What Obleevo protects you from, and what it does not
A plain account of what Obleevo is built to resist and where its protection ends. Nothing here promises that it holds against everything: it is what the design does, and what it leaves to you.
1. What it protects against
The server reading what you share. Messages, files, voice, screens and notes are encrypted end to end between browsers by WebRTC, then a second time with post-quantum keys (a hybrid of X25519 and ML-KEM-768, with AES-256-GCM). The server only introduces browsers to each other; it never holds a key.
People watching the network. Your Wi-Fi, your internet provider, and the relay that carries a connection when a direct one is not possible see encrypted bytes they cannot read.
Recorded now, decrypted later. The post-quantum layer is there so that traffic captured today stays sealed even against a future quantum computer.
A stolen or seized server. There are no accounts, no database and no stored files or messages: a room lives in memory and is gone when it ends. Taking the server yields the code - which every browser receives anyway - and counts per day. A server taken while running also holds, in memory, the rooms and addresses open at that moment, along with its system logs.
Metadata, kept to a minimum. No access log, no cookies; an IP address is held in memory only while its connection is open, and a room code only while its room exists. The privacy notice lists all of it.
2. What it does not protect against
A compromised device. Malware, a hostile browser extension or someone holding your unlocked phone sees what you see. Obleevo warns when something changes its page, but something that only reads it leaves no trace.
The people you share with. A recipient can take a screenshot, photograph the screen, keep a file or pass it on. View once and burning limit what stays on their screen, not what they decide to keep.
A first visit served by a hostile server. The code that encrypts comes from the server. If the server is hostile the first time a browser opens Obleevo, there is no older copy to check it against.
A build aimed at one person who never had the app. A server can hand one visitor different code. The Verify page, and comparing its fingerprint with someone else’s, can reveal that afterwards; it cannot prevent it.
Timing and size. The server and the relays see when you connect, from which address (Hide my IP replaces it with the relay’s), for how long, and roughly how much passes - not what it is.
No independent audit yet. Every review on the Security audits page was done internally, by us, and so are our tests. No outside firm has audited Obleevo.
3. Not an anonymity tool
Obleevo keeps what you share out of reach, ours included. It does not hide that you used it, and it is not made for escaping the law; illegal uses are forbidden by the Terms.
What remains traceable. The server and the relays see your IP address while you are connected. Cloudflare, the host and other providers keep their own records. Your internet provider sees that you connect to obleevo.com. The people in the room can keep what you send and can testify. A seized or compromised device can hold traces. Police have other means of investigation.
What does not exist on our side. No accounts, no content on our servers, no log of who talked to whom, and nothing about a room that has ended. Section 20 of the privacy notice gives the full list, both ways.
4. Signed updates, and their limits
From v1.41.0, the statement published for each release - the fingerprint of every file it serves - is signed with a key the owner keeps offline. The server never holds that key, so a hacked server cannot sign the code it serves.
Once Obleevo has been opened in a browser, the app keeps its code there and runs it from there. New code arrives only as a new version, and the copy you already have checks it before trusting it: signed with the key built into the app, newer than yours, its files the ones the signature covers. Then it says “New version verified”. Otherwise it tells you to close Obleevo, does not reload the page, and removes the new version from the browser as far as a page can. When the server does not answer the check, it says it could not check - not that something is wrong.
The secure preview (v1.42.0) is held to the same rule. The frame a received file is shown in takes nothing from the server on trust: the app writes the frame’s whole document itself, and each script the frame loads - and pdf.js’s worker, which the app checks before handing it over - must match a SHA-384 hash the app holds. Anything else is refused and never run, with a message that says why. The limit is the app’s own: those hashes are only as trustworthy as the copy of the app that holds them, so a first visit served by a hostile server is not protected here either.
The limits. A browser installs a new version whatever the page thinks: a page can detect it and undo it, not block it. A server that answered the browser’s request for the new version differently from the page’s check, while a genuine newer version exists, could slip past; that takes deliberate work against one person, and the Verify page checks again. The first visit in a browser, a private window, or a visit after burning a room or clearing the site’s data (both erase the installed copy on purpose) starts with nothing to check with. And a signature says who released the code, not that the code has no flaws.
The key built into the app changes only through a version signed with the previous key. Nothing the server sends - a file, a header, an address - can change it.
5. Check it yourself
The Verify page hashes every file in your browser against the published list, checks that list against its release statement, timestamped in Bitcoin by OpenTimestamps, and from v1.41.0 checks the statement’s signature - with the ssh-keygen command to check it on your own computer. Comparing the fingerprint it shows with someone on another device and network tells you whether you were both served the same code.
Found a way around any of this? Tell us first.
Last reviewed:
About · Work with us · Tutorials · Why this · FAQ · Terms · Privacy · Accessibility · Cookies · Security · Security audits · Vault format · Contact · What’s new
Obleevo is developed by The House of Brendrof. Proprietary software, free to use.