On this device
Key generation, wrapping, and decryption happen in the browser you are using.
What “end to end” means in Virexa Private
For a text message, your browser creates a fresh content key, encrypts the words with AES-256-GCM, then wraps that key for you and for each person in the chat who has a public key. What leaves the device is an envelope: ciphertext, the wrapping, and the sender’s public key. The people in the conversation unwrap it locally. If that unwrap fails, you see Encrypted message. Virexa Private does not fall back to plaintext.
This is not a marketing lock icon on an otherwise open inbox. The web client generates keys with the Web Crypto API, keeps the private key in IndexedDB on that browser, and registers only the public key so others can encrypt to you.
Fail closed
A body that cannot be opened is shown as Encrypted message. The app does not guess.
Per message
Each send gets a new AES-GCM content key, wrapped to every participant including you.
Username, not a number
The people you encrypt to are the usernames in the chat — not a phone book Virexa Private scraped.
The pieces, in order
1. A key pair for this browser
The first time encryption is needed, Virexa Private creates an ECDH key pair on the P-256 curve. The public half can be exported and stored with your account so others can seal a message to you. The private half stays in this origin’s IndexedDB. Clearing site data for web.virexaprivate.com removes that private key. A new browser is a new pair until it registers.
2. A content key for this send
Every outgoing text generates a random AES-256-GCM key and a random 12-byte nonce. The plaintext is encrypted with a 128-bit authentication tag. That ciphertext is what travels in the envelope, not the words you typed.
3. Wrapping for each person
For you and for each peer with a public key, Virexa Private derives a shared secret with ECDH, mixes it with a Virexa Private-specific info string, and hashes it with SHA-256. That digest becomes the wrapping key. The content key is encrypted to that person. A broken peer is skipped so the rest of the room can still read the send.
4. Open only with your wrap
On receive, the client finds the wrap that belongs to your user id, unwraps the content key, and decrypts the ciphertext. Direct chats and groups use the same path: peers are taken from the other participant or from the member list.
What the server is for
Virexa Private still has to deliver an envelope, store it for the thread, fan it out to devices, and show a preview once your client has decrypted it. Public keys are registered so a sender can wrap to someone who is not sitting in the same tab. Signaling for calls also goes through Virexa Private. None of that requires the plaintext of a sealed text message.
Last-message previews in the chat list are decrypted on this device the same way. If that fails, you do not get a forged snippet.
What this does not claim
Honesty matters more than a bigger lock. Virexa Private's web encryption is this envelope on chat text. It is not the Signal double-ratchet, and we do not pretend it is. Media files — photos, videos, voice notes, GIFs — are uploaded through Virexa Private storage and fetched with an access token. File names in an encrypted send can be sealed in the envelope; the bytes of the file follow the storage path.
Voice and video calls use WebRTC. The live audio and video are protected in transit by the browser’s DTLS-SRTP session. That is a different layer from the chat envelope. Read the calling page for how a call is set up.
Keys are per browser. If you open Virexa Private on another computer, that browser must create and register its own pair. We do not upload your private key, and we cannot reconstruct it from the server.
Identity around the lock
Encryption is only as private as the account around it. Virexa Private does not collect a phone number. Email is used once for a 6-digit code and is not stored on the account. Name and bio are optional. Date of birth is required to confirm you are 18 or older. Last seen and read receipts are switches you control. Block and report are there when a person should not have a path to you.