Arnon – browser-only ephemeral E2EE chat

[arnon-shub]

Category

Secure & Encrypted Messaging

Software to be added

Name: Arnon

Website: https://arnon.app
Source code: https://github.com/atas2390/arnon

Description:
Arnon is a tiny open-source messenger for one-off end-to-end encrypted conversations. It runs entirely in the browser (PWA), with no app install, no account, and no phone number or email. Each room is just a random URL token.

How it works:

• ECDH (P-256) key exchange via the Web Crypto API
• AES-256-GCM with a fresh IV per message
• Relay is a simple WebSocket server that only stores encrypted blobs in memory; nothing is written to disk
• Optional self-destruct timer that destroys the room on both sides

What it intentionally doesn’t do:

• No images, videos, or file sharing – just text and short voice notes (up to 30s), by design
• No contacts, groups, search, push notifications, analytics, or ads

Funding / governance:

• Free side project, no company, no investors, no monetization

Supporting Material

• Main site: https://arnon.app
• GitHub repo: https://github.com/atas2390/arnon
• Threat model / landing page explanation is on the main site.

Affiliation Disclosure

I am the developer and maintainer of Arnon.

Would you like to submit a PR?

None

Please tick the boxes

• You have filled out this form accurately, and to the best of your knowledge
• You have indicated whether or not you are associated with the suggested addition
• A similar submission has not already been opened for this software / service
• You agree to the code of conduct

[ltguillaume]

I'll make a PR if @Lissy93 likes it.

[arnon-shub]

That would be great, thanks!

[Lissy93]

Oh this is really cool. I LOVE this kind of stuff, and it's awesome the code is so short!

I am happy for a PR, but would you mind if we waited until it has been around for a little bit longer? Only because it's common for it to take a few weeks/months of use before issues to get discovered and fixed.

[Lissy93]

I took it for a spin, and a quick read of the code (which was very easy since it's only a few hundred lines! 🤩). Did find a couple of things, all of which are easily fixable (I can send you PRs if u like?)

Stored XSS (CWE-79/CWE-83)

The linkify func can allow for a stored XSS via attribute injection. Because the regex character class [^\s<&] does not exclude ", so double quotes in a URL are matched and included in the substitution, so an attacker break out of the href attribute and inject arbitrary HTML attributes, including event handlers.

Here's a demo

Recording.2026-03-14.132155.mp4

---

Bypass IP Limit / DoS (CWE-807)

You might have already spotted this, but in your rate limiter, the relay unconditionally trusts the X-Forwarded-For header, which is easily spoofable (unless I am missing something, and this gets set by your reverse proxy?). But even with this, this header is usually a comma-separated list and your code uses the entire raw header as IP key. Basically, this allows an attacker to bypass your MAX_ROOMS_PER_IP check and flood you thousands of open rooms / DoS until your server runs out of mem.

I won't include demo, for obvious reasons ;)

---

Couple of small things:

• Having a short .well-known/security.txt would be stella
• In the key generation, is extractable: true actually needed? This seems risky, as makes exfiltrating the private key (via exportKey('pkcs8', myKeys.privateKey)) possible (only if something else is compromised, like an XSS)
• You should set a CSP and other security headers
• For the voice chat feature, you should limit allowed files by MIME type, to stop a bad user sending a bad payload
• I got a memory leak while trying to test the voice chat feature. Probably because URL.createObjectURL() gets called for each voice note, but it never calls URL.revokeObjectURL()
• To actually make your "Close the tab — everything is gone" claim true, you might want to do something like history.replaceState() to strip the ?r= param from the URL, otherwise room IDs persist in browser history

And, a few usability suggestions too (just my personal opinions, you don't need to listen to these!)

• The hard-coded RELAY and BASE values means I need to edit the app.html to run
• An option for a non-bare metal installation would be nice, maybe a Dockerfile.
• If I open a chat when there's no one else there, the send button just fails silently. Some kind of error message would really help with the UX, otherwise it feels broken.
• The "Connected" string is hard-coded / shows even before key exchange

[Lissy93]

Update: I fixed all them, as well as some more security improvments I noticed in a https://github.com/atas2390/arnon/pull/4

It's certified "works on my machine" 😅 So it will need testing toughly before accepting, as there's no tests in the repo yet.

Once that's done, and after the app has been properly used and maintained for another few months, then feel free to submit a PR here @atas2390 :)

[arnon-shub]

Wow, thank you — this is an incredible review. The video demo for the XSS was a nice touch.

Everything you flagged has been fixed and pushed — the XSS, the X-Forwarded-For bypass, extractable keys, missing CSP, voice MIME validation, blob memory leak, and room IDs in browser history. Also added a security.txt, a Dockerfile, and the UX improvements you suggested (send feedback, connection status, config comments).

Totally makes sense to wait before a PR. Thanks @ltguillaume for offering to put it together when the time is right.

[arnon-shub]

Thanks for this — and for the detailed commit-per-fix structure.

I actually pushed fixes for all of these about 15 minutes before this PR landed (we were clearly working on it at the same time). Most of the changes overlap, but your --trust-proxy approach for X-Forwarded-For is better than what I did — I was just always parsing the first IP from XFF, yours correctly ignores it entirely unless the flag is set.

I'll merge this to pick up the --trust-proxy improvement. There might be minor conflicts since both branches touched the same lines, but should be straightforward to resolve.

Really appreciate the review.

[arnon-shub]

Hi Lissy,

I have deleted the project, you can close it.

Ty!

[ltguillaume]

Can I ask why? I thought it was pretty useful.