Security
Socketchat keeps what you write between the people in a room. Messages, files, display names and room names are end-to-end encrypted with a published standard, and the server that carries them cannot read them. The server can never read your messages, but it can see room rosters, when a message is sent, and can read IP addresses of users. It cannot see what was written or sent. It keeps all messages private, but does not make you anonymous.
Messages, files, photos and videos, display names and room names. Only the people in a room hold the keys that open them.
Everything Socketchat keeps on your computer is also encrypted, with your passphrase.
The server can never read your messages, but it can see room rosters, when a message is sent, and can read IP addresses of users. It cannot see what was written or sent. It keeps all messages private, but does not make you anonymous.
A room roster is a list of random keys, one for each member, which the server needs to deliver each message. It holds no names.
MLS (Messaging Layer Security), the group encryption standard the Internet Engineering Task Force (IETF) published in 2023 as RFC 9420. Socketchat uses it through OpenMLS, an open-source library written in Rust.
Encryption, in the docs explains each part in plain words.
Your invite link pins the server's certificate, so your app refuses an impostor server. When you join, your app checks that the link came from the person who invited you.
Safety numbers let two people confirm that nobody sits between them: a 60-digit number that matches on both screens, also shown as a QR code.
Socketchat destroys the room's keys on your computer at once. Its messages go once you have read them, and after 30 days they go anyway. Other members keep their own copies.
Report it privately through the Security tab on GitHub: choose "Report a vulnerability". Say what you found, how to reproduce it, and which version you tested.
SECURITY.md has the full cryptography notes.
More questions
No. The server can never read your messages, but it can see room rosters, when a message is sent, and can read IP addresses of users. It cannot see what was written or sent. It keeps all messages private, but does not make you anonymous.
No. The server never holds a key that can read messages, files, display names or room names. Whoever runs the server, or rents it to you, cannot read your rooms.
curl --proto '=https' --tlsv1.2 -LsSf https://github.com/sachio222/socketchat_v4/releases/latest/download/socketchat-installer.sh | shpowershell -ExecutionPolicy Bypass -c "irm https://github.com/sachio222/socketchat_v4/releases/latest/download/socketchat-installer.ps1 | iex"brew install sachio222/tap/socketchatOpen a new terminal when it finishes.
Then start a server with socketchat server init --host chat.example.com and socketchat server run, and open port 7444. Quick start on the home page.
Read next