End-to-end encrypted chats and calls
Chat messages, files and calls are end-to-end encrypted. Each phone and browser has its own key (X25519); messages are locked with XChaCha20-Poly1305. The server stores only scrambled data.
Security
Private by design. Clear about the details.
Chat messages, files and calls are end-to-end encrypted on iOS, Android and the web. Here is what is protected, how, and what is not end-to-end encrypted.
End-to-end encryption
Not even Next4Chat can read your chats.
Messages are locked on the sender's phone and unlocked only on the phones and browsers of the people in the chat. To check, compare the 60-digit security code with the other person.
What is in place
Encryption and data protection
Keys stay on your device
Private keys never leave the device (iOS Keychain, Android Keystore, browser storage). Signing a device out removes its key at once.
Encrypted Drive backups
Google Drive backups are encrypted with your own password (scrypt and XChaCha20-Poly1305) and stored in Next4Chat's private Drive folder.
Sealed scheduled messages New
Scheduled messages are sealed on your device when you schedule them; the server stores only ciphertext.
Private notifications
Notifications for encrypted messages show "🔒 New message", never the text.
Encrypted personal details
Date of birth and My Khata email, address and notes are encrypted on the server (AES-256).
Daily encrypted server backup New
The database is encrypted on the server (XChaCha20-Poly1305) before it goes to a separate private bucket, checked with SHA-256, kept 30 days, with a tested restore command.
HTTPS only
HTTPS only, with strict transport security and browser hardening headers on every response.
New sign-in alerts New
Your other phones and browsers are told at once when a new device signs in.
Account, device and app protection
Sign-in codes
Sign-in codes are stored only as a hash. They expire, and a code is blocked after too many wrong tries.
Registration PIN
The optional registration PIN is stored hashed and stops someone else from registering your number.
Signed-in devices
Every signed-in device is listed and can be signed out remotely.
Locked chats
Locked chats open with Face ID, fingerprint or the device passcode.
Screenshot blocking
An optional setting blocks screenshots in chats.
Expiring file links
Photos and files are served through links that expire, not public links.
Virus scanning
Uploads can be virus-scanned. This is a server setting.
Privacy controls
Choose who sees your last seen, profile photo, about, phone number and status, plus read receipts and who can add you to groups.
Blocking and moderation
Blocking, reporting, and moderation by admins.
Admin roles and audit logs
Admin roles have separate permissions, and admin actions and Khata changes are recorded in audit logs.
Status privacy
Only the owner sees who viewed or liked a status. A viewer sees only their own comments.
Disappearing messages
Disappearing messages are deleted after the time you choose.
QR web sign-in
Your phone has to say yes.
- Each code lasts 2 minutes and works only once.
- Its secret is stored as a hash.
- Its sign-in token is encrypted until the browser collects it.
- The phone has to approve the sign-in.
- Next4Chat Web gets your chat keys from the phone, so old chats open there too.
Rate limits
Limits that slow down abuse
| What | Limit |
|---|---|
| Code requests | 5 a minute per IP address, and 3 a minute per phone number or email |
| Messages | 120 a minute |
| Contacts sync | 6 an hour |
| Everything else | 300 a minute |
What is not end-to-end encrypted
- Statuses, profile photos, reactions and polls are not end-to-end encrypted. They are protected with HTTPS on the way to the server.
- The server still sees who talks to whom, when, and the type and size of each message, because it needs these to deliver them.
- A web session signed in with a code instead of the QR scan cannot read older chats until you restore the Drive backup or link it by QR.
Found a security problem? Please tell us through the contact page.