Hush

Private text messages in your browser. No phone number, no email. Pick a username and find your people.

Messages are encrypted on your device (ECDH P-256 + AES-GCM) before they leave it. The server only holds ciphertext, but it can still see who talks to whom and when. There is no password recovery: if you forget your password, the account is gone. Free hosting has limits and may change.

Settings for

Your conversations and encryption identity stay the same.

Other signed-in devices are logged out.

Security

Your key fingerprint:

Your private key is created on this device and never sent to the server. Signing in on a new device creates a new key, and your contacts will see a warning. Every message uses the same key pair per conversation, so there is no forward secrecy and old messages are not protected if a private key leaks. Message length is visible to the server. Encrypted messages are deleted from the server after 30 days. Deleting your account erases your messages and conversations from the server, which also removes them for the other person.