Direct messages and groups whose content nobody knows but you.
Direct messages and groups in Plazer are end-to-end encrypted with MLS, the standard described in RFC 9420. Keys are created on your devices, so neither we nor any server can read the conversation. On top of that come voice and video calls, groups with roles and an account without a phone number.
Keys are made on your devices, and the server only passes encrypted blocks along.
MLS is an open standard for encrypting group conversations. It works the same for two people and for a large group, and every change in who is in the group ends with a new key.
Every device has its own keys
Your phone, computer and browser each have separate keys that never leave the device. You add a new device by scanning a QR code on the old one.
The group agrees on a shared secret
The participants' devices settle on a shared group key. The server relays the exchange but never learns the key itself.
A message is encrypted before it leaves
Text, reactions, edits and polls, and even the group's name and avatar, are encrypted on your device and padded to one of a few fixed sizes.
A new member means a new key
When someone joins or leaves, the group moves to a new key. A newcomer cannot read older messages and a removed person cannot read new ones.
Under the hood
- Protocol
- MLS, the RFC 9420 standard, in every direct message and group
- Cipher suite
- MLS_128_DHKEMX25519_AES128GCM_SHA256_Ed25519
- Core
- plazer-core in Rust, built on the mls-rs library, running as WebAssembly in the browser
- Files and voice notes
- AES-256-GCM with a separate random key for every file
- Voice and video
- DTLS-SRTP directly between participants, with a fingerprint signed by the device key
A newcomer sees the conversation from the moment they join, and a removed person loses access at once.
Past keys stay with the people who were in the group at the time, so history does not pass to newcomers automatically. In the same way, a person removed from the group gets no keys for anything written later.
- History on a new device
- You bring your conversations to a new device when you pair it with a QR code, and the backup, if you turn it on, is encrypted with your account key.
- Even the group name is secret
- A private group's name and avatar are encrypted together with the messages, so the server does not even know what your group is called.
- Disappearing messages
- In any conversation or group you can set a time after which messages disappear for every participant.
Groups with a name, an icon, a link and roles, not just a list of people.
A private group has a name, an icon and an invite link. The owner hands out the admin role, admins add and remove people, and anyone can leave whenever they like.
- Owner and admins
- The owner gives the admin role to chosen people, and admins manage who is in the group.
- Adding and removing
- Every change in membership moves the group to a new key straight away.
- Name, icon and link
- You recognise the group on your list by its name and icon, and invite new people with a link.
- Person menu
- Next to every member: a mention, a note only you can see, ignoring and assigning roles, all in one menu.
Call one person or the whole group, with video and your screen.
Voice and video calls work in direct messages and in groups. A call rings on all your devices at once, and you pick up wherever suits you.
- No server in the middle
- Video and audio travel DTLS-SRTP encrypted straight between devices. Each side signs its fingerprint with its device key, so a server cannot step into the call.
- Hidden IP address
- A relay hides your IP address from the other participants.
- Screen with sound
- Share your screen together with its audio, and your camera with a blurred background.
- Clean audio
- Noise suppression, push-to-talk and a separate volume for each person.
You decide who can write to you.
Add friends by name or with a QR code. A message from someone who is not your friend lands in requests first, where you decide whether to read it, and the spam and word filter sorts out the rest on the way.
- AcceptThe conversation joins your list.
- IgnoreThe request disappears and the person gets no access to you.
- BlockThey cannot write, call or trigger a notification.
Who can write and invite
Set separately who can write to you and who can invite you to groups and servers.
No phone number needed
A name and a password are enough to sign up, so nobody finds you through a number saved in their contacts.
Friends by QR code
Meet in person, scan the code from the other person's phone and you are friends.
A note only you see
Keep a note next to any person that nobody but you can read.
When someone's key changes, you see it in the conversation.
Every person has a security key. It usually changes when someone starts using a new device, but it is also the moment to make sure the same person is still on the other side.
- Sign out everywhereSign a lost phone out remotely; a signed-out device only comes back with your password.
- Device listSee every device on your account and remove a single one without signing out the rest.
- Two-step sign-inProtect sign-in with a code from an authenticator app or a passkey.
Places for chosen people only, even on your own phone.
Some conversations should stay out of sight of anyone who borrows your phone for a moment. Others need a place of their own for two people or for one circle of friends.
Hidden chats behind a PIN
Chosen conversations disappear from the list and open only after a separate PIN. Without it, the list looks as if those conversations were never there.
Circles of friends
Group your friends your own way, and they do not know which circle they are in. A shared circle only exists if everyone agrees.
Space for two
A shared place just for the two of you, created with both people's consent.
Shared albums
Trip photos in one place, with people tagged.
The server knows who to deliver a message to, but not what it says.
We say plainly what encryption does not hide. The account server that carries direct messages and groups has to know the recipient. The content, and a private group's name and avatar, are a sealed envelope to it.
On the envelope, visible to the account server
- Who writes to whom
- When, and how many bytes
- Who is in a group
- Presence, "typing..." and read status
Inside, encrypted
- Message content
- Replies, reactions and mentions
- Edits and deletions
- Polls
- Files and voice notes
- A private group's name and avatar
Notifications without content
The screen shows only "New message", and the content appears once you open the app. The service that delivers the notification knows its time and fixed size, but not which conversation it is about.
Questions about direct messages and groups
What people ask us most often when they bring their friends and family over to Plazer.
No. You create an account with a name and a password and save a recovery key when you sign up. Add friends by name or with a QR code.
MLS, Messaging Layer Security, is an open standard for encrypting group conversations, described in RFC 9420. It works just as well for two people as for a large group, and every change in group membership ends with a new key.
No. Someone added to a group sees the conversation from the moment they join. Earlier messages stay with those who took part in them.
Remove it from the device list on another device or sign out everywhere at once. A signed-out device only comes back with your password and receives no new messages until then.
Yes. Video and audio go directly between participants, encrypted with DTLS-SRTP. Each side signs its fingerprint with its device key, so a server cannot step into the connection.
That the other person has a new security key. Most often it is a new device or a reinstalled app. If you did not expect it, ask them through another channel before sending anything sensitive.
Yes. Hidden chats disappear from the list and open only after a separate PIN.
Only if you allow it. Messages from people who are not your friends go to requests, and in the settings you choose who can write to you at all.
See what else is in your conversations
A one-to-one chat and a group are only the start. See what messages can do, how servers work and exactly how we encrypt.
Get Plazer
Android, iPhone, iPad, computers and the browser tab. One account on all your devices, with no phone number or email address.
Get Plazer