1. Part 1 of 4 · The threat model

   Assume the server is the attacker

   The server stores and relays your messages, but it can't read them, fake them or quietly change them.

   Under the hood. A database dump holds ciphertext only. Every message is signed by its author and linked into a hash chain, so the server can't forge, edit, reorder or drop messages without every client noticing.

2. Part 2 of 4 · Passwords and keys

   The password is split before it leaves the browser

   Your password unlocks your keys on your own device. The server only ever sees a derived login key.

   Under the hood. Argon2id turns the password into two keys: one signs in, the other unlocks an encrypted key vault that never leaves the browser. A 24-word recovery phrase regenerates every key the account will ever use.

3. Part 3 of 4 · Key transparency

   A public log the server can't rewrite

   Nobody, including the server, can swap in a fake key for someone without it being caught.

   Under the hood. Every key change goes into a Merkle tree log, the Certificate Transparency design. Browsers check inclusion and consistency proofs, and the log root is anchored daily on Bitcoin through OpenTimestamps.

4. Part 4 of 4 · Files

   Encrypted in the browser, stored by hash

   Photos and files are locked before upload, stripped of location data, and truly deleted with their message.

   Under the hood. Files are encrypted in authenticated 64 KiB chunks, stored by the hash of the ciphertext in MongoDB GridFS, and checked against the hash the sender signed before decrypting.

5. GhostChat

   Ready when you are

   Still starting. It will open as soon as it's up.

   Open GhostChat →

Read the full story Code