What a Chat256 identity is
Chat256 uses browser cryptographic identity as part of its authenticated communication model. A public identity can be shared with another person without sharing the private key that proves control of it. The service can associate an authorised session with the expected identity and public-key material.
How sessions work
A durable session lets the service recognise an authorised browser without requiring every action to start from scratch. Session records are checked for validity, expiry, account status and identity consistency. Sensitive operations can require an additional proof of possession from the browser's signing key.
Why identity verification matters
Encryption protects a message from unauthorised readers only if you are using the intended recipient's cryptographic identity. For sensitive conversations, compare identity information using a separate trusted channel before assuming that a contact is who they claim to be.
Recovery and device changes
Recovery mechanisms are designed to help a legitimate user regain access without turning the server into the holder of a plaintext private key. Device changes should be treated as security events: review the identity, sessions and contacts after recovering or moving to another device.
Notifications and contact privacy
Chat256's browser notification layer is designed to keep message content out of operating-system notification text. Contact information is also handled in the protected client storage used by the application.
Identity safety checklist
- Verify a new sensitive contact before sharing confidential information.
- Never send a private key, recovery secret or session token to another person.
- Protect the device that stores your Chat256 identity.
- Review active sessions after a device change.
- Treat QR codes, invite links and chat keys as secrets.