Privacy is a system property, not one feature
Chat256 combines client-side encryption, authenticated sessions, secure transport, protected media transfer and browser privacy controls. The aim is to reduce unnecessary exposure at several points in the communication path rather than relying on a single “privacy” switch.
Content protection
Supported private messages use ECDH P-256, HKDF-SHA256 and AES-256-GCM, with ECDSA P-256 used for authenticated application operations. Supported files and media are protected in the client before transfer.
What encryption does not hide
Encryption of message content does not automatically hide every fact about communication. Network connections, timing, service requests, account state and routing infrastructure can still create metadata. WebRTC calls may also use direct or relay paths depending on network conditions.
The recipient remains part of the threat model
A secure transport cannot stop the person on the other end from taking a screenshot, recording a call, copying a file or forwarding a message. Disappearing messages reduce server-side availability; they do not control the recipient's device.
Device security matters
If malware or another person controls the browser session, client-side encryption cannot protect information that is already available to that session. Use updated devices, screen locks, trusted browsers and sensible account security.
Choosing the right privacy control
- Use verified identities for sensitive one-to-one conversations.
- Use expiry when long server-side availability is unnecessary.
- Use Workspace when files should remain separate from chat publication.
- Use calls when real-time communication is more useful than written records.
- Use the security reporting route when you find a technical vulnerability.