Encrypted whiteboard

Sketch together on a private canvas. Pen, shapes, text - synced in real time, end-to-end encrypted, no signup.

Step 1 of 2

Anyone who enters this name + the same password meets in the same room. Pick anything memorable - it is not secret.

How it works

How to start

Choose a room name, keep the generated passphrase or type your own of at least 16 characters that is hard to guess, and open the board. Send the link to your collaborators and share the password separately, ideally in person or over another app. The password is not part of the link.

Encryption

The password goes through Argon2id once, with 64 MiB of memory, 3 passes and a salt made from the room name, and HKDF-SHA256 splits the result into a base key and a separate value that lets you into the room without revealing the key to the server. Every stroke, shape, text and cursor movement is padded and encrypted in your browser before it leaves, each message with its own AES-256-GCM key derived from the base key and a fresh random salt, so even hours of busy cursor traffic never wear out a single key.

What the server sees and keeps

The relay on Cloudflare Workers passes encrypted updates between participants and stores nothing. The drawing lives only in the browsers of the people in the room and syncs between them as encrypted CRDT updates. When the last person leaves, the board is gone, so export a PNG if you want to keep it. The relay can see how many people are connected and when updates are sent, and Cloudflare sees IP addresses.

Good to know

Anyone with the room name and password can join and see everything on the board, so treat the pair like a key. Up to 32 people can draw together, and anyone in the room can lock it so that nobody new can join until they unlock it or leave. The board also has its own encrypted chat. Its messages travel with the drawing, so newcomers see recent ones and they vanish when the last person leaves; end a message with !N to make it disappear after N seconds.

Signatures and keys

Each browser also keeps its own signing key for every board. Everything you send, from strokes and cursor moves to chat messages, is stamped with the room, the time and a unique id and signed with that key before it is encrypted, so the relay cannot replay old updates and nobody in the room can speak under someone else's name. The first key seen with a name is trusted; if the same or a lookalike name later shows up with a different key, it is marked as a new key on the cursor and in the chat. Open the people list in the bottom bar to compare safety numbers and trust the key.