Passphrase looks short — brute-forcing the stored key costs less than you think.
Change passphrase
Passphrase looks short — brute-forcing the stored key costs less than you think.
Danger zone
Wiping destroys the private key on this device. Messages encrypted to it become permanently unreadable (unless you restore a backup). Export first.
Add a contact
Verify these 12 emoji over a voice call before trusting this contact.
Waiting for a valid public key…
Export / import contacts
Contacts export as an unencrypted JSON array of {"name", "pub"}. If you restore contacts from an untrusted place, re-verify their 12-emoji fingerprints.
No identity on this device yet — create or restore one in the Setup tab first.
A static page for emergency encrypted text (X25519 ECIES + AES-256-GCM). You host it; friends exchange tagged envelopes (CJK base4096 or Z85) over any channel — tapped, monitored, hostile. The channel just carries opaque blobs.
Full protocol spec and the pinned threat model: see README.md in the repo.
- Message contents against tapped/monitored transport
- Tampered or forged ciphertext — any modification fails decryption
- Key-substitution attacks — if you do the fingerprint ceremony
- Private key at rest — device storage and backup files are passphrase-wrapped (PBKDF2-SHA-256 800k + AES-GCM)
- Availability — static files, works offline, a saved copy runs from
file://
- Sender authentication — anyone with your public key can send you a decryptable message. Judge senders by the voice ceremony and message context
- Replay — an old but genuine message can be re-sent to you
- Metadata & plaintext length — blobs are visibly crypto; who talks to whom, when, and the exact UTF-8 byte length of the plaintext (no padding) are visible
- Plaintext contacts & public keys at rest — your public key, saved contact names/keys, and last selected contact are stored unencrypted in
localStorage - In-app browsers (WebViews), non-standard browsers, & extensions — chat-app WebViews and extensions/userscripts (e.g. Tampermonkey, auto-translate, AI sidebars) can read the page DOM and steal passphrases or plaintext
- Cloud keyboards (IMEs) & clipboard managers — third-party keyboards or OS/cloud clipboard history can capture what you type or copy
- A compromised device while you use the tool (keyloggers beat any passphrase)
- Forward secrecy against later key theft — history falls if the private key falls
- A forgotten passphrase — the key and all its messages are gone forever
- Call each other on a hard-to-tamper channel (voice). Agree: we use this system, for what, around when.
- Each reads the 12 emoji (or their English labels) under their own public key; the other checks them against the fingerprint shown for that contact.
- Do it in both directions. 12 emoji ≈ 72 bits — has never been feasible to fake for anyone in scope.
- Treat unexpected blobs outside agreed windows with suspicion.
- Download the raw
index.htmlandcrypto.jsfiles from the repository into the same folder offline before you need them (avoid browser "Save Page As", which can breakcrypto.jsor bake live screen state into the HTML). - Export the passphrase-encrypted key backup (and optionally your contact list) and keep it somewhere survivable.
- Always open this page in standalone Firefox, Chrome, Edge, or Safari — never inside a chat app's built-in browser/WebView — and disable browser extensions (Tampermonkey, translation plugins, AI sidebars) on this page.
- Use your OS's built-in offline keyboard, and prefer reading decrypted messages on screen rather than copying plaintext to the clipboard.
- Never paste plaintext or the private key into any chat. Only envelopes and public keys.
- If adversaries upgrade to targeted nation-state: stop, use Signal/GPG/in person instead.