Session locked — all keys wiped from memory

🛡 Nulkratos-Core

Nulkratos-Core

AES-256-GCM · Argon2id · HKDF Ratchet · Zero-Knowledge

⬡ End-to-End Encrypted · PIN-Derived Key

Secure Private Encrypted Messenger — No Account Required

Nulkratos-Core is a free, browser-based, zero-knowledge encrypted messaging app. Send private messages with AES-256-GCM encryption and Argon2id key derivation. No account, no phone number, no email needed. Start a secure anonymous chat channel instantly. Your PIN never leaves your device. All cryptography runs client-side in your browser. Compatible with Tor Browser and VPN for maximum anonymity. No metadata, no identity, no plaintext ever stored on any server.

  • End-to-end encrypted chat without registration
  • Anonymous messaging app — zero identity required
  • Private browser chat with AES-256 encryption
  • Secure PIN-based messaging, no phone number
  • Zero-knowledge architecture — server sees only ciphertext
  • Works with Tor Browser for maximum privacy
  • VPN compatible private chat application
  • No data collection, no tracking, no analytics
  • HKDF forward-secret message ratchet
  • Chaff traffic injection to defeat metadata analysis
establishing secure channel…
📡
Reconnecting…
Attempt 1 · next retry in 2s
Open Zero-Knowledge Secure Channel
🔐 Deriving key (Argon2id)…
or
Security Architecture
🔑
Argon2id Key Derivation (64MB RAM)
Memory-hard KDF from PIN + channel ID. Shared by both users — same PIN = same key.
64MB/attempt
🔒
AES-256-GCM Encryption
Each message encrypted with authenticated AEAD. Tampering is detected and rejected.
256-bit
⚙️
Forward-Secret Message Ratchet
Each message derives a unique sub-key via HKDF. Compromising one key never exposes others.
Per-msg key
👻
Chaff Injection + Timestamp Blinding
Random dummy messages + bucketed timestamps. Traffic analysis reveals nothing.
Anti-analysis
Argon2
KDF
256
AES-GCM bits
64MB
Argon2 RAM
0
Plaintext stored
🗄️What the database seesZero Plaintext
channel_idSHA-256 blind hash of your ID — original never stored
message.cAES-256-GCM ciphertext (random bytes) ▪ unreadable
message.iRandom 96-bit IV — different every message
sender.sc/siEncrypted sender name — server cannot identify who
_btBucketed timestamp ± 5min — exact time hidden
_chaffDummy entries mixed in — server can't tell real from fake
_x / _y / _zRandom decoy fields — obscures message structure
pinArgon2 / pinFPArgon2id hash of PIN — original PIN never stored
names / contentNever stored in plaintext — ever
The server is a blind relay. Without the PIN — which never leaves your device — all data is indistinguishable from random noise.
💻 Device Requirements Minimum Spec
BrowserChrome 90+, Firefox 88+, Safari 15+, Edge 90+Required
WebCrypto APIMust be available — all modern browsers support itRequired
RAM256 MB free minimum — Argon2id uses 64 MB per loginImportant
CPUAny modern processor — key derivation takes 1–4 secondsAny
JavaScriptMust be enabled — the entire app runs client-sideRequired
ConnectionInternet required for message sync onlyAny speed
StorageLocalStorage for device ID only — no messages storedMinimal
ProtocolHTTPS strongly recommended — HTTP works but is unsafeHTTPS
Argon2id is intentionally memory-hard. On very low-end devices (<1 GHz or <256 MB RAM) the login step may take longer — this is by design to resist brute-force attacks.
🛡️ Boost Your Privacy: VPN & Tor Maximum Anonymity
Step 1Enable a trusted VPN — Connect through a no-log VPN before opening this app. Your ISP and network observer will see only encrypted traffic to the VPN server, not to this site.VPN
Step 2Use Tor Browser — Open this app in Tor Browser for full IP anonymisation. Your real IP address becomes completely unknown to Firebase, Cloudflare, or any observer. JavaScript must remain enabled for the app to function.Tor
Step 3Stack VPN over Tor — For the highest level of anonymity, connect your VPN first, then use Tor Browser. This hides your Tor usage from your ISP and hides your VPN from the exit node.Both
Step 4Share channel ID out-of-band — Never send the channel ID or PIN over the same channel you are trying to protect. Use a face-to-face meeting, an offline note, or a phone call.Critical
Step 5Verify Page Integrity — After loading the app, both parties should open the ⋯ menu → Page Integrity and compare the SHA-256 hash of the page. A match confirms neither side is running a tampered version.Verify
Step 6Use a private browsing session — Open the app in a private / incognito window to prevent browser history, cached data, or autofill from leaking information about your session.Recommended
Combined with Nulkratos-Core's AES-256-GCM encryption, Argon2id key derivation, chaff injection, and zero-knowledge architecture, following these steps makes your communication virtually untraceable at every layer — network, metadata, and content.
Frequently Asked Questions
Can Nulkratos-Core read my messages?
No. All encryption and decryption happens entirely inside your browser. Your PIN and derived encryption key never leave your device — not even as a hash we could reverse. We receive only ciphertext that is mathematically impossible to decrypt without your PIN.
What happens if I forget my PIN?
Your messages are permanently unrecoverable. The PIN is the only key that can decrypt your data — there is no password reset, no recovery code, and no backdoor. This is by design: zero-knowledge means we genuinely have no way to help. Always share your PIN through a secure out-of-band channel (phone call, in person) and remember it.
Is the connection secure if I use HTTP instead of HTTPS?
Always use HTTPS. While messages are encrypted before leaving your device, an active network attacker on a plain HTTP connection could serve you a tampered version of this page. You can also use the Page Integrity tool (in the ⋯ menu inside a chat) to verify the app hash with your contact.
How is this different from other secure messaging apps?
Nulkratos-Core is a zero-install, browser-based, PIN-derived encrypted messenger. Unlike most other security apps, it requires no phone number, no account, and no installation — just a shared channel ID and PIN agreed out-of-band. Everything runs entirely in your browser with no identity linkage whatsoever. It is purpose-built for scenarios where maximum privacy, anonymity, and zero metadata exposure matter most.
What is chaff injection and why does it matter?
Chaff injection means the app periodically sends random encrypted dummy messages alongside your real ones. Combined with bucketed timestamps (rounded to ± 5 minutes), a network observer cannot tell when you actually sent a message or how long your conversation pauses were. This protects metadata, not just content.
Security Stack
Argon2id 64MB key derivation Message Ratchet (HKDF chain) Chaff Traffic Injection Timestamp Blinding AES-256-GCM Page Integrity Verifier Non-extractable CryptoKey Zero-knowledge architecture Auto session lock
?
connecting…
connecting…
Zero-knowledge channel active. Send the first message.
📊 Live State
LIVE
chaff 0
ratchet
Send a message to see ratchet progress
Last message trace
msg_hashawaiting…
ratchet_idxawaiting…
padawaiting…
ts_bucketawaiting…
decoysawaiting…
🔍 Page Integrity SHA-256
Computing page hash…
Hashing the full HTML/JS to detect tampering.
🔐 Preparing your message…

My Channels

Loading…

Create Secure Channel

Both users must use the same PIN — it's the shared secret that generates your encryption key. Share your PIN securely out-of-band.

🔐 Generating Argon2id key…
🗑
Delete Channel?
Permanent. Irreversible. All data cryptographically erased.
· channel-id ·
All encrypted messages and channel data permanently wiped.
❤️ 😂 😮 🔥 👍