How Bisik's Security Works

Last updated: November 8, 2026

From a code to a key

When you type a code, your browser derives two things from it. One PBKDF2 process (250,000 iterations) produces both at once: the room id — the only thing ever sent to the server, just to pair up two browsers using the same code (a room holds at most two people) — and the AES-GCM 256-bit encryption key, which never leaves your browser. The room id is deliberately derived the expensive way as well, so it can't be used to guess your code offline.

The journey of a message

Messages and images are encrypted in the sender's browser with a fresh random IV for every message, relayed by the server in encrypted form from memory only, then opened in the recipient's browser. The server has no key, so if its traffic were intercepted or the server itself breached, all anyone would get is random-looking text. The six characters at the top of the chat screen are your room fingerprint — compare them with your friend's to be sure you're both using the same code.

What it protects

Your conversation's contents from network snoopers, from the hosting provider, and from anyone who doesn't hold the code. There is no history that could be demanded, stolen, or leaked from the server, because nothing is ever stored.

What it cannot protect

Bisik can't help if your own device is already compromised, if the person you're talking to photographs the screen or forwards the contents, or if your code is weak and gets guessed — codes like a birthday or "secret123" can be tried by anyone. Your IP address also remains visible to the network and the hosting provider, like any website.

Tips for staying safe

Use the built-in random code, or a long custom code with no personal meaning. Share the code through a different channel than the conversation itself. Compare room fingerprints before discussing anything sensitive. End the session when you're done.