Your device encrypts direct messages, groups and private channels before it sends anything. You sign up with a name and a password, notifications never reveal what was said, and we will publish the code so anyone can check that Plazer works the way we describe it here.
Plazer encrypts conversations with MLS, the protocol the IETF published as standard RFC 9420. The same mechanism works in a one-to-one chat, in a group of friends and in a private channel on a server.
A new key from this device up the tree
Every device in a conversation has its own key, and the keys join into a tree with the group's shared secret at the top. When one device refreshes its key, only its path to the top changes, so even a large group moves to a new key in a few steps.
When someone joins, leaves or is removed, the group moves to a new epoch with a new key. Someone new cannot read the history from before they joined, and someone removed cannot read anything you write afterwards.
Keys stay on the devices they were created on. Pairing a new device and exporting your data are both encrypted.
When the security key of someone you talk to changes, Plazer shows a warning in the conversation.
Encryption covers everything about the content of a conversation, not just the text itself. Here it is exactly, item by item.
The server carries the conversation but knows neither a word of it nor who reacted to what.
Even the name of your group stays between you.
The file key travels inside the encrypted message. Files are padded with Padme by at most 12%, so the server only knows their size roughly.
Network traffic cannot tell a short "ok" from a long paragraph.
The server carries the call but cannot hear it or put itself in the middle.
A public channel is readable by its server, but the server cannot forge anyone's message.
No server gets the content of private conversations, but each one has to know something to deliver a message at all. Here is exactly what each of them knows.
Accounts, direct messages and groups
Channels, roles and voice calls
The service that wakes up your phone
If the central server goes down, community servers keep running, so their channels and voice calls carry on.
Two mechanisms that mean you do not have to take the server owner, or the server itself, at their word.
The server owner and anyone with the Administrator role can open a private channel, because that is what an administrator is. Every such entry stays in the channel history as an event everyone can see, just like a new message. Conversations nobody but you should see belong in direct messages or a group.
We are moving the meeting to Saturday
The meeting is cancelledAnyone who joins a public channel can read it, so its text is readable by the server. Every message, though, is signed by the author's device. The server can hide a message, but it cannot change a word of it or write anything in your name, because it does not have your key.
A name and a password are all it takes to create an account. You never give a phone number or an email address, so nobody can link your account to a SIM card, a mailbox or the contacts on your phone.
3 to 32 characters: letters, digits and underscores. Friends find you by that name, or you add each other with a QR code.
The password protects your account and unlocks it on a new device. You can add a code from an authenticator app or a passkey on top.
You get the key once, when you sign up. Together with your password it brings your account back when you change or lose your devices.
Some of the work other messengers hand to a server, Plazer does on your device. The server then gets nothing it could read.
The message index lives on your device, so the server does not know what you search for, when or how often. Filters by author, channel, attachments and date work offline too.
The sender's device prepares the page preview and sends it encrypted, in encrypted chats too. The server never sees the address, and the recipient's app does not contact the page until someone clicks the link.
Translating messages and turning voice notes into text happen on your device, without sending the content anywhere.
A notification only says "New message", and the content appears once you open the app. The service that wakes your phone only knows the time and the fixed size of the notification.
You decide what stays, for how long, and who can even tell that a conversation exists.
By default your history is not copied anywhere. You turn the backup on with a switch, and before it leaves your device it is encrypted with your account key. The server stores a block it cannot open, and you restore your history from it on a new device.
In a chat, a group and on a server you set how long messages stay before they disappear. A conversation that does not need to last forever simply does not.
Conversations you do not want on your list go behind a separate PIN. They stay invisible until you enter it, even when someone browses your unlocked phone.
Files meant to stay with you go into a private vault. Large files travel with no size limit straight from your device to the recipient's, once they accept.
Your password is the first layer. You can protect sign-in with a code from an app or a passkey, and the device list shows where you are signed in.
We do not want you to take our word for it. We will publish the code of the server, the apps, the encryption core and the protocol, so anyone can check how we encrypt and what reaches the server.
The central server, the community server and the encryption core are licensed under AGPL-3.0. Modified versions of them will have to stay open too, even when someone offers them to others over a network, so nobody can lock them behind a paywall.
We will give the open source licence for the app and the protocol specification at publication, together with the code.
Short answers to what people ask most before they trust a new messenger.
No. Direct messages, groups and private channels are encrypted on your device, and only the people in the conversation have the keys. The server sees who talks to whom and when, but not what was said.
No. You sign up with a name and a password and save a recovery key when you register. You add friends by name or with a QR code.
You get your account back with your password and recovery key. You restore your history from the backup encrypted with your account key, if you turned it on. Without a backup the history stays with the people you talked to, because we have no access to it.
An administrator can open a private channel, but everyone sees that entry in the channel history. Conversations nobody but the participants should see belong in direct messages or a group.
A public channel is open to anyone who joins it, so its text is not end-to-end encrypted. Every message is signed by the author's device, though, so the server can hide it but cannot forge it. Voice calls are encrypted in every channel.
No, both are equally secure. It is the same code from app.plazer.org, which loads the latest version every time it starts, so either way you trust that you get the same code as everyone else. We build the encryption core from a pinned version of its code in a reproducible way, and every release records its checksum and the central server key it pins. Private keys stay in the browser's storage and, where the browser supports it, cannot be exported from it.
Not yet. The encryption rests on the MLS standard and the mls-rs library, whose authors have validated it against RFC 9420 but state plainly that it has not yet had a full third-party security audit. We plan a cryptography audit of Plazer before version 1.0, and you can report a vulnerability today.
Community servers keep running, so their channels and voice calls carry on. Direct messages and groups wait until the central server is back, because it is the one that delivers them.
A ZIP archive with a README.txt that describes every part. account.json is the data from the central server: your profile, privacy settings, friends and friend requests, blocks, servers with your roles, notes about others, favourite GIFs, sessions and devices, message requests, the messages you wrote on servers hosted by the central server and the list of files you uploaded. encrypted-conversations.json is made only in your browser and only if you include it: the encrypted conversations that browser received, decrypted there into plain text. It does not hold other people's messages outside your conversations, data from servers on their own hosts, the files themselves, your password or your keys. You can ask for an export up to 5 times a day, and the file from the central server waits 7 days to be downloaded.
Encryption runs through every part of Plazer. See how it looks in chats and on your own server, and how Plazer compares with other messengers.
Download Plazer
Install it from app.plazer.org on your phone, tablet and computer, or open it in a browser tab. The encryption works the same everywhere.
Download Plazer
