SecurmyUser manual
A complete guide to Securmy: how to sign up, log in, use the privacy features, and understand what this prototype really protects — and what it doesn't.
1. Sign-up and first login
On the start screen, tap "Sign up" and enter your email and a username. No phone number is required.
After signing up you'll see three pieces of information only once — save them right away somewhere safe (a password manager, for instance):
- Username and password: the username is the first field, the password decides which profile opens. You can have several profiles under the same username, each with its own password.
- Public ID: this is what you share with people you want to add as contacts. It never reveals your email.
- Secret combination: used to reveal hidden chats (see the dedicated section).
If you lose your password you can reset it by email, but only if the profile's email was verified. Without the password and without a verified email the profile cannot be recovered.
2. Multiple profiles on the same device
You can create several profiles (for example a personal one and a cover one) with the same username but different passwords. When you enter your username and password the matching profile opens, with no selection screen that would reveal how many profiles exist. You cannot use the same password for two profiles under the same username.
3. Adding contacts and chatting
Tap "+ Add contact" and enter the person's public ID. A real-time chat opens, end-to-end encrypted (see section 7).
5. Cover profile
At sign-up you can check "Create as a cover profile": a profile meant to be shown if asked to, with no hint that other profiles exist on the same device.
6. Timed (self-destructing) messages
Before sending a message, you can pick a self-destruct time from the dropdown: 30 seconds, 5 minutes, or 1 hour. Once that time passes, the message is removed.
7. End-to-end encryption: how it actually works
This isn't a marketing slogan: every message is encrypted in your browser, before it's sent to the server, using this scheme:
- On first sign-in your device generates an ECDH key pair (P-256 curve): the public key goes to the server, the private key stays on the device, encrypted with your password. It also prepares a batch of one-time public keys ("prekeys").
- For every message, your browser generates a temporary key and fetches ONE one-time prekey of your contact from the server. It combines three ECDH exchanges (your identity, the temporary key, the prekey) and derives with HKDF-SHA256 a 256-bit AES-GCM key valid for that message only.
- The message is encrypted with that key and a random IV; the header is authenticated, so it can't be tampered with. The server only receives ciphertext.
- The recipient rebuilds the same key, reads the message and immediately deletes the private prekey: from then on the message can't be decrypted by anyone, not even with your long-term keys.
This is the same type of math (ECDH + AES-GCM) used by many modern secure protocols, applied here through the browser's native Web Crypto API, with no external libraries.
Forward secrecy: past messages stay safe
Even if someone obtained your long-term keys (for example by stealing your device), they couldn't decrypt messages you have already received, because their keys were deleted. Text you have already read stays only in your device's encrypted local cache.
The key vault
Private keys, prekeys and the message cache are stored in the browser only in encrypted form (AES-GCM), using a key derived from your password with PBKDF2-SHA256 (310,000 iterations). If you sign in with biometrics, you are asked for your password once to open the vault. When you change your password, the vault is re-encrypted.
Check it's really them: safety number
In a chat tap the 🔑 icon: you see a 60-digit number, identical for both of you. Compare it with your contact in person or by voice: if it matches, nobody is interfering. If a contact's key changes (new device or possible interception), a warning appears and sending stays blocked until you choose "Accept new key".
8. Biometric unlock (Face ID / Touch ID / fingerprint)
In the profile settings (⚙️ icon) you'll find "Enable Face ID / fingerprint unlock". Turning it on makes your device create a passkey via WebAuthn/FIDO2 and register it with the server (only the public key, never the biometric data itself).
From then on, the login screen shows an "Unlock with biometrics" button: use it instead of the password, and your operating system (not the app) verifies Face ID, Touch ID, Android fingerprint, or Windows Hello. Biometric data never leaves your device.
You can turn it off at any time from the same settings.
9. Changing language
In the top corner of every app screen you'll find a language selector. This website is available in the same 11 languages too: Italian, English, Spanish, French, German, Portuguese, Arabic, Chinese, Hindi, Russian and Japanese. The language you pick in the app is remembered on the device.
10. Native mobile apps (iOS/Android)
The native app (React Native/Expo) for iOS and Android is built and in testing: chat, vault, P2P sending, calls, two-step verification, biometric lock and content-free push notifications, with the same end-to-end encryption as the webapp. Publication on the App Store and Google Play is coming; meanwhile the webapp works in any browser and can be added to the Home Screen.
11. Stated security limits
For honesty, here are the limits that remain, even though the encryption is real and not just claimed:
- Prekeys running out: if a contact stays offline for long and runs out of one-time keys, the message still uses a new key but without one-time deletion, so forward secrecy is weaker.
- Messages tied to this device: by design, decrypted history doesn't move. On a new device or after an email password recovery the previous vault can't be recovered: you start with a new identity and contacts see the key-change warning.
- The vault is only as strong as the password: choose a long, unique one. Anyone with your already unlocked device and the app open can read chats, as with any app.
- Metadata visible to the server: sender, time, reactions and expiry of timed messages are not encrypted.
- Email-only recovery: if you lose both the password and access to the verified email, the profile can't be recovered. If you use several profiles (e.g. a cover one), use different emails: a recovery link reveals to whoever controls the email that the profile exists.
12. Troubleshooting
"Can't encrypt: the contact doesn't have a public key yet"
This happens if your contact hasn't logged in since the latest app update (the key is generated and uploaded automatically at login). Ask them to log in once — after that you'll be able to message them normally.
"I lost my password"
Use "Forgot password?" on the login screen and enter your email and username: if the profile's email is verified you receive a link valid for 1 hour. If the email was not verified the profile cannot be recovered and must be created again. Always keep your password in a password manager.
Biometric unlock doesn't show up
It requires a device with Face ID, Touch ID, a fingerprint sensor, or Windows Hello set up, an up-to-date browser, and an HTTPS connection (the production webapp already uses one). It also needs to have been enabled at least once from settings.
"Message no longer readable"
For safety each message's key is deleted as soon as you've read it: the text remains only in this device's encrypted cache. If you change device, clear browser data or reset your password via email, earlier messages can't be recovered. That's the price of forward secrecy.
13. Securmy vault and tools
Open the Vault from the 🛡️ button in the sidebar. Everything inside is encrypted on your device with AES-256-GCM, using a key kept in your vault and protected by your password: the server never receives files, notes or passwords.
File vault
Add files (up to 100 MB each) from the Files tab. If the box is ticked, photos are stripped of metadata before being saved. You can download, send via P2P or delete each file.
P2P transfer by link
Pick a file and an expiry time (10 minutes or 1 hour): you get a one-time link. The file travels straight to the recipient, encrypted with a key that sits only after the # in the link and never reaches the server. Keep the page open until the transfer finishes.
Clean photos
Redraws the image, discarding EXIF, GPS location and thumbnails. Works with JPEG, PNG and WebP; for other formats automatic cleaning is not available.
Notes and passwords
Notes and credentials stay encrypted in the vault. The generator creates random passwords; when you copy a password, the clipboard is cleared after 20 seconds.
View-once messages
Choose “View once” next to the message field. The recipient taps to see: the text stays visible for 10 seconds, then is destroyed on their device and on the server. It cannot stop a reader from photographing the screen.
Voice and video calls
Use the 📞 and 🎥 buttons in the chat header. Audio and video travel directly between the devices, encrypted. Both sides see a 4-digit code: compare it out loud; if it matches, the call has not been intercepted.
Two-step verification
In Security you can enable TOTP codes with an authenticator app (Google Authenticator, Aegis, 1Password…). Once enabled, signing in with your password also requires the 6-digit code. Biometric unlock remains a separate sign-in method.
Backup and emergency wipe
The backup holds files, notes and passwords encrypted with a passphrase of at least 10 characters that you choose: without it, it cannot be recovered. Messages are not included. The emergency wipe removes keys, message cache, files, notes and passwords from the device and cannot be undone.
Limits to know
- Cross-device sync is optional and paid (storage packs): data stays encrypted on your device and the server does not have the key. Without a plan the vault stays local-only; backups are still how you move it by hand.
- To hide your IP in P2P transfers and calls, turn on Security → IP protection (encrypted relay), where the service has a TURN server. Without a relay the other person can see your IP, and on very restrictive networks the connection may fail.
- The password manager is basic: it does not fill in forms by itself and does not replace a dedicated manager for professional use.
- If you lose your password and the backup passphrase, the encrypted data cannot be recovered: nobody, not even us, can open it.