New session / 6-digit code
Connect with a 6-digit code
One of you gets six digits. The other types them in. Your browsers then connect directly, end-to-end encrypted. No account, nothing stored.
Ready
Six digits. One use. Ten minutes.
Get a code, then read it out or send it. Keep this tab open until the other person types it in.
- No account
- Nothing stored
- End-to-end encrypted
Ready
01How it works
One code. Two screens.
The code only helps your browsers find each other. Messages, files and calls then travel peer-to-peer, end-to-end encrypted.
Get a code
One of you opens Get a code. Six digits appear on screen.
Share it
Read it out or send it. It works once, for 10 minutes.
Type it in
The other person opens Enter a code and types the six digits.
Compare
Both screens show a safety code. Check that the two match.
Before anything sensitive
Compare the safety code
Six digits are quick to share, but short. Once you’re connected, both screens show a safety code like 4F2A-9C1B-77DE. Read it to each other on a call or in person. If the codes match, nobody is in the middle.
| Stores | The code and a random peer ID |
|---|---|
| Lifetime | 10 minutes, one use |
| Wrong codes | 10 per 10 minutes per network, then a pause |
| IP address | Salted hash for rate limits, deleted after about an hour |
| Messages & keys | Never sent to it |
No code needed
Prefer a link?
A private link carries a 256-bit secret, so there is nothing to guess and no code service involved. Send it through any channel you trust.
02Questions
About 6-digit codes
01My 6-digit code says it was not found or has expired.
Each code works once and expires after 10 minutes. Ask the other person to generate a new code and enter it promptly. After several wrong attempts, code entry pauses for a few minutes to stop guessing.
02What is the safety code, and should I check it?
After you connect, both screens show a 12-character safety code. If the connection has not been tampered with, the two codes are identical. Compare them with the other person over a separate channel, such as in person or on a phone call. Matching codes mean nobody is sitting in the middle of your session. Checking matters most when you connect with a 6-digit code.
03Can NulBridge or its servers read my messages?
No. Encryption keys are created and kept in your browser and are never sent to any server. The signaling server only relays the connection setup, such as network addresses and public keys, and the 6-digit code service only stores which code points to which waiting session. Codes stop working after 10 minutes and are deleted shortly after.
04Does NulBridge work on phones?
Yes, in current mobile browsers. Keep NulBridge in the foreground during a session: mobile browsers may pause background tabs, which can drop the connection.