Ghostly

The challenge

Make private conversations effortless: no sign-up, nothing left behind, and a server that never sees what people say, while still feeling instant and friendly on a phone.

What I worked on

• 01

  End-to-end encryption with AES-256-GCM in the browser

• 02

  Real-time chat, typing and presence over WebSockets

• 03

  Self-destructing rooms with Durable Object alarms and a scheduled backstop

• 04

  Installable PWA with link and QR code invites

• 05

  Light and dark mode, mobile-first interface

Implementation

Messages and photos are encrypted in the browser with AES-256-GCM. The key lives in the part of the link after #, which browsers never send to a server, so the backend only ever stores ciphertext. Each live room is a Cloudflare Durable Object with hibernating WebSockets for messages, typing indicators and presence, plus a self-destruct alarm. D1 holds the encrypted data and a scheduled sweep backs up the alarms. The front end is a mobile-first React, Vite and Tailwind PWA.