ut.Let's talk
All projects
Security & operations / Educational security project

CipherRelay.

Private content. Visible engineering.

Explore the repository
WHAT IT DOES

Educational encrypted chat and file sharing, packaged with reproducible deployment and operational tooling.

WORK IN THIS REPOSITORY

Client-side encryption, identity trust boundaries, and operational tooling.

THE INTERESTING DECISION

AES-256-GCM protects message and file content. Conversation keys are derived using P-256 ECDH and HKDF-SHA-256; private identity keys are non-exportable CryptoKey objects in IndexedDB.

START WITH THE EVIDENCEAES-256-GCM

Browser-side messages and files.

Inspect the source ↗
BUILT WITH
ReactWeb CryptoSocket.IODocker
PROJECT TYPE

Educational security project

START HEREREADME & setup
01 / THE IDEA

Private content. Visible engineering.

The problem

An encrypted messenger needs both a content-security boundary and an understandable operational setup. Deployment, recovery, and identity trust all affect what the system can actually promise.

The approach

Messages and files are encrypted in the browser. The application combines authenticated WebSockets with a single-host Docker deployment, Caddy HTTPS routing, metrics, logs, and backup/restore tooling.

02 / THE SYSTEM AT A GLANCE

Follow the flow.

  1. 01Sender browser
  2. 02Encrypted content
  3. 03Relay server
  4. 04Recipient browser

A simplified architecture overview. The repository documents the implementation details.

03 / THE ENGINEERING DECISIONS

Why it's built this way.

01

Encrypt in the browser

AES-256-GCM protects message and file content. Conversation keys are derived using P-256 ECDH and HKDF-SHA-256; private identity keys are non-exportable CryptoKey objects in IndexedDB.

02

Pin peer identity

Trust-on-first-use fingerprints block later identity-key changes. This protects subsequent contacts but leaves the first-contact key substitution limitation explicit.

03

Include operations

The repository includes health/readiness endpoints, private Prometheus metrics, Grafana provisioning, immutable-tag rollback commands, and backup/restore verification.

04 / WHAT TO LOOK AT

Evidence over adjectives.

Content encryptionAES-256-GCM

Browser-side messages and files.

DeploymentReproducible

Docker Compose and Caddy routing.

ObservabilityBuilt in

Metrics, logs, alerts, and Grafana configuration.

Capabilities and result snapshots follow the project's current README, reviewed October 10, 2026. Read the source

Security boundaryOperations runbookValidation record
05 / THE HONEST PART

What I'd improve next.

Current boundaries

  • Static identity ECDH means the protocol has no forward secrecy.
  • The server can see metadata including participants, timestamps, file names, and sizes.
  • There is no multi-device key transfer or recovery; clearing browser storage makes existing ciphertext unreadable there.
  • This is an educational design, not an independently audited production messenger.

The next iteration

Explore a reviewed protocol with forward secrecy and a deliberate device/key-recovery design.

Open my Cloud & DevOps CV
KEEP EXPLORING

Across the browsers

Same journey. Different engines.