End-to-end encrypted messaging

End-to-End Encrypted Messaging Direct messaging is now live between registered users. Every message is encrypted in your browser before it leaves your device — the server stores ciphertext only. How the Encryption Works Key generation happens automatically on first use: 1. Your browser generates an ECDH P-256 key pair using the Web Crypto API 2. Your public key is stored on the server 3. Your private key stays in localStorage — it never leaves your device When you send a message: 1. Your browser fetches the recipient's public key 2. Both keys are used to derive a shared AES-256-GCM secret (ECDH — neither key is transmitted, the secret is computed independently on both sides) 3. The message is encrypted with that secret + a random 12-byte IV 4. Only the ciphertext and IV are sent to the server The server has no way to read your messages. Even a full database dump returns only encrypted blobs. Using It Inbox: /messages or via the user menu → 🔒 Messages Start a conversation: go to any user's profile and click 🔒 Message {username} Reply: type in the thread — messages appear in real time (3-second poll) Device Limitation Because the private key lives in localStorage, messages only decrypt on the device where you generated your keys. If you log in on a new device, previous messages will show as [encrypted — open on the device where you logged in]. New messages sent to that device will decrypt normally after the new device publishes its own public key. This is the inherent tradeoff of true E2EE without a key escrow server.