1 · Start in one minute
Ephem runs in your browser. There is nothing to install and no account to create.
- Open Ephem (direct mode) or Ephem in Tor mode. On an iPhone or iPad you can add it to the Home Screen from Safari's Share menu.
- In Chats, tap ＋ New, then Create invite. Ephem shows a QR code and a link.
- Let your friend scan the QR code, or send them the link through any messenger. It works once.
- Direct mode only: your friend's screen shows an answer. They send it back to you; you scan or paste it under 2 · Paste their answer and tap Connect. In Tor mode there is no answer: keep your tab open and they connect to you.
- You are connected. If you did not meet in person, compare the Safety code on a call and tap Codes match.
Got a code, link or QR from someone? Tap ⌗ Code at the top of the app. It accepts every kind: an invite, an answer, a reconnect code, a contact card, a channel link and a board link.
2 · Direct mode or Tor mode?
| Direct mode (app/) | Tor mode (app/tor.html) | |
|---|---|---|
| Your IP address | Your peer sees it (and the STUN servers that help find a path) | Hidden: nobody sees anyone's IP address |
| Starting a chat | Two codes: an invite and an answer | One code, no answer |
| Speed | Fast: browser to browser | About 0.5–2 s per message; the first connection can take a minute |
| Saved contacts | Need a new invite each time | Reconnect now without any code |
| Both sides | Your peer uses direct mode too | Your peer uses Tor mode too |
Rule of thumb: use Tor mode unless speed matters more than hiding where you are. Channels and boards always go through Tor, even when you open them from direct mode (Ephem then downloads its Tor part once, about 2 MB; your chats stay direct).
Where Tor is blocked, add your own Snowflake bridge lines in Settings → Connection and privacy (see Settings).
3 · Chats
During a chat
- Tap a message for Reply, React, Edit (your own), Delete for everyone (your own), Delete for me and Copy.
- ⏱ sets self-destructing messages: off, 5 s, 30 s, 1 min, 5 min, 1 h or 1 day. It applies to what you send from then on.
- Ticks show delivery and, if both of you allow it, that the message was read.
- ⓘ shows how you are connected and, in direct mode, what your peer can see of you (Show addresses).
- ＋ Add to contacts keeps the person so you can find them again (it needs a saved identity, see identity).
If the connection drops
In direct mode a network change (Wi-Fi to mobile data, for example) can break the path. Ephem shows Direct path lost: either of you taps Create reconnect code and the other scans or pastes it. Your messages, including unsent ones, are kept for 10 minutes. In Tor mode saved contacts use Reconnect now instead.
Leaving
Leave, or closing the tab, ends the chat for good. Nothing is stored anywhere: not on a server (there is none), not on your device. You can have up to 16 chats and rooms open at once.
Codes expire after 5 minutes by default (5, 15 or 30 in Settings). An invite works only once.
4 · Rooms
A room is a group chat for up to 16 people, created with ＋ New → Create room. Everyone is connected directly to everyone else; there is no server in the middle.
- You own the room you create. Add people with Invite member (can write) or Invite observer (can only read). Each invite works once. In direct mode you paste their answer under Add to room; in Tor mode no answer is needed.
- As the owner you can remove members and delete anyone's message for everyone.
- When the owner leaves, the room is gone for everyone.
5 · Your identity and contacts
Temporary or saved identity
By default every tab gets a fresh, temporary identity: nobody can link today's chat to yesterday's. To be recognisable (contacts, contact cards, channels, boards), open Settings → Your identity → Save this identity…, choose a label and a passphrase of 12 or more characters, and tap Encrypt and download.
- The downloaded key file holds your keys, nickname, contacts and bridge lines, encrypted with your passphrase. Ephem keeps no other copy.
- A lost file or passphrase cannot be recovered. Keep the file somewhere safe. When your contacts change, Ephem shows Backup out of date: tap Download again.
- Use a saved identity… signs in with the file (or its text) and passphrase. Remember on this device keeps an encrypted copy so you only type the passphrase next time.
- Receive identity from another device moves an identity between your devices (direct mode). Both devices show a safety code: never skip comparing it, because the whole identity is at stake.
Contacts and contact cards
- A contact card (a link with
#k=or its QR code) lets someone add you without chatting first. Share yours from Chats → ＋ New → Add a contact. Cards last 30 days or never expire (Validity of a new card). - In Tor mode someone can also connect to you once with your card; Ephem asks you first (Accept and add as contact or Decline).
- Open a contact and compare their number in person or on a call, then tap It matches: mark as verified.
- Reset my contact card makes every card you shared useless for new first contacts. Contacts you already have keep working.
6 · Channels
A channel is a public feed: only its owner posts, anyone with the link reads. It is served from the owner's browser tab through Tor and checked by every reader, so nobody can fake or roll back its posts.
Following a channel
- Open its link (
#c=…) or paste it in ⌗ Code or Following. Tap Follow to keep it in your list. - A channel is online only while its owner's tab, or a follower's mirror, is open. When it is offline you still see the last copy you verified.
- Mirror this channel serves a copy from your tab too, so others can read it while the owner is away. Your IP address stays hidden (Tor).
- Read without Tor… fetches it from a public IPFS gateway, which sees your IP address. It works only if someone mirrors the channel to public IPFS.
- Anyone can also read a channel in Tor Browser at its onion address: a plain page, no scripts.
Running your own channel
- My channels → ＋ New channel. It needs a saved identity and a desktop browser, because the tab serves the channel. Consider Use a separate identity for channels… so the channel is not linked to your chats.
- Posts are up to 4 KiB of text. Everything you post is public and permanent: followers may keep copies even of posts you delete. Your writing style and posting times can identify you.
- One device writes your channels at a time. Take over here moves hosting to the device you are on; the other one stops within minutes and says so.
- Export backup saves the whole channel. Mirrors you vouch for lists other onions that serve it, signed by you.
7 · Boards
A board (marked ▦) works like a classic image-less imageboard: anyone with its link posts anonymously, active threads are bumped to the top and old ones fall off. Text only.
Reading and posting
- Open its link (
#B=…). The catalog can be sorted by Bump order, Newest threads or Most replies, and searched. - Every post costs a little computing work (a proof of work), solved in the background while you type. Ephem shows how long it should take on your device. This is what keeps spam bots out; the board's host checks it, so it cannot be skipped.
- sage replies without bumping the thread.
- A trip label (optional) signs your posts with a key derived from your saved identity, so others can tell your posts apart without knowing who you are. Without one, each post gets a fresh anonymous key.
- If a board does not answer, it may be offline (the owner's tab is closed). Try again on a fresh connection helps when the host has just moved to another device.
- Titles, subjects and posts that contain invisible characters or text-direction tricks are refused, so nothing can look like something else.
Running a board
- My channels → ▦ New board. Hosting needs desktop Chrome or Firefox with the tab kept open: phones, Safari and the installed app pause background tabs. The board accepts posts only while that tab is open; readers can still read it from mirrors.
- You publish whatever your board accepts and are responsible for it where you live. Spam and illegal content will arrive; only you can remove it, and only while the tab is open.
- Moderation: delete posts (with Undo), Mass delete from a post number on, lock and pin threads, ban trips, and the switches under Settings: Pause posting, New threads closed, Trips only, Approved trips only, Pre-moderation (hold every post until you approve it), and an automatic flood response.
- Proof of work per post raises the cost of posting when you are flooded. Mirrors you vouch for and See also (links to other boards) are signed by the board.
- One device hosts a board at a time; Host this board here moves it, with its posts, bans and switches.
8 · Settings worth knowing
- Send read receipts / typing notifications
- Off means you neither send nor see them.
- Notify me of new messages and posts
- While Ephem is in the background. The notification never shows the text.
- Tell me when a channel or board I follow comes back online
- Checks its owner's address through Tor every 2 minutes while it is offline.
- Addresses in my codes
- Direct mode: what your codes reveal. LAN only for the same network, Drop IPv6 addresses if your VPN covers only IPv4.
- Tor connection
- Automatic uses the Tor Project's Snowflake. My own bridges takes Snowflake bridge lines (from bridges.torproject.org, choose snowflake, or from whoever runs the bridge). Only Snowflake works in a web page. Share my bridges gives friends a link with them.
- Code lifetime
- 5, 15 or 30 minutes.
9 · What is protected, and what is not
Protected
- Every chat and room is end-to-end encrypted. Ephem has no server that could read or store anything.
- In Tor mode, nobody (not your peer, not a server) sees your IP address.
- Close the tab and the chat is gone. Only a saved identity and contacts persist, encrypted with your passphrase.
- Channel and board posts are checked by every reader: they cannot be forged or rolled back.
- Updates never install themselves: a new version waits until you tap Update.
Not protected
- In direct mode your peer, and the STUN servers (Google, Cloudflare), see your IP address.
- A peer can copy or screenshot anything you send. Channel and board posts are public and may be kept forever.
- Messages travel only while both of you are online. There is no offline delivery.
- The Snowflake volunteer proxy sees your IP address and that you use Tor, not whom you talk to.
- A compromised device, browser or extension can see everything. You trust the code this site serves.
Always compare the Safety code with people you did not meet in person: if it differs, someone may be in the middle. The technical details are in the specification.
10 · When something goes wrong
- “No direct path between you and your peer”
- Some networks (a VPN, a strict company or mobile network) cannot connect directly, and Ephem never uses a relay. Try another network, or use Tor mode on both sides.
- Tor mode stays at “Connecting to Tor through Snowflake…”
- The first connection can take a minute or two. If it never finishes, Tor may be blocked where you are: add your own Snowflake bridge lines in Settings.
- “Ephem could not start” or an Update bar appears
- A new version was published. Tap Update. If no bar appears, reload the page; if that does not help, clear this site's data in your browser (your saved key file is not affected) or open the link in a private window.
- A code does not work
- It may have expired (5 minutes by default) or been used already: ask for a new one. Make sure you open it in the same mode it was made for (Tor links open
tor.html). - A channel or board does not load
- Its owner's tab is probably closed. You see the last verified copy; turn on Tell me when a channel or board I follow comes back online. A first read through Tor can take up to a minute.
- Links open in Safari, not in the installed app
- iOS does that. Use ⌗ Code to scan or paste the code inside the app.
- Forgot the passphrase
- It cannot be recovered, by design. Create a new identity and share your new contact card.
11 · Words used in Ephem
- Invite / answer
- The two codes that start a direct-mode chat; Tor mode needs only the invite.
- Safety code
- A short number both screens show. If they match, nobody is in the middle.
- Key file
- Your saved identity and contacts, encrypted with your passphrase.
- Contact card
- A link that lets someone add you as a contact.
- Onion address
- An address inside Tor (ending in
.onion) that hides where the computer is. - Snowflake / bridge
- The way Ephem reaches Tor from a web page, through volunteer proxies.
- Mirror
- A copy of a channel or board served by someone other than its owner.
- Proof of work
- A small computation each board post costs, to keep spam out.
- Trip
- An optional pseudonymous signature on board posts.