02 / Full Stack · Security

Encora

Real-time, end-to-end encrypted chat application — messages are encrypted in the browser before leaving your device.

Overview

A full-stack chat application with true end-to-end encryption using ECDH + AES-GCM. Inspired by WhatsApp, Encora supports real-time messaging, typing indicators, message delivery and read receipts, and a mobile-first UI — with Google Sign-In and no plaintext ever reaching the server.

Problem

Most chat applications rely on server-side encryption, meaning the server can read your messages. Building genuine E2E encryption requires the cryptographic operations to happen entirely in the browser, with the server acting only as a relay.

Approach

Used the Web Crypto API to generate ECDH P-256 key pairs in the browser. Private keys are encrypted with a user PIN (PBKDF2 → AES-GCM) and backed up to the server as an opaque blob. Each message is encrypted with a shared AES-GCM key derived from ECDH — only sender and recipient can decrypt.

Architecture

Browser (React)
    │
    ├── HTTPS REST  ──►  Express API  ──►  MongoDB
    │
    └── WebSocket   ──►  WS Gateway  ──►  RabbitMQ
                                              │
                                         Async DB writes

Technical Decisions

RabbitMQ decouples message delivery from database writes — the server acknowledges sends instantly and persists asynchronously. IndexedDB stores decrypted private keys in-session to avoid re-entering the PIN on every page load.

Challenges

Designing key restoration across devices without the server ever seeing the private key. Handling WebSocket reconnection gracefully while keeping delivery/read receipt state consistent.

Technologies

ReactTypeScriptNode.jsExpressWebSocketsRabbitMQMongoDBWeb Crypto APIGoogle OAuth

All projects