How it works

This page explains plainly what sockets protects, how, and where the honest limits are. No product should ask for your trust without telling you both halves.

The word is the key

When you type a secret word (or use a room code), your browser runs it through PBKDF2 with 100,000 iterations of SHA-256 and derives 64 bytes: the first 32 become an AES-256-GCM encryption key, the next 12 become the room's address on the server. The word itself never leaves your browser. The derivation is deliberately expensive, which slows down bulk guessing — but it cannot make a short or common word safe.

What the server sees

• Encrypted message blobs (ciphertext), each deleted within seconds of delivery.
• A room address that reveals nothing about the word that created it.
• Nicknames, presence, a settings flag, timestamps — all deleted when the room dissolves.
• Standard connection metadata: your IP address and connection timing, visible to Google Firebase and Vercel like any internet service.

The server never sees your word, your key, or any readable message content.

Disposability

Rooms exist only while occupied. Server-side disconnect rules wipe the entire room the moment the last person leaves — including crashes and closed tabs, since the cleanup runs on Firebase's servers, not in your browser. Nothing waits around for anyone.

Honest limits

• Short or common words are guessable. sockets accepts words as short as 3 characters for convenience, and words that short — or common words of any length — can realistically be found by someone running guesses. Whoever finds your word can silently occupy your room. If your conversation matters, use a long, unusual word; the minimum is a floor, not a recommendation.
• Anyone with the word is in. The word is the entire identity system. Rooms are capped at two people, but share the word only with the person you mean.
• You are trusting this site's code. sockets runs as JavaScript served by this website. Whoever controls the deployment could, in principle, serve different code. This is true of every browser-based encryption tool; it is why we publish the source for inspection.
• Metadata exists. Encryption hides what you said, not that a connection happened. IPs and timing are visible to infrastructure providers.
• The panic screen fools glances, not forensics. It is a convenience for shared spaces, nothing more.

Privacy & terms