whispr
generating ephemeral identity...
how it works
no accounts. no servers storing your messages. here's exactly what happens.
you open whispr
a room is created
you share the link
keys are exchanged
direct connection established
you chat
someone leaves
use cases
situations where you need to talk without creating a permanent record.
You need to send something to someone without starting a contact, a thread, or a paper trail. whispr gives you a channel that disappears when you're both done.
You want honest input from someone who might self-censor if their name is attached. Share a whispr link, let them speak freely. The conversation expires when you both leave.
Something is happening right now and you need an out-of-band channel fast. Spin up a whispr in seconds. No setup, no inbox to clean up afterward.
You have information that matters but cannot attach your name to it. whispr lets you open a channel without either party revealing a real identity. The server never knows who you are.
You are on a library computer, a hotel kiosk, or a borrowed phone. whispr is browser-only with zero localStorage. Close the tab and the session is completely gone.
Reach participants or sources without exchanging personal contact details. Share a link in a post or survey. They reach you once, anonymously, with no permanent connection created.
security
what we built, what it covers, and where the limits are. no marketing, just facts.
The Cloudflare Worker is a blind relay. It stores nothing. A full compromise reveals no message content, no keys, no identities.
Messages are encrypted before leaving your browser. The relay only sees ciphertext it cannot read.
No plaintext passes through any infrastructure. There is nothing to log.
No email. No phone. No name. Your alias is randomly generated in your browser and means nothing to us.
Messages exist only in React state. They are never written to disk, localStorage, or any database. Tab closes — they are gone.
Unlike server-based apps, whispr has no user records, no conversation history, no timestamps stored anywhere. The Worker self-destructs after handshake.
If your device or browser is compromised, an attacker with local access can read messages on-screen. E2EE does not protect against this.
Once the other person reads your message, they can screenshot or copy it. Ephemeral channels cannot prevent human action.
whispr uses session-level ECDH, not the Signal Double Ratchet protocol. The threat model is different. We do not claim otherwise.
Your IP address is visible to the other peer during a WebRTC connection. This is a WebRTC limitation. Use a VPN if IP privacy matters for your use case.
If someone intercepts your invite link before the intended recipient opens it, they can claim the session. Share links through a trusted channel.
ready to disappear?
generating ephemeral identity...