CypherBay

Anonymous, end-to-end encrypted communication

Private conversations with nobody in the middle. No registration, no accounts, no traces.

End-to-end encrypted

AES-256-GCM. The server only ever stores ciphertext it cannot read.

Encrypted file sharing

Files are encrypted in your browser before upload. Only session participants can decrypt them.

No account needed

No login, no email, no phone number. Pick an alias and start talking.

No tracking

No cookies, no analytics, no fingerprinting. Sessions auto-delete after one hour.

Real-time

Typing indicators, instant delivery, optional sound notifications.

Easy to share

QR code and direct link per session. No app or account needed on the other side.

Self-hostable

Open source, runs on any PHP server. Own your infrastructure.

What we can't protect you from

  • The server sees your IP address and connection timestamps
  • For real anonymity, use Tor Browser
  • No protection if your device is compromised
  • Share the password through a separate channel, not in the chat
  • Uploaded files are kept for 7 days, then deleted
  • Sessions expire after 1 hour

Create New Chat

Share the Session ID and password with your conversation partners.

Scan to get the Session ID

The password is never sent to the server. It is used for encryption only.

Important: Both the Session ID and password are required to join the chat. There is no password recovery.

Saves the Session ID in cookie cypherbay_session (path /, expires after 1h). The password is never stored.

Join Chat

If the password is incorrect, messages will not be readable. No error message will be returned from the server.

Session:
Connecting...
Encryption Details

Messages and files are encrypted with AES-256-GCM before leaving your device.

The key is derived locally from your password and session ID (PBKDF2-SHA256, 310,000 iterations). The server stores only ciphertext and never sees plaintext.

Files are encrypted in the browser before upload. Decryption happens in the browser on download — the server cannot read them. Your alias is visible to other participants.