XorChat help

Last revised: September 28, 2026.

Use XorChat in your browser to manage your account and open Encrypted Conversations. New private text, GIF and voice messages sent there are end-to-end encrypted between verified devices. Legacy room/direct-message history from before cutover remains server-readable and encrypted at rest; legacy rooms are read-only while encrypted group rooms are migrated.

Sign in and verification

Create an account with your own email address. Complete the eligibility and policy confirmations, then open the verification email before signing in. If it does not arrive, check spam and use Resend verification email. Only request a link for your own account.

For a forgotten password, use password recovery. Verification and recovery links expire and can be used once. Support will not ask for your password or recovery link.

Contacts, profiles and conversation controls

Use your account’s Contacts or Conversations controls to choose a person and open Encrypted conversations. Profile, availability, favorites, folders and other account tools remain separate from encrypted message content.

Encrypted Conversations includes + Add, My profile, Info, emoji, encrypted Winks, replies, reactions, editing, delete tombstones, the Fun/game library and voice recording. Reply references, reaction details, edits, delete tombstones and Winks are sent inside the encrypted private-message event content. Account/profile controls remain service metadata; game state is a separate server-stored activity and is not part of the message-E2EE claim. More also contains local switches for typing indicators and read receipts. Those signals are service metadata rather than encrypted message content.

A contact folder organizes your own list; it is not an encrypted group chat. Legacy room history remains read-only while encrypted group-room support is completed.

Encrypted GIFs and audio; separate legacy activities

In Encrypted conversations, use Media to choose a supported GIF or audio file. Selecting a supported file starts encrypted sending; check the result before choosing it again. The client encrypts the bytes before upload. Use Decrypt GIF or Decrypt voice message to load a received item on your device.

General document/file attachments are not available. The Voice message control records audio locally for review, then encrypts supported audio before upload. Encrypted Winks use the message-E2EE path. Games remain separate server-stored activity state.

Do not treat game state as encrypted message content: it is stored by the shared-activity service. XorWink message events, by contrast, use the encrypted private-message path before the animation is shown locally.

Calls and Remote Assist

Voice and Video controls are in the direct-conversation toolbar. Both participants need compatible browsers, device permissions and a working connection. Call history and missed calls are in Calls; notification and incoming-call settings are in Settings & privacy.

Remote Assist is beta. Request a screen-sharing session, wait for the other person to accept, and use the browser’s screen picker. Desktop control needs a compatible helper, a separate control approval and local permission on the sharing device. Revoke control or end sharing whenever necessary. Full two-device remote-control acceptance is still pending; do not treat this as unattended support. Never grant access to a person you do not trust.

Desktop and mobile betas

Use the web app for the verified private-message encryption flow. Native-app encryption compatibility has not completed equivalent acceptance. Windows, Linux and Android betas are listed in the download centre; check signing status, requirements and limitations.

The iOS build is at simulator-beta stage, not a public installable iPhone app. An available beta download does not establish E2EE feature parity.

Messages and connection problems

Choose a contact in Encrypted conversations, unlock your device and verify participant fingerprints. Enter sends; Shift+Enter starts a new line. If encryption, membership or verification is incomplete, sending stays blocked.

Use Reply or React on an encrypted message. You can Edit or Delete your own messages. When read receipts are enabled, the most recently acknowledged outgoing message can show Seen. Typing indicators and read receipts reveal activity metadata to the service and can be disabled under More. Delete sends an encrypted tombstone that tells participating clients to hide the content; it does not promise immediate erasure of ciphertext that has already entered normal server retention or backups. If a send fails, your text remains in the open composer. Keep the page open and check delivery before sending again. Do not assume the encrypted view’s unsent draft survives a refresh, browser shutdown, lock action or cleared browser storage.

Only one tab can own the same encryption store at a time. Lock or close the other encrypted-chat tab before opening encrypted chat here. A missing or damaged device token fails closed: XorChat does not silently replace the device or fall back to plaintext.

A replayed or altered encrypted event may be rejected instead of shown. For persistent errors, contact support with the page, time and error message—not message keys, previous migration passphrases, recovery passphrases, recovery files or unrelated private content.

Report, block and notification controls

Use the report control beside a message to report content. Use Conversations and the block controls to restrict a contact. Settings & privacy includes notification and call preferences; desktop alerts also require browser permission. Encrypted conversations show local New badges for activity you have not opened on this browser. Mark unread in Conversation Info adds a local-only unread marker and does not revoke a read receipt already sent. The local unread markers store only room state/timestamps, not message text. With desktop alerts enabled and message previews disabled, the notification says only New encrypted message. Enabling message previews places decrypted preview text on the browser/operating-system notification surface. Mute/Unmute and Archive/Restore are available directly in Conversation Info and update your existing account metadata. Archived conversations are available from the Archived contact filter. Muting a contact suppresses its desktop alerts without hiding the local unread badge. Copy on a text message places decrypted text on the operating-system clipboard only after you explicitly choose it; clipboard contents are outside XorChat message E2EE. Blocking is not an emergency response. If there is immediate danger, contact your local emergency service.

Export or delete your account

In Settings & privacy, use Export or permanent account deletion and enter your current password. Read the deletion confirmation carefully. Deleting an account does not itself cancel a separate paid subscription; contact billing@xorvaniq.ca for subscription help. See the privacy and retention information for retained safety records and backups.

Contact support

support@xorvaniq.ca for access or technical problems; abuse@xorvaniq.ca for safety reports; privacy@xorvaniq.ca for privacy requests. Include the affected page, approximate time and a short description. Do not include passwords, verification links or unrelated private messages.