Technical Specification
Under the hood
Frontend
TanStack Start (React 19, Vite 7), Tailwind v4, PWA.
Crypto lib
libsodium-wrappers-sumo. No hand-rolled primitives.
Prekeys
Signed prekey rotated; one-time prekeys consumed on first contact.
KDF
BLAKE2b (crypto_generichash) with domain-separation tags.
Auth
Password ≥ 6 chars incl. 1 uppercase & 1 digit. No usernames.
Transport
HTTPS + WSS. Only ciphertext blobs cross the wire.
Backend
Cloudflare Workers edge runtime. Postgres via RLS-enforced Data API.
Identity
Ed25519 signing key + X25519 DH key derived from single seed.
Symmetric AE
crypto_aead_xchacha20poly1305_ietf_encrypt.
Session store
IndexedDB record per peer, sealed with crypto_secretbox_easy.
Auto-lock
1 / 5 / 10 / 15 / 30 / 60 min. Idle + tab-hidden aware.
Attachments
Per-file secretbox key; key travels in the sealed message.