A small chat room run by Bloodweb, reachable as a Tor hidden
service. It's built so that the people running it learn as
little about you as possible.
What happens to messages
- Everything is deleted after 24 hours, automatically.
- Direct messages between account holders follow whatever
expiry the recipient has set, up to 30 days.
- Nothing is archived or backed up before it expires.
What we don't collect
- No IP addresses. Over Tor we couldn't see yours if we wanted to.
- No email address, no phone number, no real name.
- No cookies, no analytics, no third-party scripts. The
page loads nothing from anywhere else.
Reading vs posting
Anyone can read the room, from a normal browser or over Tor.
Posting requires the .onion address.
A message sent over the clearnet leaves your IP in this
server's logs, timestamped next to what you wrote. A message
sent over Tor doesn't. Since the room is readable either way,
the only person a restriction can protect is the one writing
— so that's where it goes. It also means one thing can be
said plainly: every message here was posted over Tor.
This is not a secrecy boundary and isn't meant as one. Anyone
can install Tor Browser; nothing here is hidden from someone
willing to do that.
Joining as a guest
Pick a display name and start typing. Nothing is stored
between visits when you close the tab, that identity
is gone.
Joining with an account
An account keeps your name reserved and lets you receive
direct messages. We store your chosen username and a bcrypt
hash of your password. That's the whole record.
Accounts are invite-only. To get one you need a bloodweb.net
membership but the invite is built so that it proves
you're a member without revealing which
member, even to us.
If you forget your password
When you create an account you're given a recovery
code. Save it. Entering it with your username lets
you set a new password.
There is no "email me a reset link" here, because there's no
email address on your account to send one to — that's the
other side of not being asked who you are. If you lose the
password and the code, nobody can let you back in; you'd need a
fresh invite and a new username. You can generate a new
recovery code any time from Chat Settings.
How that works
When you request an invite, your browser generates a secret
and multiplies it by a random number that never leaves your
machine. bloodweb.net signs the scrambled result a
number it cannot read and your browser divides the
random number back out. What's left is a valid membership
signature that the signer has never seen.
So the two sides cannot be matched up afterwards. Not by
comparing databases, not from logs, not by us. It's a
property of the arithmetic, not a promise about our
behaviour. (The technique is called a blind signature, and
it dates to David Chaum in 1982.)
On this side we record only that some member created
an account, never which one, and the date is stored without a
time of day so it can't be lined up against anything.
What this does not protect you from
- Timing. If you request an invite and
redeem it five minutes later, anyone watching both sides
can draw the obvious conclusion. Wait hours, or a
different day.
- Small numbers. Hiding in a crowd needs a
crowd. While few people use this, "some member" narrows
down a lot on its own.
- What you type. No amount of cryptography
helps if you post identifying details in the room.
- Not using Tor. The clearnet mirror lets
you read, and on it your IP is visible to the network in
the ordinary way. Use the .onion address.
Running it yourself
The server is a few hundred lines of Node and SQLite. If you
want to know exactly what it stores, the schema comments say
so plainly, including the parts we deliberately left out.