SecureChat is a privacy-first, mobile-only, real-time chat application that lets users create temporary, anonymous chat rooms with advanced privacy protection.
Built with real-time WebSocket messaging, AES-GCM encryption, and privacy overlays, SecureChat ensures conversations remain secure, short-lived, and for-your-eyes-only. No accounts, no traces, no digital footprint.
- Anonymous session-based identity (no login)
- Client-side AES-GCM message encryption (optional)
- Screenshot detection & prevention
- Disabled text selection, copy, and context menus
- Visual privacy overlay for suspicious activity
- Mobile-only enforced access
- WebSocket-based real-time messaging
- Typing indicators & live presence tracking
- Temporary in-memory message history
- Configurable room duration and member limit
- QR code sharing for room entry
- Room creator gets admin privileges
- Kick members from room
- Visual crown icon for admin
- Modify room settings (duration, limits)
- SPA with Vanilla JavaScript
- Component-based architecture
- Client-side router
- WebSocket integration
- Mobile-first design with enforced privacy behaviors
- Node.js + Express
- Real-time with native WebSocket (
ws) - Room/session management with PostgreSQL via Drizzle ORM
- Room expiration & cleanup logic
- Hosted on Neon (serverless PostgreSQL)
- Type-safe migrations via Drizzle Kit
- Tables: rooms, messages, members (ephemeral)
- User configures settings (duration, limits, etc.)
- Backend generates 8-digit numeric room code
- Room stored in DB with TTL
- WebSocket session initiated
- User enters or scans room code
- Server validates and joins user to the room
- Real-time presence established via WebSocket
- Message typed → client-side encryption (optional)
- Message sent via WebSocket
- Server validates & broadcasts to all connected members
- Message rendered on UI in real-time
- Cron job every 5 minutes checks expired rooms
- Expired rooms removed from DB
- WebSocket sessions disconnected
- Temporary message storage purged
| Tool | Purpose |
|---|---|
| Neon DB | PostgreSQL-as-a-service |
| Drizzle ORM | Type-safe DB interaction |
| dotenv | Environment variable management |
| ws | Native WebSocket server |
| Express.js | HTTP server |
Create a .env file in the root:
PORT=8000
DATABASE_URL=postgresql://your-neon-db-url
NODE_ENV=development# 1. Clone
git clone https://github.com/utsavbhardwaj/secretroom.git
cd secretroom
# 2. Install dependencies
npm install
# 3. Run database migrations (Drizzle)
npx drizzle-kit push
# 4. Start development server
npm run dev
No persistent accounts or cookies
- Messages are ephemeral (in-memory only during room lifetime)
- Client-side encryption prevents server-side interception
- HTTPS recommended in production
- Security headers enabled (CSP, Frame Options, Referrer Policy)
- CORS restricted to trusted origins
- WebSocket keeps data in sync without polling
- Connection pooling via Neon
- Horizontal scalability possible due to stateless session tracking
- Room expiry ensures storage cleanup
- Minimal JS footprint with native DOM rendering
- Optional end-to-end encryption with key exchange
- Self-destruct timers per message
- Audio/Video chat support
- Decentralized peer-to-peer mode (via WebRTC)
📧 Email: utsavjha.me@gmail.com