanup rule removes any leftover photo file after 410 days, longer than any room can last.
• All of this uses the cryptography built into your browser (WebCrypto). There are no third-party scripts on room pages.

The honest limits

• Anyone with the link can read the whole chat, including what was said before they joined. Share it only with people you trust.
• Nicknames are not verified. Anyone can type any name.
• You are trusting the website code we serve you. Because it is a web app, we could in theory serve different code. We keep the room code small, load nothing from other companies, and want you to be able to check it.
• Browsers can keep the full link, including the key, in history or sync it between your devices. Use Delete now for sensitive rooms.
• Anyone in the room can screenshot or copy messages, and save photos. No chat tool can stop that.
• If you report a photo and choose to send it, the key for that one photo comes with the report, so our moderators can look at it. Nothing else in the room is opened.
• There is no forward secrecy: if the link leaks while the room still exists, whoever has it can read the stored messages. Short lifetimes are the protection.

Questions people ask