How the encryption actually works

Every MURMURLINE chat is end-to-end encrypted using standard, browser-native cryptography (the Web Crypto API) — no custom crypto, no server-held keys. Here's exactly what happens, in order.

1. When you press "Start listening," your browser generates a fresh ECDH P-256 key pair — a public key and a private key that never leaves your device.
2. When you're matched, both browsers send only their public key to the relay server, which forwards each to the other person.
3. Each browser combines its own private key with the peer's public key to independently derive the same shared AES-256-GCM secret — a textbook Elliptic-Curve Diffie-Hellman exchange. The shared secret is never transmitted; both sides compute it separately.
4. Every message you type is encrypted with that shared key before it leaves your browser, sent as ciphertext, and decrypted only inside your partner's browser.
5. The relay server's job is to pass bytes between two WebSocket connections. It never has the private keys and never derives the shared secret, so it has no way to decrypt what it's relaying — it sees ciphertext, full stop.
6. When the chat ends (hang up, skip, or close the tab), the key is discarded. A new chat gets an entirely new key pair — keys are never reused across matches.

Why this matters in practice

"End-to-end encrypted" gets used loosely by a lot of apps that actually hold a copy of your key, or decrypt on their servers for "safety scanning." MURMURLINE's server genuinely cannot read your conversation, because it never has the information needed to: no private key, no shared secret, no plaintext. This is also why we can't offer server-side content moderation that reads messages — see how reporting and moderation work instead, entirely without reading text.

What encryption does not protect against

• Your partner screenshotting or retelling what you say — encryption protects the wire, not the other person's honesty.
• Anything you choose to type. If you tell someone your real name, phone number, or location, that's still visible to them regardless of encryption.
• Malware or a compromised device reading your screen before encryption happens.

Kept chats

If you and your partner both choose "Keep chat," the conversation is saved end-to-end encrypted in your browser's local storage on each of your own devices — still never on our server, still with a key our server doesn't hold. Details in the Privacy Policy and FAQ.