Securmy🔑
Username and password login
Username comes first, then the password: same username, different password, different profile. No selection screen.
Functional prototype
A chat where your password picks your profile
No phone number. Enter your username and password: the password decides which profile opens. Hidden chats, a cover profile, self-destructing messages.
What you can do
🪪
Multiple profiles
Several profiles on the same device, each with independent contacts, chats and settings.
🙈
Hidden chats
Hide a conversation from the main list. It only reappears by typing a secret combination into search.
🎭
Cover profile
Create an innocuous profile to show in case of a check, with no hint that other profiles exist.
💣
Timed messages
Send messages that self-destruct after 30 seconds, 5 minutes or an hour.
📵
No phone number
Sign up with email and username: your email is never visible to other users.
🔐
Real end-to-end encryption
Every message is encrypted in the browser with ECDH (P-256) + 256-bit AES-GCM before it leaves: the server only ever sees ciphertext, never the plaintext.
Biometric unlock
Face ID, Touch ID, Android fingerprint or Windows Hello via real WebAuthn/FIDO2: no biometric data ever leaves your device.
🌍
11 languages
App and website available in Italian, English, Spanish, French, German, Portuguese, Arabic, Chinese, Hindi, Russian and Japanese.
More than a chat: your digital vault
Securmy goes beyond messaging. Everything you save or share is encrypted on your device, using the same vault that protects your chats.
🗄️
File vault
Hide and protect documents, photos and files: encrypted on your device with AES-256 and opened only by your password or biometrics.
🔗
P2P transfer by link
The file goes straight from one device to the other, encrypted, never stored on the server. One-time link with an expiry.
🧼
Metadata cleaning
Removes GPS location, camera model and other hidden data from photos before you share them.
🔑
Password manager
Store credentials in the vault, generate strong passwords and copy them: the clipboard is cleared after 20 seconds.
📝
Encrypted notes
Private notes encrypted on your device, never sent to any server.
👁️
View-once messages
The recipient opens them once: after a few seconds they are deleted from the server and from their device.
📞
Encrypted voice and video calls
Directly between the two devices (DTLS-SRTP), with a verification code to compare out loud against eavesdropping.
🔢
Two-step verification
TOTP codes with any authenticator app: even someone who discovers your password cannot get in.
💾
Encrypted backup
Export files, notes and passwords into a single archive encrypted with a passphrase only you know.
🚨
Security check and emergency wipe
A score tells you what to improve; in danger, one tap erases keys, files and passwords from the device.
☁️
Encrypted sync (paid)
Sync your vault across your devices with storage packs (5, 25 or 100 GB per month). The server only keeps data that is already encrypted: the key stays on your devices. Without a plan, everything stays local.
🛰️
IP protection with a relay
With an encrypted relay (TURN) you can hide your IP address during calls and P2P transfers, and make them work even on very restrictive networks.
Security and privacy: the heart of the app
We don't just say "it's encrypted". Here is, concretely, what protects your conversations.
🔄
A new key for every message
Each message has a one-time key (forward secrecy), deleted after reading. If someone ever got hold of your keys, they still couldn't decrypt past messages.
🗝️
Vault encrypted with your password
Private keys and read messages are encrypted on the device (PBKDF2 + AES-GCM) with your password: without it they stay unreadable.
🔍
Key verification and anti-interception alert
Compare the safety number with your contact by voice. If their key changes, the app warns you and blocks sending until you confirm.
🙈
A blind server
The server stores only ciphertext. Email and username are encrypted at rest in the database; passwords are kept only as a hash (scrypt).
🛡️
Defence against login attacks
Attempts limited per IP address and per username, revocable sessions, other sessions closed when you change your password.
Biometrics that never leave your device
With WebAuthn/FIDO2 the server only receives the passkey's public key: biometric data never leaves your phone or computer.
How it works
Sign up
Email, username and password: you get a public ID and a secret combination. Save them: they are not shown again.
Log in with username and password
Every time you open the app, enter your username and password: the matching profile opens automatically.
Add contacts
Search for someone by their public ID and start chatting in real time.
Hide what you want
Type the secret combination into the search bar to reveal hidden chats when you need them.
Coming soon
What we are planning. It is not available yet and should not be taken as a promised date.
🧅
Tor network
The service can be exposed as a .onion address: the setup files are ready (self-hosting) and are enabled on request. Tor Browser disables WebRTC, so P2P transfers and calls do not work over Tor; messages, vault and sync do.
📱
iOS and Android apps
Native apps with biometric unlock, published in the stores with the same security and privacy guarantees as the website.
What it is, what it isn't
This is a working prototype, not a finished product, but the security is real: every message has a new key deleted after reading (forward secrecy), private keys sit in a vault encrypted with your password, you can verify your contact's identity with a safety number and you get a warning if their key changes. Biometric unlock uses real WebAuthn/FIDO2. Known limits remain, explained plainly in the user manual (metadata visible to the server, history tied to the device, email-only recovery). It is not yet meant for extremely high-risk conversations.
Native iOS and Android apps
The native app (React Native/Expo) for iOS and Android is built and in testing: chat, vault, P2P sending, calls, two-step verification, biometric lock and content-free push notifications, with the same end-to-end encryption as the webapp. Publication on the App Store and Google Play is coming; meanwhile the webapp works in any browser and can be added to the Home Screen.
Test version: if Android asks, allow installing from this source. iPhone: coming soon on the App Store.
Try the prototype
All you need is an email and a username to create your first profile.
Open the app →