Encrypted chat

How to start

Choose how messages are kept, pick a room name, set a password of at least 16 characters that is hard to guess and share the link with the people you want to talk to. Rooms are created only here, so every room gets a strong password and an explicit message mode; opening the address of a room that does not exist leads back to this form. The link does not carry the key: everyone has to type the password, which you should share another way, for example in person or over a different app. A saved room has no password: it gets a random address and a random 256-bit key after the # in its link, so that link is the key and must be shared just as carefully.

Messages

Every message is encrypted in your browser with AES-256-GCM. When you join, the password goes through Argon2id once, with 64 MiB of memory and 3 passes, so every offline guess is slow and memory-hungry. HKDF-SHA256 then splits the result into the message key, which also depends on the room's message mode, and a second, separate value that only proves to the server that you belong in the room. The server learns that value, never the encryption key, and the room on the server is named after a hash of it rather than after your room name. A saved room skips the slow password hash: its key is already random, so HKDF-SHA256 derives the message key and the access value from it directly. In rooms without server history each message also gets a second layer with forward secrecy, described below.

What the server sees and keeps

Rooms run on Cloudflare Workers. The relay forwards encrypted messages to the people in the room and does not store them, except in saved rooms, where it keeps the encrypted messages, at most 1000 per room, in the European Union until a member deletes the room or nobody has visited it for 90 days. Otherwise it keeps only the room settings, and deletes them when the room has been empty for 7 days. It does see when messages are sent, how many people are connected and, from the timing, when someone is probably typing. Every message is padded to one of a limited set of sizes, at least 512 bytes, so short messages, typing indicators and presence signals all look the same and longer ones only show their rough size. Cloudflare, like any host, sees your IP address, and the room name appears in the page address you load. In saved rooms it also keeps each member's public ML-DSA key, encrypted under the room key, so it cannot recognise a returning member by their key.

History and disappearing messages

In the default mode each participant keeps the history in their own browser: the signed messages, sealed under a key derived from the room secret, so they survive a reload. Members who are online hand up to the last 200 messages to a newcomer, encrypted for that newcomer alone and still carrying every author's signature, so nobody can put words in someone else's mouth while passing history on. Forward secrecy protects what crosses the relay; what members' browsers keep, they can show anyone who joins with the password, which is what this mode is for. In a saved room the encrypted history lives on the server instead, so it is there after a reload, on a new device or for someone who joins later; your browser keeps a copy too and asks the server only for what it has missed. You can instead make all messages disappear between 5 seconds and a day after they are shown, and then nothing is kept. In any room, ending a single message with !N, such as !30, makes just that message disappear after N seconds, and it is left out of the stored history. The timer runs in each participant's browser, so a modified client or a simple screenshot can still keep a copy.

Calls

Voice and video calls use WebRTC. On top of its standard DTLS-SRTP encryption, your browser encrypts every audio and video frame, screen sharing included, with AES-256-GCM before it leaves, in the style of SFrame. Each participant creates a random media key on joining and gives it to every other participant separately: inside the encrypted room channel, sealed once more with a key only those two browsers share for this call (ECDH P-256). When someone leaves, everyone who stays switches to a new key, so whoever left cannot decrypt what follows. Frames that do not decrypt are dropped, never played, and a browser that cannot encrypt frames cannot join a call. Call setup travels through the room as encrypted messages. Media always goes through a TURN relay, so participants never see each other's IP addresses; the relay only forwards encrypted packets. Every participant connects to every other one, so calls work best in small groups.

Files

Files up to 90 MB are encrypted in your browser with a random key of their own, including the file name. The key and the download link travel only inside the encrypted message, so a file is protected exactly like the message that carries it, forward secrecy included. The encrypted file is uploaded to encrypt.click's own storage, or, if that fails, to backup hosts through encrypt.click's server (files up to 50 MB only). The hosts see only the encrypted file, its size and the uploading address. Uploaded files are deleted 24 hours after upload; the message stays in the history, the download does not.

Good to know

The chat is only as private as the link or password: anyone who has it can join and read along from then on. In rooms with forward secrecy, though, a password learned later does not open traffic recorded before, although in the default mode members who are online pass recent history on to whoever joins. A wrong password leads to a room that does not exist, so if the page says the room does not exist although you expected others there, check the password. Up to 32 people can join a room.

Member keys in saved rooms

In every room your browser creates a signing key for that room and keeps it to itself; every message carries the public half and a signature, and anything unsigned is dropped, including history that other members pass on. Names are only labels: the random alias or whatever a member typed. Other members remember which key a name first appeared with and warn you when the same name, or one that only looks like it, shows up under a new key, which is what an impostor who knows the password or link would look like. The members panel shows a key code for each member, a short fingerprint of that one key, and a safety number derived from both your keys, which is the same on both screens: compare it in person or by voice. In a saved room a member's key is the pair of its Ed25519 and ML-DSA-44 keys, and the key code and the safety number cover both. A new browser or device gets a new key, so expect that warning after you switch. The signature proves who in the room wrote a message, not who they are, and the password or link is still the only thing that lets someone in. The message mode is part of the room key, so the server cannot quietly turn a room with disappearing messages into one that keeps history. In a saved room, whoever has seen the link can read everything for as long as the room exists, so share it with care and delete the room when it has served its purpose; deleting removes the history from the server and from the browsers of everyone connected.

Forward secrecy

In rooms that keep history only in browsers and in rooms with disappearing messages, the room key alone opens no message. Each browser creates a fresh P-256 key pair when it joins and keeps it in memory only. Every member has its own sending chain: each message is encrypted with AES-256-GCM under a key that HKDF-SHA256 derives from the chain, then the chain moves one step on and used keys are deleted. Every other member gets the current chain key separately, sealed under a key made from their two ephemeral keys (ECDH) together with a secret derived from the room password, inside the signed room channel as always. Someone who records the traffic and learns the password later cannot read the messages without breaking the key exchange, and once the session is over the keys needed are on no device any more. A future quantum computer that breaks P-256 would still need the password; against someone who has both the password and such a computer, forward secrecy does not hold. Chains are replaced after 100 messages or 10 minutes and whenever someone leaves: the new chain goes only to members who answer, so whoever left cannot read on with the keys they had. Newcomers get each chain only at its current step, so nothing that crossed the relay before they arrived opens with their keys. Saved rooms have no forward secrecy: their history has to stay readable on any device that has the link.

Saved rooms: complete history and post-quantum signatures

Saved rooms check instead that their history is complete. Every stored message carries its author's running number and the hash of that author's previous stored message, both under the signatures. Your browser follows each author's chain as history arrives and remembers how far it got, and members who are online announce their latest number and hash. If the server leaves out messages, puts an author's messages in a different order or holds back the latest ones, or if two different messages claim the same place, the chat shows a warning. The server still deletes the oldest messages once a room holds 1000, and the chat points it out when that happened while you were away; it can also hold back the latest messages of someone who is not online, and the order between different authors is not checked. Saved rooms also sign every message with ML-DSA-44 (FIPS 204) next to Ed25519, and a message counts only if both signatures are valid, so forging one would take breaking both. Each browser keeps its ML-DSA key sealed under a key derived from the room link. Messages name that key by its hash, and the server keeps the members' public keys encrypted under the room key, so messages from members who are offline can still be checked. A message without a valid ML-DSA signature, including one whose ML-DSA key is not available, is dropped.