Encrypted Chat
Chat through this page. Each message is encrypted on your device before it leaves, and the history shows encrypted text unless you ask to read it.
The same passphrase on both devices, typed into this exact address, opens the same room. Starting takes a few seconds on purpose, to make guessing slow. If your browser offers to save or fill a password here, decline.
How this works, and what it cannot do
- Your message is sealed on this device before anything is sent. The relay that passes messages along is sent only sealed text, and it refuses anything else. This page never sends it your passphrase.
- You are trusting whoever runs this address to serve this page unchanged. They could serve a different page that behaves differently, and this page cannot warn you about that. The original Sealed Message tool can keep a checked copy of itself on your device. This page cannot.
- The passphrase does two jobs. It locks each message, and it decides which room you are in. Both devices reach the same room by typing the same passphrase into this exact address. A different address, even for the same machine, is a different room.
- A short or common passphrase can be guessed, and a room lasts until someone ends it, so a patient guesser gets many tries. Anyone who guesses it lands in your room and can read it. Use a long one, and a new one for each session.
- The menu shows how many devices have opened the room. Opening the page in another tab counts as another device. Set People expected in this room to 2, 3 or 4, and the count turns red when more devices than that have opened it. That setting lives on this device only and starts at 2. If someone joined before the people you expected, the count can look normal, so treat it as a warning sign and not as proof.
- The switch at the top decides what is readable. A message that is not readable shows its encrypted text instead. With Decrypt current message, only one message is readable at a time: the newest one from the other device opens by itself, and tapping another message or a file asks for the passphrase again before it replaces it. Decrypt all messages asks for the passphrase again too, and then every message is opened and stays readable on screen, so use it somewhere private. Switching back locks them all again at once. This page stores nothing you open: ending the session or reloading the page discards it. Your phone may still keep a picture of the screen for its app switcher.
- Attach file seals a file of up to 200 MB on this device and sends it in pieces of exactly one megabyte, a few at a time, so neither the relay nor the network learns its true size. Its name and type are sealed inside it. The relay refuses pieces whose bytes are plainly not sealed, which guards against a mistake, but the relay cannot prove sealing: that rests on this page. A large file takes minutes, not seconds: keep this page open and in front until it finishes, and use Stop this transfer to give up. Files do not open by themselves. Tap one to fetch and open it, then choose Show image, which previews it here, or Download. A downloaded file is an ordinary readable copy on your device, and End session cannot remove it. Files exist only in the chat, and cannot be opened in the original tool.
- Audio call and Video call ring every other device in the room, and each can answer or decline. A call holds up to four people. Each pair of people in it has an encrypted link of their own, so nothing is mixed or opened on the way, and each person you add costs every device more battery and data. When one person hangs up the rest carry on. If a call is already going on, the call buttons join it. It only rings while their chat is open and in front: a web page cannot wake a locked phone, and doing so would need a notification service run by someone else. With the chime switched off, an incoming call makes no sound. The notes that set a call up are sealed with the session passphrase like any message, so only someone holding the passphrase can ring you, and nobody in between can put themselves into the call. The sound and picture never pass through the relay. They go through a forwarding server at this same address, already encrypted between the devices by the browser, so that server passes on what it cannot see or hear. It does learn the internet address of every device in the call, that a call is happening, how long it lasts, and roughly whether it is sound or picture. The relay learns that a call is being set up. No device learns another's address. A call pauses or drops if the phone locks or you switch to another app. This page records nothing and keeps nothing of a call, but the other person could record it on their device, as with any call. A call ends with End session. A missed call leaves a line on this device only.
- A short chime plays when a message or file arrives from the other device, unless you switch it off with the Chime button. Switching it on plays it once, so you can hear whether your device will sound. With the chime on, an iPhone plays it even when set to silent, and may pause music playing in another app. It only works while this page is open and in front. The page cannot alert you when it is closed or the phone is locked, because that would need a notification service run by someone else. The switch is not remembered between sessions.
- The relay holds the sealed messages in memory until someone presses End session. It writes nothing to disk and keeps no log of requests. If the relay restarts, every open room is lost.
- End session removes the room from the relay, overwrites the relay's stored copy of every message, and clears this device. Those messages were only ever sealed text. The relay cannot scrub the brief working copies it made while passing them along, which its memory reclaims in its own time. The other device clears itself the next time it checks in, or the next time it tries to send. It cannot remove records kept elsewhere that a connection happened, or anything the other person copied.
- The page cannot tell you who wrote a message, because both of you share one passphrase. It only marks what this device sent during this session. The relay could also hold back, repeat or reorder messages. Each opened message shows when it was sealed, which is how you would notice an old one sent again.
- Every sealed message here is an ordinary Sealed Message. To seal or open one by hand, use the original tool, which is blocked from using the network at all: sealed-message.statichost.page
- Always open this address in Safari, Chrome or Firefox itself. The browsers built into apps such as Messenger and Instagram can read what is typed into any page they show. This page refuses to work in the ones it can recognise, but it cannot recognise all of them. A keyboard app with full access can also see what you type, and no page can detect that.
- Only the one script built into this page can run here, and it talks only to the relay that served it. Your browser enforces the first part.