Shuk
The simplest way to say something only one other person can read. No account, no phone number, no password — and no key that ever reaches the server.
Get the Android app
Point your camera at the code, or download it here. Android will ask you to allow installing from outside the store.
It is the stronger of the two: the page lives inside the signed APK instead of arriving from a server each time, the certificate is pinned, the WebView is barred from the network entirely, screenshots are blocked, and it routes through Tor if Orbot is running.
— · SHA-256 —
Hand this link to one person
Anyone holding it can read the room, so pass it through something you already trust — in person, or a channel you'd trust with the message itself.
What this does protect
- The relay can't read you. AES-256-GCM, key derived in your browser from the link fragment. The server receives ciphertext and a one-way hash of the key.
- No account, no password, no recovery. A profile is a key pair generated here and marked non-exportable — this page cannot read it back out, and nor can a page that replaces it later. There is nothing to log into and nothing to subpoena.
- Nobody can take your address. It is the fingerprint of your own public keys, recomputed by the relay on every publish, so there is no name-server to trust and no window in which the wrong key could be served under your name.
- Forward secrecy, between profiles. Every message rides a fresh ephemeral key plus a one-time key the relay hands out exactly once and the recipient destroys on use. Once it is gone, the long-term identity key will not reopen that message.
- Photos and files are sealed too. An attachment is split into fixed-size chunks, each encrypted on its own under a key that exists only inside the message naming it. The relay stores the chunks of a photo and has no path to it, and because the index and the count are authenticated it cannot reorder them, cut the tail off, or splice in a chunk from another file without the whole thing failing to open.
- Tampering shows. GCM authenticates every message; an altered byte renders as a broken-seal slip, not as text.
- Messages expire. Each slip carries its own delete time and is swept server-side; Burn wipes the room immediately.
- No third party on the page. No webfont, no CDN, no analytics — one HTML, one CSS, one JS, all from this origin, locked down by CSP.
What it does not
- Metadata still exists. Your network and the host see that you reached this site, when, and roughly how much. Content is sealed; the fact of traffic is not. Use Tor or a VPN if that matters.
- Your device is the weak point. A screenshot, a shoulder, a keylogger or a backed-up browser history beats any cipher.
- The link is the secret. Whoever gets it — including whoever reads it over your shoulder in a chat app — gets everything in the room.
- In a burner room, no identity. Anyone with the link can type any name. With a profile this is fixed — messages are signed, and an address is the fingerprint of the keys that signed — but a profile is a lasting thing the relay can see receiving mail.
- On the web, you trust the code you were served. A compromised host could ship a page that leaks the key. Check the fingerprint below against another device — or use the Android app, which carries its own copy and pins the certificate, so neither the host nor a CA can swap it.
- A profile is a social graph. The relay knows an address exists, and that its mailbox receives mail — not from whom, and never what. A burner room leaks none of that. Pick the one that fits what you are protecting.
- A file gives away its rough size. Chunks are padded to 16 KB each, so the relay sees "between 32 and 48 KB", not the exact length — but it does see that a file was sent, when, and roughly how big. And the moment you save one it stops being sealed: it is then an ordinary file on an ordinary device, where a backup or another app may reach it.
- Burner rooms have no forward secrecy. One key covers the room's whole life, so a link that leaks later opens anything unexpired. Profiles do not share this: each message gets its own ephemeral key and a one-time key that is destroyed on use.
So: not 100% untappable — nothing is, and anything that claims to be is selling you something.
What it is, is a channel where the operator of the server has no technical path to the contents,
and the remaining risks are yours to manage rather than theirs to abuse.
Code fingerprint of this page: measuring…
One device, one key, no password
Make yourself an address.
Your keys are generated here and marked non-exportable, which means this page cannot read them back out — and neither can a page that replaces it later. There is nothing to log into, and nothing to recover: lose the device, lose the identity.
No conversations yet.
Tap the pencil and paste someone's address.New conversation
Their address is 16 characters. Case, spaces and dashes don't matter.
Keys
Nothing between you yet.
What you send is sealed to their key alone.Kept on this device only. It travels inside the encryption, and it proves nothing.
Applies to what you send from now on. The relay deletes on expiry, on every read.
measuring…
Same on every device = you were all served the same code.
—
Metadata, your own device and whoever holds the link are all outside what a cipher can reach.
Sealed and empty.
Send the first slip, or hand someone the invite link.