How a chat starts
- You create an invite. Show it as a QR code, or send the link through any messenger.
- Your peer opens it. In direct mode they send an answer code back; in Tor mode no answer is needed, their browser reaches yours through Tor.
- You are connected. Both screens show the same safety code: compare it when you did not meet in person.
Saved contacts reconnect without a new code in Tor mode, and a contact card (QR or link) lets someone add you without chatting first. One tab holds up to 16 chats and rooms at once, in a list like any messenger's.
What Ephem does
- Chats and rooms of up to 16 people, end-to-end encrypted (Noise), with replies, edits, reactions, read receipts and self-destructing messages.
- Direct mode: browser to browser, never through a relay. Tor mode: onion service to onion service, so nobody sees anyone's IP address.
- No chat history anywhere: close the tab and your chats are gone. Only your identity and contacts can be kept, and only in a key file encrypted with your passphrase.
- Public channels: you post, anyone with the link reads. A channel is served from your tab through Tor and verified by every reader; followers can mirror it.
- Where the usual way into Tor is blocked, paste your own Snowflake bridge lines.
What it does not do
- In direct mode your peer can see your IP address, and so can the STUN servers used to find a path (Google, Cloudflare). Use Tor mode, or a VPN, to hide it.
- It cannot deliver to someone who is offline: messages travel only while both tabs are open, and a channel is online only while its owner or a mirror has it open.
- It cannot connect every pair of networks directly; then it says so instead of silently using a relay. Tor mode is slower (0.5–2 s per message), text only.
- It cannot stop a peer from copying what you send, and channel posts are public and permanent: followers may keep copies.
- It cannot protect you from a compromised device, browser or extension, and you trust the code this site serves.
Browsers
Current desktop Chrome, Edge, Firefox and Safari, and Safari on iPhone and iPad (also as an app added to the Home Screen). Owning a channel needs a desktop browser (the tab serves it). Android Chrome should work but is not a primary target yet.
Under the hood
Rust compiled to WebAssembly owns all protocol state. Direct mode: WebRTC DataChannel, public STUN only for address discovery, Noise KK pinned to the exchanged codes. Tor mode: the Tor client (arti) runs inside the page and reaches Tor through Snowflake; chats use Noise IK over onion services. Channels are plain IPFS data (CIDs, DAG-CBOR, CAR, signed IPNS records), served over an onion service from the owner's tab. The full design, including its limits, is in the specification.