Btwinus

Btwinus lets two people open a private chat without installing anything or signing up. Opening the page produces an invite link and a passphrase. The link contains the WebRTC session offer, compressed and encrypted with AES-256-GCM under a key derived from the passphrase (PBKDF2-SHA256, 100,000 iterations); it lives in the URL fragment, which browsers never send to the host. The recipient enters the passphrase, gets a reply link, and sends it back. From then on, messages travel directly between the two browsers over a WebRTC data channel (DTLS encrypted). Both sides see a short verification code they can compare out loud.

There is no backend. The site is static files on GitHub Pages. Nothing is stored server-side because there is no server to store it; the only outside party in the connection is a STUN server used to discover public IP addresses.

Limitations, stated plainly: both people must be online at the same time; peers see each other's IP addresses; the invite link should be treated as sensitive even though it is encrypted; the code is loaded from the web host on each visit; there has been no independent audit. The current session's messages are kept in the browser's session storage so that a reload of the same tab shows a read-only copy; the browser discards them when the tab closes.

Available in English, French and Lingala. Vanilla HTML, CSS and JavaScript, about 840 lines for the app. MIT licensed.