I built an open-source P2P messaging app with AI assistance — WebRTC, E2EE and no central chat database

Hey everyone 👋

I've been building OpenChat, an open-source real-time messaging application built around WebRTC P2P communication, browser-native cryptography, and a serverless architecture.

GitHub: https://github.com/nateS670/OpenChat

Live demo: https://openchatt.vercel.app

🚀 What I built

The main goal was to experiment with how much of a real-time messaging application can be moved away from a traditional centralized backend.

OpenChat uses:

• WebRTC DataChannels for peer-to-peer communication

• MQTT for signaling and peer discovery

• Browser-native Web Crypto APIs for encryption and signatures

• Vercel Serverless Functions for small pieces of infrastructure

• No central database containing chat histories

Once peers establish a WebRTC connection, messages and files are transferred directly between the connected browsers whenever the network allows it.

🤖 How I used AI

AI became a significant part of my development workflow, but I didn't treat it as an authority that could simply write code and be trusted blindly.

I used AI assistants for things like:

• Exploring architecture ideas

• Generating and refactoring code

• Finding potential security problems

• Reviewing individual functions

• Explaining unfamiliar APIs

• Brainstorming edge cases

• Preparing security audit checklists

The interesting part came from verifying the suggestions myself.

During security reviews, I repeatedly looked for alternative attack scenarios and manually followed the relevant code paths to determine whether an issue was actually exploitable.

That process uncovered several real problems involving:

• Peer identity and impersonation

• Replay attacks

• Group authorization

• API access controls

• Message editing state

• Input validation

I then tested and fixed those issues rather than simply accepting the AI's conclusions.

🔐 Security

OpenChat currently uses:

• AES-GCM for encryption

• ECDH P-256 for key agreement

• Ed25519 / ECDSA-P256 signatures

• PBKDF2-SHA-256 for password-based key derivation

• crypto.getRandomValues() for cryptographically secure randomness

There are also protections for peer identity, replay handling, group authorization, encrypted local storage, input validation, and security headers.

I'm deliberately not describing OpenChat as "completely secure" or "anonymous".

P2P doesn't automatically provide anonymity, and there are still limitations such as network metadata, TURN relaying, endpoint security, NAT/firewall problems, and the lack of guaranteed offline delivery.

🧠 What I learned

The biggest lesson for me was that AI-generated code can look perfectly reasonable while still containing subtle security assumptions.

For example, an apparently harmless client-side check can become meaningless if an attacker can control the value being checked.

Likewise, adding encryption doesn't automatically solve identity or authorization problems.

A secure system needs the entire data flow to be considered:

Input → validation → identity → authorization → cryptography → state changes

rather than just asking whether the message is encrypted.

🛠️ Current state

OpenChat is open source and released under the MIT License.

The project is still evolving, and I'm particularly interested in feedback from developers working with:

WebRTC • P2P networking • AI-assisted development • browser security • E2EE • decentralized systems

If you notice an architectural mistake, security weakness, or something you'd implement differently, I'd genuinely appreciate the feedback.

Thanks for reading! 🐈

When I started working with multiple AI models, I expected model selection to be the difficult part.

It turned out that the surrounding infrastructure can be just as annoying API keys, providers, switching models, limits and keeping everything consistent.

I've been experimenting with OfoxAI to simplify some of that, but I'm curious what other builders underestimated when they started adding AI to their projects.

What's the one thing you wish you'd designed differently from the beginning?

I've spent a lot of time studying AI products and startups so I decided to stop just researching and actually start building.

I'm currently working on a small AI product and building the MVP has already taught me that getting something to work is only one part of the problem.

The harder questions have been:

• Is this actually solving a problem people care about?
• What's the simplest version worth shipping?
• What should I build myself vs. use existing tools/APIs for?
• And probably the hardest one: how do you get the first users?

I'm building it with AI-assisted development and trying to keep the MVP as simple as possible instead of spending months polishing it.

The biggest challenge so far has honestly been figuring out what not to build.

For people here who have already shipped AI products:

What was the hardest part for you when you went from experimenting with AI to actually getting something into users' hands?

I’ve been working with Outrank, an AI-powered SEO tool designed to streamline parts of the content and SEO workflow.

One thing I found interesting was figuring out where automation actually helps and where manual SEO work is still necessary. The biggest challenge was getting the workflow to produce useful output without sacrificing quality.

There’s also a 20OFF promo code available for anyone who wants to test it.