Frequently asked questions

No. Messages and files exist only in the memory of the two browser tabs. Nothing is written to a server or a database, and when either tab closes the conversation is gone for good. There is no history and no recovery.

Each session creates fresh ECDH P-256 key pairs in both browsers. The shared secret is combined with the secret from your private link, or with your 6-digit code, through HKDF-SHA-256, and every message and file chunk is then encrypted with AES-256-GCM before it leaves your device. This runs on top of the DTLS encryption that WebRTC already applies to the connection.

• Read the security model

After you connect, both screens show a 12-character safety code. If the connection has not been tampered with, the two codes are identical. Compare them with the other person over a separate channel, such as in person or on a phone call. Matching codes mean nobody is sitting in the middle of your session. Checking matters most when you connect with a 6-digit code.

No. Encryption keys are created and kept in your browser and are never sent to any server. The signaling server only relays the connection setup, such as network addresses and public keys, and the 6-digit code service only stores which code points to which waiting session. Codes stop working after 10 minutes and are deleted shortly after.

NulBridge never asks who you are. However, like every WebRTC app, a direct connection reveals each side’s IP address to the other person, and the signaling server sees connection metadata such as IP addresses. Only connect with people you are comfortable sharing that with, or use a trusted VPN.

The session ends immediately for both people. Keys, messages and received files are discarded from memory and cannot be recovered. Files you already downloaded stay wherever you saved them.

Up to 500 MB per file. Files are sent in encrypted chunks directly to the other browser, so the speed depends on both connections. Very large files can be slow on phones with limited memory.

Yes. Once connected, either person can start a voice or video call, and the other person can accept or decline it. Calls use WebRTC’s built-in DTLS-SRTP encryption and go directly between your devices whenever the network allows. Your browser will ask for microphone and camera permission first.

Most failures are caused by strict firewalls or carrier-grade NAT that block direct peer-to-peer connections. Run the connection check to see what your browser and network support. Some corporate and mobile networks only work through a TURN relay, which the operator of the site can configure.

• Run the connection check

Each code works once and expires after 10 minutes. Ask the other person to generate a new code and enter it promptly. After several wrong attempts, code entry pauses for a few minutes to stop guessing.

Yes, in current mobile browsers. Keep NulBridge in the foreground during a session: mobile browsers may pause background tabs, which can drop the connection.