Encrypted web socket chat
Branch: master
Clone or download
Latest commit c4b96e5 Jan 29, 2018
Type Name Latest commit message Commit time
Failed to load latest commit information.
.gitignore Darkwire v2.0.0 Release (#57) Dec 9, 2017
LICENSE Licenses Jan 19, 2016
docker-compose.yml Referencing local redis Dec 9, 2017
readme.md Updated description Jan 29, 2018
setup-dev.sh Darkwire v2.0.0 Release (#57) Dec 9, 2017



GitHub release

Simple encrypted web chat. Powered by socket.io, the web cryptography API. This project is an example of how client side encryption works and how you can integrate it as a chat service.

Hosted Service (Darkwire.io)

As of January 11, 2018, Darkwire.io is no longer provided as a hosted service. You may set up your own version of Darkwire by using the server and client code located in the repository below.

Darkwire Server

Darkwire server is a Node.js application that requires redis.


Darkwire Web Client

The Darkwire.io web client is written in JavaScript with React JS and Redux.


Running Darkwire Locally

To quickly get up and running, we recommend using Docker and Docker Compose.

$ docker-compose pull && docker-compose up

Darkwire client will be binded to port 80 while the server is on port 3000. Go to http://localhost. This will also start a redis instance running on port 6379.

If running in a public environment, be sure the modify ENV_VARS via docker-compose.yml.

    - API_HOST=dwserver
    - API_PROTOCOL=http
    - API_PORT=3000

Contributing to Darkwire

Run setup-dev.sh to automatically clone server/client files and install dependencies, or clone the client and server repositories.

  1. Create a Pull Request for the respective service with detailed changes
  2. Wait for review and/or merges


Please report any security issues to hello@darkwire.io.

Legacy Darkwire

If you are trying to access the legacy stable version of darkwire, you can use the oldest tag before v2.0.0 which is v1.6.0 or checkout the legacy branch.

How it works

Darkwire uses a combination of asymmetric encryption (RSA-OAEP), symmetric session keys (AES-CBC) and signing keys (HMAC) for security.

Here's an overview of a chat between Alice and Bob (also applies to group chats):

  1. Bob creates a room and immediately creates a public/private key pair (RSA-OAEP).
  2. Alice joins the room and also creates a public/private key pair. She is sent Bob's public key and she sends Bob her public key.
  3. When Bob goes to send a message, three things are created: a session key (AES-CBC), a signing key (HMAC SHA-256) and an initialization vector (used in the encryption process).
  4. Bob's message is encrypted with the session key and initialization vector, and a signature is created using the signing key.
  5. The session key and signing key are encrypted with each recipient's public key (in this case only Alice, but in a group chat multiple).
  6. The encrypted message, initialization vector, signature, encrypted session key and encrypted signing key are sent to all recipients (in this case just Alice) as a package.
  7. Alice receives the package and decrypts the session key and signing key using her private key. She decrypts the message with the decrypted session key and vector, and verifies the signature with the decrypted signing key.

Group chats work the same way because in step 5 we encrypt keys with everyone's public key. When a message is sent out, it includes encrypted keys for everyone in the room, and the recipients then pick out the ones for them based on their user ID.

Man-in-the-middle attacks

Darkwire does not provide any guarantee that the person you're communicating with is who you think they are. Authentication functionality may be incorporated in future versions.

File Transfer

Darkwire encodes documents (up to 1MB) into base64 using btoa and is encrypted the same way chat messages are.

  1. When a file is "uploaded", the document is encoded on the client and the server recieves the encrypted base64 string.
  2. The server sends the encrypted base64 string to clients in the same chat room.
  3. Clients recieving the encrypted base64 string then decrypts and decodes the base64 string using atob.

Sockets & Server

Darkwire uses socket.io to transmit encrypted information using secure WebSockets (WSS).

Rooms are stored in memory on the server until all participants have left, at which point the room is destroyed. Only public keys are stored in server memory for the duration of the room's life.

Chat history is stored in each participant's browser, so it is effectively erased (for that user) when their window is closed.