Private Chat, Panic Close and Dead Drops

Choose a direct room or an encrypted group chat

A Strumio direct room has capacity for two participants. It fits a private back-and-forth conversation between a creator and one invited person. A group room supports up to 20 participants when a small team needs to discuss sensitive information without placing readable message content in an ordinary chat archive.

Chat messages are encrypted and decrypted in each participant's browser with AES-256-GCM. The room key is carried in the fragment of the complete invitation URL. Under normal browser behavior, that fragment is not included in requests to the server, but anyone who receives the complete URL may have the material needed to decrypt room content.

Direct rooms support two participants.
Group rooms support up to 20 participants.
Participants choose display names when they join.
Valid new participants can receive the active encrypted conversation history.

Protect and share the complete conversation link

The creator shares one complete invitation link with participants. Because its URL fragment contains the room key, the complete link should travel through a channel the creator trusts. Posting it publicly, storing it in an exposed ticket, or forwarding it to the wrong person can grant access to someone the creator did not intend to invite.

A creator can add an optional room password. The browser derives password-verification material before sending it, and the API does not accept the plaintext room password. The password is an additional access barrier, not a replacement for protecting the invitation link. Share it separately when the situation warrants a second channel.

For an in-person handoff, the creator can show or download a QR code for the complete active-room invitation. Strumio generates this code locally in the browser without sending the invitation to a remote QR service. Scanning it opens the same invitation, so room capacity, password, expiration, Panic Close, and creator-ending controls work exactly as they do for a copied link.

Treat the full invitation URL as sensitive.
Treat a QR code for the complete invitation as sensitive too.
Verify participants through a known contact method when identity matters.
Use the optional password as an additional barrier.
Do not assume a display name proves a participant's identity.

Understand room expiration, ending, and disappearing history

Rooms last 24 hours by default and can be configured for a shorter period or for up to seven days. The creator can also end a room before its scheduled expiration. When a room ends or expires, later room access is rejected and cleanup removes its server-side room records through the implemented lifecycle.

This makes Strumio useful for temporary messaging and disappearing conversations, but deletion has a boundary. Ending a room cannot erase text someone copied, screenshots someone captured, or files someone downloaded. Participants should avoid sharing information whose risk cannot be reduced after another person sees it.

Expiration limits how long the active room remains available.
The creator can end the room for every participant.
Room ending and expiration remove access to the Strumio conversation.
No chat service can recall copies already stored elsewhere.

Use Panic Close to revoke your own participant session

Panic Close is a fast local exit for the participant who activates it. Strumio requests immediate revocation of that participant session and clears the room's in-memory and session data on the current device. For a creator, it also removes that room's local recovery record from the current browser.

Panic Close is intentionally different from the creator's End control. Other participants can continue using the room after one person panic-closes. The control also cannot erase messages, screenshots, downloads, clipboard contents, or other copies that already left the current Strumio session.

Panic Close revokes the current participant, not every participant.
It clears local in-memory and session data for that room.
A creator uses End when the whole room should close.
Previously copied or downloaded information remains outside its reach.

Share encrypted files with standard or Dead Drop access

Chat attachments are encrypted in the sender's browser before upload. A standard encrypted attachment remains available while the room and attachment remain active. A Dead Drop adds an access limit so the sender can choose how many successful claims are permitted.

Each successful Dead Drop claim counts toward its limit. The final permitted claim atomically locks the attachment against later access and queues the stored encrypted object for deletion. That protects against additional retrieval from Strumio, but it cannot delete a file that a permitted recipient already downloaded, copied, or saved.

Files are encrypted before upload and decrypted in the recipient's browser.
Dead Drop access limits apply to successful claims from Strumio.
The final allowed claim prevents later claims and starts the deletion workflow.
Use revocable credentials inside files when post-download control is important.

Match the Strumio feature to the sharing job

Use a SecretLink for one focused delivery, especially when one-time retrieval, a short expiration, an encrypted file, or one encrypted reply is enough. Use private chat when two people need temporary back-and-forth messaging. Use group chat when a small invited group needs the same temporary encrypted conversation.

Use Dead Drop when limiting future attachment claims is more important than keeping a file available throughout the room. Use Panic Close when you need to remove your current participant session quickly, and use the creator's End control when the entire room should become unavailable. These controls reduce different risks and work best when participants also protect devices, links, and downloaded information.

Related guidance

When an encrypted delivery link is appropriate, Create a free Strumio account.