Security at SecureChitChat

SecureChitChat is built around a simple idea: the safest data is the data you never collect in the first place. There is no account system, no password to store, no public profile to browse and no permanent archive of your conversations.

Reducing what the service holds also reduces what could go wrong. This page explains, in plain language, how the current version protects the service and your session — and, just as importantly, where those protections end.

When you create a guest profile, the backend issues a short-lived session token. That token is cryptographically signed with an HMAC-SHA256 signature, which means it cannot be altered without invalidating it, and it carries an expiry of one hour from the moment it is issued.

Because there is no password, there is no password database to leak. The browser keeps a small copy of the session in local storage so that all tabs of the same browser profile share a single identity. When you leave the session, the app removes that copy and tells the backend you are finished, which releases your display name for other people to use.

If a session is altered, forged or expired, it stops working. You can read the user-facing mechanics on how anonymous sessions work.

Messages are real-time text sent over a WebSocket connection. When the site is served over HTTPS — as it is in production — that connection uses the secure WebSocket protocol (wss), so the transport between your browser and the backend is encrypted in transit.

Each conversation is a room between exactly two people. The backend routes a message only to the other participant in that room; it is not broadcast to other users. Messages are held in the open page while you are chatting rather than written to a permanent chat history.

It is important to be precise: the current version is not end-to-end encrypted messaging. To deliver a message to the other person, it passes through the service's backend, and the person you are talking to sees exactly what you type.

We state this plainly rather than implying a stronger guarantee than the product delivers. If a conversation requires end-to-end encryption, use a service that is purpose-built for that. For related expectations, see what "anonymous" actually means here.

Every message is checked for address-like content before the room accepts it. Messages that look like a web address are rejected on the server, not merely hidden in the browser, so the block cannot be bypassed by disabling a stylesheet or editing the page.

This removes one of the most common vehicles for phishing, spam and scams. Be aware of what it is: a rule that looks for the common shapes of a URL, not a malware scanner and not an analysis of any website. Read why links are blocked in chat for the full explanation.

There is no feature for uploading photos, files or attachments in a room. Messages are text only, limited in length and typed like a conversation.

Removing media is a security decision, not just a design preference. Files are a common delivery method for malware, and images can carry identifying information or be used to pressure and blackmail people. A text-only room closes both of those doors.

The backend applies rate limiting to incoming requests per client, so a single source cannot hammer the API or the session endpoints without being throttled. The service also publishes a reporting workflow: harassment, threats, scams and illegal content can be reported for review.

Reports are handled by email through the Report Abuse page. Because conversations are not stored as a permanent transcript, the report is partly your account of what happened, so writing down the details while they are fresh matters.

No service can promise perfect security, and this one does not. The limits below are as important as the features above:

• The person you talk to can screenshot anything you send, regardless of whether the service stores it.
• Anonymous here does not mean invisible: your network and internet provider still handle connection-level information just as they do on any website.
• The service cannot protect information you choose to share in a message — once you type it, the other person has it.
• Text-only rooms stop file attacks, but they cannot stop someone from asking for your details in words.
• A shared or public computer keeps the temporary session in its browser until it expires or is cleared, so it is not the same as a private device.

If you believe you have found a security problem, please contact us at support@securechitchat.com with enough detail to reproduce it. We welcome responsible reports.

Please do not test against other users, do not attempt to access accounts or conversations that are not your own, and do not degrade the service while investigating. Good-faith reports are read and assessed.