QR + invite string
Same offline payload — scan or copy/paste. No HTTPS join mint for new Hardened rooms.
Buzzio superpower · Hardened Whisper
No name to find.No trail to chase.No proof you met.Gone with the room.
Temporary. Accountless. Pure encryption. Onion hops that keep your production IP off the clearnet Whisper path. SQLCipher database vault, Chat Lock PIN, biometric unlock, and fail-safe wipe. No durable server chat archive — zero evidence left when the room ends.
Hardened Whisper Preview — residual device and global-correlation risks remain; we still refuse fake “perfect anonymity” slogans.
The superpower
Not another encrypted thread. A temporary connection with no lasting trail.
Whisper is built for moments that should never become a permanent Buzzio relationship edge: share a QR or invite string, talk under pure session encryption, ride onion hops, then erase the room — keys, cells, and local Whisper data for that 1:1 session.
Not tied to Buzzio account
Accountless Whisper path — no Buzzio ID / FCM identity on the hardened wire.
Pure encryption
On-device seal + per-lane ratchet. Relays move ciphertext, never readable chat.
Onion hops + IP cover
Tor fail-closed — entry → middle → mailbox. Clearnet Whisper is refused in production.
Database security
Separate SQLCipher Whisper vault + field-level AEAD for messages and media.
Lock PIN + fail-safe
6-digit Chat Lock PIN, biometric when available, fail-safe wipe PIN for panic erase.
We do not keep a single piece of Whisper chat data on our servers after the room ends. Everything for that session is deleted — sealed cells, keys, slot linkage. When Whisper ends, there is no durable record left that this conversation ever happened.
QR & string sharing
Share face-to-face — or pass the invite string
Hardened Whisper uses one offline payload. Encode it as a QR for in-person join, or copy the invite string and paste it under Scan → Manual Entry. Same bytes. Same crypto. Still not an HTTPS deep-link room minted on Firebase.
QR share
- Show the code in person
- Camera scan joins the lane
- Ideal for face-to-face meetings
Invite string share
- Copy from Share → invite string
- Paste in Manual Entry to join
- Same offline payload as the QR
- 1
Create
Pick duration (1–48h). Optional Maximum privacy route when mixnet is linked. Room is 1:1.
- 2
Share QR or string
Hand one person the QR, or copy the invite string. Only that one joiner can enter.
- 3
Join (one person only)
The first scanner / paster validates the offline payload and opens the 1:1 chat. A second join is refused.
- 4
Chat sealed
Tor hops → opaque mailbox. Constant-rate cover while live. Pure ciphertext on the path.
- 5
Expire / End
Timer or End → local wipe + mailbox scrub. Temporary connection closed. Trail scrubbed.
Not connected to Buzzio account
Accountless by protocol — not a contact edge
Hardened Whisper is designed so the chat path does not bind peers through Buzzio IDs. Relays are not supposed to receive Buzzio ID, Firebase UID, phone, email, or FCM tokens on that path. In the room you see creator / scanner labels — not each other’s Buzzio account identity.
- No Buzzio ID exchange in the chat protocol
- No FCM-tied Whisper chat path for Hardened rooms
- Does not create a lasting contact relationship
- The joiner is not added as a permanent Buzzio contact
1:1 only
One creator. One joiner. Nobody else can join.
Current Hardened Whisper is strictly 1:1. You create the room and share the QR or invite string. Only one person can join. After someone is in, a second scan is refused — this Whisper is already in use. It is not a multi-member group room.
Strict 1:1
Creator + one scanner. Extra joiners are refused once the seat is taken.
Private Double Ratchet chat
Only you and the person who joined share that sealed lane.
Session name
Optional label on your device — packaging, not a public identity.
Local nickname
You can label the peer on-device only. It never becomes their Buzzio ID.
End / leave
Creator can End the session; the joiner can leave — that room wipes.
Not a group
No multi-scanner inbox. No other people joining the same Whisper.
Zero trail design
Temporary connection. Zero durable evidence. Zero lasting metadata.
Whisper is engineered so there is nothing useful left to “look up later” for that room: no readable server transcript, no durable Whisper social graph, no permanent storage of what you said. While live, relays hold opaque sealed cells only. When the room ends, those cells and local session material are scrubbed.
No durable server chat storage
Mailbox cells are opaque ciphertext with TTL scrub — not a cloud inbox of your Whisper.
Zero durable metadata graph
After expiry: no lasting who-talked-to-whom archive for that Whisper room.
Zero session evidence after scrub
Keys, relay cells, slot linkage, and local Whisper data for that room are deleted.
Hard to exploit after expiry
Fresh session crypto dies with the timer — compromise of one room does not unlock others.
No delivery / typing / online wire
Hardened control plane is encrypted seen-only — less metadata surface in flight.
Temporary by force
1–48h hard cap. Joins rejected after expires_at. Creator can End early.
Pitch line: meet → seal → hop → expire → leave no durable Whisper evidence for that connection.
Onion hops (production)
Every Whisper ride is multi-hop — not a single clearnet server.
Hardened Whisper traffic goes through onion hops so no single relay holds the full picture. Entry → middle → mailbox. Multi-vendor hops when configured. Relays see sealed cells only — not your Buzzio account, not plaintext chat, not a simple IP-to-identity map.
DeviceKeys & vault
EntryHop 1
MiddleHop 2
MailboxOpaque cells
PeerUnlock locally
Entry hop
First onion step — accepts sealed traffic into the Hardened path.
Middle hop
Separates trust — the entry hop does not equal the mailbox hop.
Mailbox hop
Opaque sealed cells only. TTL scrub. Rotating epoch ids.
Fail-closed Tor
No clearnet Whisper path when Tor is required in production.
IP cover
Your clearnet IP is not the Whisper chat path identity.
Cover traffic
Constant-rate cover while the room is live — less timing leakage.
Multi-vendor hops
When configured, hops can span operators so trust is not one vendor’s monopoly.
Maximum privacy route
Optional mixnet-linked route at create when available — Preview / evolving, not magic.
New rooms do not use Firebase create or Whisper FCM chat paths. Platform keep-alive rules are covered under Limits & platform.
Pure encryption
Sealed on device. Ratcheted per lane. Built to die.
Pure session encryption — not your long-lived 1:1 identity keys. Fresh material rides in the QR / invite string. After the one joiner connects, the 1:1 lane ratchets. Servers never get a decryptable Whisper transcript to store.
Offline payload
QR or invite string — same secret
Per-lane ratchet
After the joiner connects
On-device seal
Plaintext never for relays
Seen-only control
No typing / online wire
Cover traffic
While the room is live
Crypto erase
Keys + cells deleted on End
Encryption verification
Verify this 1:1 chat out-of-band — then mark it trusted on this device
Hardened Whisper includes encryption verification for the room. Open chat info → Encryption / Verify. Compare safety material with the other person through a channel you trust (in person, a known voice call, etc.). When it matches, mark the chat verified — a local badge on this phone, cleared when the Whisper session is wiped.
Out-of-band check
Compare lane safety material outside the Whisper wire — don’t trust a spoofed screen alone.
Verified badge
After a match, the lane can show verified in the chat header / encryption tile.
Local only
The verified mark lives on this device’s prefs — not a Buzzio social graph edge.
Clears on wipe
End session, expiry, or vault wipe clears verify state with the room.
Verification helps confirm you are talking to the intended peer for that lane. It does not create a durable contact or server archive.
Temporary connection
1 hour to 48 hours — then nothing to reopen
This is not a soft “maybe delete someday.” It is a hard temporary connection. When time is up (or you End), the Whisper room is designed to leave zero durable session evidence behind.
Joins are rejected after expires_at. Creator can End early. Joiners detect closed/expired rooms and wipe locally. Your normal Buzzio account and 1:1 contacts stay.
Locks & vault
Database security. Lock PIN. Biometrics. Fail-safe wipe.
Open a Whisper session → Advanced security ⋮. This is the full on-device Hope stack: a separate encrypted database for Whisper, a Chat Lock PIN to open it, biometric presence when available, and a fail-safe wipe PIN for panic erase. Hops protect the wire. This stack protects the phone.
SQLCipher database vault
Whisper data lives in a separate encrypted DB — not mixed into ordinary chat storage.
Field-level AEAD
Messages and media sealed under the vault DEK. Fields stay protected at rest.
Chat Lock PIN (6 digits)
Optional lock. Weak PINs rejected. Required to open the vault after seal.
Biometric / device credential
When hardware is available: PIN verify → live presence check → unwrap keys → open DB.
PIN-only fallback
If hardware protection is unavailable: Advanced security shows “PIN only” — unlock still works with Chat Lock PIN.
Auto-seal on leave / background
Leave Whisper, background the app, or lock the device — vault seals; keys zeroed in RAM.
Wrong-PIN ladder
Attempts left shown every try. Escalating wait. 10 wrong attempts → full Whisper wipe.
Fail-safe wipe PIN
Panic PIN set after Chat Lock. Entering it always erases Whisper — it never unlocks.
Wipe scope
Vault file, Whisper media, key material, lock secrets — cleared with a clear confirmation.
Advanced security ⋮
What you set in-app
- Chat Lock PIN — open the vault
- Fail-safe wipe PIN — panic erase only
- Change / remove lock needs Chat Lock PIN
- Fail-safe PIN must differ from Chat Lock PIN
- Hardware status: biometric available, or PIN only
- Sealed dashboard shows locked stubs — no plaintext titles
- Database security: SQLCipher + AEAD vault
- Lock PIN: 6-digit Chat Lock
- Biometric unlock when TEE / device credential exists
- PIN-only mode when hardware protection is unavailable
- Fail-safe lock: wipe on enter — never stealth unlock
- Onion hops on the wire + vault on the device
Honest limit: Chat Lock protects sealed data on a stolen or unlocked phone. It does not stop a live debugger while Whisper is open, and it is not a network anonymity claim.
Lane tools
Once-view. Screenshot protection. Creator control. Verify.
Short-lived tools for a short-lived room — without turning Whisper into a permanent social product. There is no separate Secure View feature; screenshot hardening is built into Whisper and once-view.
Default screenshot protection
Whisper private chat hardens screenshots / screen recording by default for the session — no standalone Secure View toggle.
Once-view text
Swipe up so new messages leave after they’re seen, with built-in on-screen capture hardening.
View-once media
Photos and videos open once in a secured viewer, then leave.
Encryption verification
Compare safety material out-of-band; mark this 1:1 chat verified on this device.
End session
Creator can End early — mailbox scrub + local wipe for that Whisper.
Leave
The joiner can leave and wipe their side of the room.
No Whisper calls
Voice/video calls stay on normal sealed 1:1 contacts. Whisper is the QR room.
Limits & platform
Create limits, freemium caps, and honest platform rules
Whisper is powerful — and honest about what the phone and plan can do. Duration, the hard 1:1 join rule, and keep-alive behave differently on Android vs iOS by design.
Duration presets
Creator picks 1 hour → 48 hours. Hard cap 48h — scanners reject longer QRs; mailbox clamps too.
Join limit: one person
Only one joiner per Whisper. Once someone has joined, a second scan is refused.
Free: 1 active Whisper
Close or wait for expiry to create another. Ending frees the create slot.
Premium: higher cap
Premium unlocks more active Whispers and longer create-duration options where gated.
Android — keep app open
While a Hardened room is live, keep Buzzio open. A foreground session notification can show the room is running.
iOS — open / foreground
Whisper network is foreground-oriented: sync when the app is open. No promise of background wake while suspended.
Optional Maximum privacy
Create can offer a mixnet-linked Maximum privacy route when linked — Preview / evolving.
What is not deleted
Your Buzzio account, normal 1:1 contacts, and unrelated features stay. Only that Whisper room scrubs.
Not the same product
Whisper private chat ≠ Whisper Questions
People mix these up. Don’t. This page is only Hardened Whisper private chat — timed QR / invite-string E2E rooms. Whisper Questions is a separate product: anonymous ask links (for example on whisper.buzzio.dev) where strangers answer and the link owner reads replies in the app.
Whisper private chat (this page)
- QR or invite string join
- End-to-end sealed 1:1 room
- Tor / onion hops · accountless path
- Hard timer → scrub · zero durable Whisper graph
- Chat Lock vault on device
Whisper Questions
- Share an ask link in a browser
- Not the same E2E Whisper room model
- Answers stored so the owner can read them
- Not Tor Hardened private chat
- Not Chat Lock / fail-safe Whisper vault
If you need sealed meet-and-vanish chat, use Whisper private chat. If you need anonymous Q&A links, that is Whisper Questions — a different surface.
Best on Earth
Why Whisper beats every privacy app category for meet-and-vanish chat.
Compared honestly with the apps people actually choose for privacy — Signal, Telegram, Session, and BChat. They encrypt (or claim to). Almost none delete the fact that you talked. Whisper is built so that after End / expiry, our servers hold no Whisper chat body, no lasting who-met-whom graph for that room, and no archive proving the conversation existed.
| Capability | Buzzio Whisper | Signal | Telegram | Session | BChat |
|---|---|---|---|---|---|
| Join without phone / account ID edge | ✓ | ✕ | ✕ | ◐ | ◐ |
| Hard timer then full room scrub | ✓ | ◐ | ◐ | ✕ | ✕ |
| Zero durable server chat after end | ✓ | ◐ | ✕ | ◐ | ◐ |
| No lasting proof-you-talked graph | ✓ | ✕ | ✕ | ✕ | ✕ |
| Multi-hop onion path (entry → middle → mailbox) | ✓ | ✕ | ✕ | ◐ | ◐ |
| Tor / onion fail-closed on chat path | ✓ | ✕ | ✕ | ◐ | ◐ |
| Clearnet IP refused for the room | ✓ | ✕ | ✕ | ◐ | ◐ |
| Database security (SQLCipher Whisper vault) | ✓ | ✕ | ✕ | ✕ | ✕ |
| Advanced security Chat Lock (PIN + biometric) | ✓ | ✕ | ✕ | ✕ | ✕ |
| Fail-safe wipe lock (panic erase PIN) | ✓ | ✕ | ✕ | ✕ | ✕ |
| Meet-and-vanish · room cannot reopen | ✓ | ✕ | ✕ | ✕ | ✕ |
- ✓ Full support
- ◐ Partial / different model
- ✕ Not designed for this
Signal — strong E2E, but phone-number identity and lasting contact edges. Disappearing messages ≠ a room that dies. Telegram — cloud chats by default (readable by Telegram); Secret Chats are optional E2E and still account-tied. Session & BChat — deeper anonymity routing than mainstream apps, but built around durable messaging IDs and long-lived threads — not Hardened Whisper’s timed, accountless, scrub-after-end meet-and-vanish model.
Best for identity silence
No Buzzio ID handshake — creator + one scanner labels only, strict 1:1.
Best for temporary truth
The room is born to die. Other apps keep a thread; Whisper deletes the connection.
Best for server emptiness
After End: no Whisper bodies, no durable session metadata graph for that room.
Best for production hops
Tor fail-closed onion path — not a clearnet “E2E” sticker on a phone-number network.
Best for device panic
Chat Lock vault + fail-safe wipe — Advanced security database lock on this phone.
Best for “it never happened”
When scrub finishes, there is no durable Buzzio record left that this Whisper existed.
Encrypting content is table stakes. Deleting the conversation’s existence from our servers after End — that is why Whisper is the best meet-and-vanish privacy product on Earth.
Honesty that builds trust
What we still refuse to fake
Zero durable Whisper evidence after scrub is a product design. It is not a promise that a live peer, a compromised phone while the vault is open, or a global traffic adversary can never exist. Preview stays Preview until verification and a public audit report land.
- We design for zero durable server chat storage & metadata
- We do not claim magic immunity to every attacker forever
- We do not say “audited” without a published report
- Mixnet Maximum privacy is optional / evolving
- iOS does not promise background Whisper wake while suspended
- Whisper Questions ask-links are not this E2E room
Ready for temporary. Sealed. Gone.
Create Hardened Whisper. Share the QR or invite string. Talk under pure encryption on Tor hops. Let Chat Lock guard the database. When the moment ends — vanish with zero durable trail for that room.