End-to-End Encrypted Chat, Without a Phone Number

Saved Chat is FlashChat’s end-to-end encrypted messaging between FlashBuddies. Messages are encrypted in your browser with AES-GCM using a key derived from an ECDH P-256 exchange, and the server stores only the resulting ciphertext and initialisation vector — it cannot read your messages even with full access to its own database. Unlike every mainstream encrypted messenger, it requires no phone number and no account.

What end-to-end encryption means, without the marketing

Encryption in transit — the padlock on every website — protects data while it moves between you and the server. The server itself still sees the plaintext. Almost every chat platform stops there.

End-to-end encryption means the message is encrypted on your device and only decrypted on the recipient’s device. The server in the middle carries a blob it has no key for. If the entire database were copied, the attacker would hold ciphertext and nothing else.

That is what Saved Chat does. The distinguishing part is not the cryptography, which is standard — it is that you get it without handing over a phone number, which every mainstream encrypted messenger requires.

How it works

Key exchange

ECDH on the P-256 curve. Each device generates a keypair; the private key never leaves your browser.

Message encryption

AES-GCM, using a shared secret derived from your private key and your buddy’s public key.

What the server stores

Base64 ciphertext and an initialisation vector. Nothing else about the message content.

Attachments

Photos and voice notes are encrypted with the same scheme before upload.

Auto-destruct

A timer you set per conversation, capped at 24 hours.

Identity

A device-local keypair. No phone number, no email, no account.

Verifying you are talking to the right person

Encryption protects the message in transit. It does not, by itself, prove who is on the other end — that requires verification, and every serious encrypted messenger provides it.

Saved Chat generates a 60-digit safety number derived from both sides’ public keys. If you and your buddy see the same number, no one is sitting in the middle. It is the same principle Signal uses.

There is also automatic protection for the case people actually hit. The first time you talk to someone, their key is pinned. If it ever changes, you get an explicit warning rather than silence: "their security code changed — they may be on a new device, or someone is impersonating them", with the option to accept the new key or verify it first. A silent key change is how impersonation succeeds on platforms that do not warn you.

Using it on more than one device

Because your private key lives in your browser and nowhere else, a second device does not automatically inherit it. Pairing is explicit: your existing device shows a 6-digit code, you enter it on the new one, and the identity transfers directly between them.

There is also an optional password-encrypted key backup. It is opt-in on purpose — a backup is a copy of your key, and a copy is a risk you should choose deliberately rather than have chosen for you.

What is encrypted and what is not

Being precise about this matters more than a broad claim:

• Saved Chat between FlashBuddies — end-to-end encrypted. Text, photos and voice notes.
• Random one-to-one stranger chat — not end-to-end encrypted. It does not need to be: those messages are never written to a database at all. They live in server memory during the conversation and are dropped when it ends.
• Group rooms — not end-to-end encrypted. Room history is stored so people who join later can read recent messages. That is a deliberate design choice, and it is why rooms are not the place for anything sensitive.
• Metadata is not hidden. The server knows that two devices exchanged messages and when. It does not know what they said. Hiding metadata is a much harder problem and no mainstream messenger solves it either.

How it compares

WhatsApp and Signal both offer strong end-to-end encryption and both require a phone number, which ties your encrypted conversations to a real-world identity registered against government ID. Telegram does not encrypt end-to-end by default at all — only in Secret Chats.

Saved Chat is narrower in scope than any of them: it works between FlashBuddies inside FlashChat, not as a general-purpose messenger. What it offers that they do not is encrypted messaging with no phone number attached to it.

FAQ

Is FlashChat encrypted end-to-end?

Saved Chat between FlashBuddies is end-to-end encrypted using ECDH P-256 key exchange and AES-GCM. The server stores only ciphertext and an initialisation vector. Random stranger chat is not encrypted end-to-end because those messages are never stored at all.

Can FlashChat read my encrypted messages?

No. Encryption and decryption happen in your browser and the private key never leaves your device. The server holds ciphertext it has no key for.

Do I need a phone number for encrypted chat?

No. This is the main difference from WhatsApp and Signal, which both require one. Saved Chat uses a device-local keypair instead.

What encryption does FlashChat use?

ECDH on the P-256 curve for key agreement, and AES-GCM for message encryption. Attachments are encrypted with the same scheme before upload.

How do I know I am talking to the right person?

Compare the 60-digit safety number with your buddy. If both sides match, nobody is intercepting. If their key ever changes, you get an explicit warning before continuing.

What happens if I lose my device?

If you have no paired device and no key backup, the message history cannot be recovered — by you or by us. That is inherent to genuine end-to-end encryption.

Can I use encrypted chat on two devices?

Yes. Pair them with a 6-digit code shown on your existing device, which transfers the identity directly. There is also an optional password-encrypted key backup.

Are group chat rooms encrypted?

No. Room messages are stored so that people joining later can read recent history. Rooms are not the place for sensitive conversations.