Secure Messenger
End-to-end encrypted chat and video calls in the browser
- React
- TypeScript
- Vite
- Zustand
- Tailwind CSS
- Socket.IO
- WebRTC
- WebCrypto
- Node.js
- Express
- MongoDB
- Redis
- MinIO
A web messenger with anonymous accounts: no phone number or email, just a username and an invite code. Messages, photos and voice notes are encrypted in the browser with the WebCrypto API before they are sent, so the server only relays and stores ciphertext. Audio and video calls go directly between the two browsers over WebRTC. The interface is available in English, French and Arabic.
Features
- Anonymous accounts: a username and an invite code, no phone number or email
- One-to-one and group chats in real time
- Photos, files and voice notes, encrypted before upload
- Audio and video calls over WebRTC
- Read receipts, replies, reactions and pinned messages
- Safety numbers to check a contact's identity in person
- English, French and Arabic interface with a right-to-left layout
How the encryption works
- Each account's key pair (ECDH P-256) is created in the browser; the private key never leaves the device
- Every message gets its own AES-256-GCM key, wrapped for each member with a key derived through ECDH and HKDF
- The same scheme covers private chats and groups, so the server never holds message text
- Attachments are encrypted before upload; their key travels inside the encrypted message
- Every request and socket event is tied to a session token and checked against conversation membership