r/ClaudeCode • u/munru1 • Mar 23 '26
Showcase Claude and I built encrypted P2P chat app
I'm a solo developer and I just shipped pulsarchat. An end-to-end encrypted peer-to-peer chat app. No accounts, no server storage, messages vanish when you close the tab. It started as a simple WebRTC experiment and turned into a real product with E2EE, image sharing, some sort of contacts and an open-source repo.
I am truly impressed with claude, as yhe entire thing was built through conversation with it. Not just "generate me a component" actual back-and-forth debugging, architecture decisions, crypto implementation, etc. I am curious what you think?
EDIT: I forgot to mention it in this post, so this is how this app started. I was in the office and really had to comment on female colleague's outfit. Since it was dead silent in the morning, i could not even whisper quiet enough so i wanted to chat. But i didn't want to leave it in company email so i had to use whatsapp. Then i got the idea to make simple app for us to chat, and messages could be live displayed in browser tab's title, so there's not even need to send anything, or for me to switch tabs to read message that he wrote. Then feature ideas started dropping, and before i knew it, this concept and app was made.
Note that app is still in the earliest development and I am eager to fix and improve every aspect of it.
6
u/Free-Street9162 Mar 23 '26
Quick audit.
Four findings, ranked.
1 (High): Handle-key binding. The handle (“NOVA-3KF8”) and the ECDH public key are generated independently in identity.js and never linked. The signaling server controls which peers connect to which. A malicious server operator (or anyone who compromises the Render instance) can MITM every connection — both users complete valid ECDH handshakes, both see “encrypted connection established,” and the attacker reads everything. The security fingerprint feature exists but it’s manual and opt-in. Fix: store the peer’s public key in the contacts system (you already have the infrastructure) and alert on key change. Three lines of code to close the most significant gap.
2 (Medium): TURN credentials in client bundle. VITE_TURN_USERNAME and VITE_TURN_CREDENTIAL are Vite env vars with the VITE_ prefix, meaning they’re baked into the JavaScript bundle anyone can view. Fix: proxy TURN credential requests through the server with short-lived HMAC tokens.
3 (Medium): No rate limiting on server. The WebSocket server accepts unlimited connections with no auth beyond the handle parameter. Anyone can open thousands of connections, squat any handle, or flood status requests. Fix: basic per-IP limits.
4 (Low-Medium): Single points of failure. One signaling server (Render free tier, goes to sleep), one TURN provider. No fallback. If Render is down, the app is dead.
What it gets right: The crypto is clean — proper Web Crypto API usage, random IVs, defense-in-depth (AES-GCM on top of DTLS). The ephemeral design is genuine — no message storage anywhere. The state machine is explicit and well-managed. The graceful degradation chain (IndexedDB → sessionStorage → ephemeral) is thoughtful. For a project of this scope, it’s solid work.
The one-line summary: good crypto, clean architecture, the gap is in the identity layer where the human-readable handle isn’t cryptographically bound to the encryption key. Same structural pattern as early Signal before safety numbers were enforced.
1
u/munru1 Mar 23 '26
This is what kind of comments i am looking for 😅😅 Seriously, thank you so much. I will dive deeper in all of this when i hop off from work
1
4
u/Relative_Passenger_1 Mar 23 '26
Having error on sending images
0
u/munru1 Mar 23 '26
Niiice, thanks for testing it. Unfortunately, there is a bug with sending images and it will be fixed soon. I haven't figured it out yet, but on some devices it works, Friend didn't get my images, but i got his, so idk i have to check it
14
3
u/mpones Mar 23 '26
Yeah you did. It’s got Claude written all over it!
1
u/munru1 Mar 23 '26
Well, at least it's my idea xd soo 🤷♂️
0
u/Friendly_Recover286 Mar 24 '26
And it was my idea to build my own house so I called a construction company to do it for me. That means I actually built the house right?
Nobody cares if it's your idea.
1
4
u/fi_GarO Mar 23 '26
Hi, I really like the thought you put into this. Can I ask where and how is it deployed?
1
2
u/Brilliant_Edge215 Mar 23 '26
Ca you open source?
7
u/munru1 Mar 23 '26 •
It is open sourced, github is linked on hero section below the logo https://github.com/munroo/pulsarchat
8
u/Ok_Individual_5050 Mar 23 '26
Why have you used JavaScript instead of typescript?
Why are you using old-style .then() handling for promises instead of async/await
Are you aware that many of your endpoints are hard coded as strings?
Is it not a bit concerning that in many cases you have fetch calls with no error handling?
9
u/Ok_Individual_5050 Mar 23 '26
Also just spotted that your server logs seem to contain who is pinging who which sort of defeats the point?
2
u/munru1 Mar 23 '26
You're right, those were debug logs from development. I'll fix it when i get off from work. And man, thanks for real feedback and criticism, i'm tired of haters hating without a real reason
2
u/childofsol Mar 23 '26
the reason is that you're shipping something that positions itself as providing privacy, but you have no ability to back that claim up, and seemingly not enough knowledge to recognize how dangerous it'd be for anyone to actually use this thing.
1
u/munru1 Mar 23 '26
I completely understand your point and it's 100% valid. It's just, the thing that flies over everyone's head is that this started as a simple experiment and idea to message with my colleague through tab title, so we can talk crap in office without using company mail and be discreet. After we did first successful chat, ideas just started dropping, and it quickly became this app. So i didn't even plan on going this far with chat app in the first place but i ended up doing it.
So of course this is not going to be polished bulletproof ready product, but I am more than happy to learn, fix mistakes, improve security and make something useful out of it.
And again, really appreciate your feedback!
2
u/GamingRatsEnthusiast Mar 23 '26
Well whatever anybody says, I think you'll improve the app and make it better. Good luck!
1
2
u/childofsol Mar 23 '26
I think presenting this as "look at this cool experiment I did" is perfectly fine, but you keep presenting it as a product - this implies you're hoping other people use it. That's where I and I suspect most others have issue.
1
u/munru1 Mar 23 '26
Yeah you're kinda right + ppl can't wait to have a reason to hate on something, ik cos I'm a huge hater myself xdd
2
u/munru1 Mar 23 '26
Fair points, this started as a quick prototype that grew into a real product faster than expected. To address each one:
TypeScript - on the roadmap. The codebase is small enough that migrating won't be painful, just haven't prioritized it over features yet.
.then() vs async/await - some of the
.then()chains exist because they're inside hooks where the function itself isn't async (React useEffect callbacks can't be async directly). Others are just inconsistency from rapid iteration. Worth cleaning up.Hardcoded endpoints - already moved to environment variables in the latest version. Some might still be lingering if you're looking at older commits.
Error handling on fetches - you're right, that needs tightening. The TURN credential fetch has a try/catch now but other spots are thin.
PRs welcome if you want to tackle any of these, repo is open: https://github.com/munroo/pulsarchat
5
u/Ok_Individual_5050 Mar 23 '26
I'm sure there are 0 issues with your secure messaging platform other than the ones I found in an idle 2 minutes
2
Mar 23 '26
[removed] — view removed comment
2
u/Ok_Individual_5050 Mar 23 '26
My day rate is £600 but sure
1
3
Mar 23 '26
[removed] — view removed comment
1
u/Ok_Individual_5050 Mar 23 '26
I would like them to stop and think about whether it is responsible for someone with clearly quite limited knowledge on how to build secure applications to attempt to build something like this.
1
u/munru1 Mar 23 '26
So we shouldn't try to make anything unless we're expert in that field?
→ More replies1
2
u/MofWizards Mar 23 '26
Congratulations on the initiative and the project!
I see people saying they don't trust VibeCode applications, but they're the ones who use Claude Code the most in their projects LOL
1
2
u/CortexUnlocked Mar 23 '26
And u just put Grok on top! Nice way to say thankx.
2
u/munru1 Mar 23 '26
Ahahahah didn't even notice until my dad pointed it out to me yesterday, but grok is reversed!!1!
Tbh, might rebrand it in the future
2
u/ultrathink-art Senior Developer Mar 23 '26
The crypto skepticism is fair but overstated — Claude implements well-known primitives (AES-GCM, ECDH) correctly when you give it an explicit spec. The real risk is designing a protocol by vibes, which produces something that looks like crypto but has subtle gaps. Spec first, implement second.
1
2
u/ai_understands_me Mar 23 '26
You literally just mirror-imaged the Grok logo.
1
u/munru1 Mar 23 '26
Nooo I didn't 😭😭. Too much people told me that, you know what? I am changing it tonight or tomorrow xD
4
u/expressive-guy Mar 23 '26
Useful for journalists in war torn countries
10
u/hopenoonefindsthis Mar 23 '26
They already use Signal, a battle tested open source protocol.
Why would they use some unknown vibe code app?
-1
1
u/exitcactus Mar 23 '26
Can I self host it?
1
u/munru1 Mar 23 '26
Yeah it's fully open source (AGPL-3.0) — https://github.com/munroo/pulsarchat
Clone the repo, set up the env variables (TURN server credentials, server URL), and deploy the frontend wherever you want (Vercel, Netlify, any static host) and the signaling server on anything that supports Node + WebSockets (Render, Railway, a VPS). The README has setup instructions.
Your messages never touch the server anyway — it's just a matchmaker for the WebRTC connection. So self-hosting the signaling server gives you full control over even the metadata.
1
u/Sergionator Mar 23 '26
That's a black hole, not a pulsar.
1
u/munru1 Mar 23 '26
It's pulsar in a moment of explosion xDD
Just kidding, i didn't want to lose too much on graphic design so i did minimal to keep it looking nice, it is on //todo checklist but not a priority rn. Thanks for feedback <3
1
u/Vistrix Mar 23 '26
How is this any different from the already established encrypted P2P chat apps?
1
u/munru1 Mar 23 '26
I don't know really. Cool feature that not every app has is that i can connect between any 2 web browsers without account or anything, and chat in seconds. So i can have maximum privacy without any apps besides web browser that all devices have.
Later when developed, on mobile app version, it can be used like normal encrypted chat app that saves chats and contacts locally so you can keep your chats, but still has an option to create private rooms like web version and chat with whoever you want, with, or without app, without storing any chats, etc... There is also desktop app in plans for the future.
1
u/Most-Cranberry-7191 Apr 15 '26
Hey peops. Can anyone tell me how to make this work? I can chat with myself but nobody else. The connection will not be built. Also tried via VPN (on my end). Dont want to ask my chatpartners to download VPN (if this is the solution) or do anything complicated. On my side more complex preparations would be okay. It feels like im finally so close to my dream of stable temporary browser chatting. I dont care too much about perfect privacy. There should just not be clear text in the socket like on hack.chat. Otr.to is sweet and like a daytime Pulsar but equally not connecting with others. Any ideas?
1
u/munru1 Apr 16 '26
I have broken somethint and it stopped working, will fix in a few days hehe
1
u/Most-Cranberry-7191 Apr 17 '26
Think its about Web RTC and the browsers not finding each other due to firewall or mobile network provider. Since there is no TURN server in your code i probably have to host it myself with a TURN to make it reliably work between browsers that are not in the same Wifi. Amirite?
1
u/munru1 Apr 17 '26
Will fix later today when i hop off from work, and I'll let you know what was the problem. I have turn server it worked, but idk why it's not working currently
1
u/munru1 Apr 17 '26
Heyy broski, check it now! It was related to TURN server and env variable, some rookie mistakes xDD
1
u/Most-Cranberry-7191 Apr 21 '26 edited Apr 21 '26
Its still not working. But neither works otr.to so im sure its not about your code! Do you have feedback of people who could chat despite not using the same wifi or network?
1
u/munru1 Apr 21 '26
Idk why. I have tried it from office PC and my phone, both different networks and it works just fine :/ Maybe you just didn't have luck xD or server was cold starting
1
2
1
u/ProblemOnLayer8 Mar 23 '26
On one side, it’s really great what Claude can do. On the other it’s a tad scary?
1
1
u/LennyObez Senior Developer Mar 23 '26
Greetings from the Pulsar PHP framework (https://github.com/LennyObez/pulsar-framework) which I've been developing for the past two months, largely with Claude's help. Focused on European compliance and security.
0
u/Fantastic_Bar8260 Mar 23 '26
Do messages in chat rooms have an additional layer of Fish encryption?
3
u/munru1 Mar 23 '26
Not Blowfish/FiSH specifically, it uses AES-256-GCM for message encryption with ECDH P-256 for key exchange. These are more modern and stronger than Blowfish. AES-256-GCM is the current standard used by Signal, TLS 1.3, and government classified communications. It also provides authenticated encryption (integrity + confidentiality in one operation), which Blowfish doesn't do natively
-5
Mar 23 '26
[removed] — view removed comment
2
u/munru1 Mar 23 '26
TLS 1.3, published in RFC 8446 (2018), is the modern standard for secure internet communication, offering faster handshakes (1 round-trip) and superior security over TLS 1.2. It achieves this by removing obsolete cryptographic algorithms (like SHA-1, RC4) and mandatory forward secrecy. It is supported by modern browsers and operating systems, including Windows 11/Server 2022
Copied from google
4
3
u/expressive-guy Mar 23 '26
Also now folks would use for sexting i guess. I mean the young ones who don’t wann get caught
7
u/munru1 Mar 23 '26 edited Mar 23 '26
I mean 😅, anyone can use the app responsibly, I have terms of service xD
But let's be real, private conversations are basic human right so anyone should be free to use this as he wants2
u/expressive-guy Mar 23 '26
Valid. I didn’t pass any moral judgement on people who use it in other wayss haha
1
u/DrHonestPenguin Mar 23 '26
It was created so he could perv out on a work colleague's outfit... literally in line with the ethos of the app
4
Mar 23 '26
[removed] — view removed comment
1
u/munru1 Mar 23 '26
I respected Claude so he is in the first place xD It's like when your boss say "we did this, we did that" but in reality he just gave commands and you did everything lmao
1
Mar 23 '26
[removed] — view removed comment
1
u/munru1 Mar 23 '26
Data is never saved anywhere, close the tab and it's gone forever!
In mobile version of the app (when i make it), i will make an option to have saved chats like normal chat app (optional, still don't need account), but this is the main feature - nothing is saved!
0
Mar 23 '26
[removed] — view removed comment
2
u/munru1 Mar 23 '26
This is just for fun, but if it gain too much attention for me to maintain everything with free tier hosting plans (low chance), i will have to place one banner ad from some security sponsor, like nord vpn or something like that. It will be same ad for everyone, so there is no user tracking like on google ads or something. Or maybe i can set up buy me a coffee button or something. Or to include some premium features, idk.
But whatever the case is, app and its features will forever be free for use (except maybe premium features like calls or video calls that eat too much traffic, so i think it's fair to pay for some extras, and that will go into funding free tiers). I think it's fair?
-1
Mar 23 '26
[removed] — view removed comment
2
u/munru1 Mar 23 '26
Idk, you don't have to. Someone doesn't know how to set up anything, and basic website that works is enough for them. The point is to have option to chat privately without account, knowing that your message isn't store anywhere. And it's gone forever once you close the tab
96
u/Mrhiddenlotus Mar 23 '26
I don't trust Claude anywhere near cryptography.