VANISH PRIVATE CHAT GUIDE
One secret link opens the encrypted room
The invite lets a recipient decrypt a room without sending the encryption secret to the backend.
How the invite works
A random room identifier and 256-bit secret are encoded in the invite. The secret sits in the URL fragment, which browsers do not include in ordinary web requests.
Encryption on the device
Messages are encrypted with AES-256-GCM before upload. The server stores ciphertext rather than readable message bodies.
A simplified example
A link can look like https://vanishchat.xyz/#v=6&r=ROOM_ID&k=SECRET&e=EXPIRY. Everything after the hash sign is a URL fragment. Browsers normally keep that fragment out of HTTP requests, so Vanish can use the secret locally.
Authenticated browser encryption
Each message uses AES-256-GCM with a fresh random nonce. Additional authenticated data binds ciphertext to the protocol version, room, expiry, and message identifier, so altered payloads fail authentication.
Limits of a secret link
Possession of the complete link grants room access until expiry. It cannot verify identity, stop copying, protect a compromised device, or provide forward secrecy.
Questions and answers
Does the server receive the fragment secret?
The fragment is normally omitted from HTTP requests and used locally by the browser.
Should I post an invite publicly?
No. Treat the complete invitation like a temporary password.