Security

End-to-end encryption

Messages are encrypted on the sender's device and can only be decrypted by the intended recipient. The server never sees the plain text, which means even a complete infrastructure breach cannot expose conversations.

SecureMessenger uses the Extended Triple Diffie-Hellman (X3DH) handshake combined with a double-ratchet algorithm. Each message is encrypted with a fresh key, so a single compromised key cannot unlock past or future messages.

Secure voice and video

Calls are established over WebRTC with encrypted signaling via WebSocket. Media streams use DTLS-SRTP, ensuring that audio and video packets cannot be intercepted or replayed by anyone in the middle.

Authentication and access control

• Passwords are hashed with bcrypt before storage.
• All API access requires a signed JWT token with a strict expiry.
• Rate limiting prevents brute-force and enumeration attacks.
• Helmet.js enforces modern security headers on every response.

Input validation and injection defence

Every endpoint validates request shape and sanitises user input with express-validator and Mongoose, protecting against NoSQL injection and malformed payloads.

Device and key management

Each device generates its own identity key pair. Public keys are exchanged through the server, but private keys never leave the device. Users can review and revoke linked devices at any time.

Independently audited

SecureMessenger has undergone a full security audit covering authentication, real-time authorization, encryption key handling, and infrastructure configuration. Findings are tracked by severity, remediated, and re-verified — and the audit is revisited as the product evolves, rather than treated as a one-time checkbox.