01
Install and open BurnerChat on your machine
Linux: .deb / AppImage / tarball. macOS: app / DMG. The UI binds to loopback by default (127.0.0.1). Remote UI on LAN is opt-in and separate.
Product walkthrough
BurnerChat encodes messages into opaque tokens on your machine, then lets you choose how (or whether) to deliver them: hand the token offline, push via an optional Tor mailbox, or send to a paired peer on LAN Direct. This page explains every step and lets you click a fake UI so you can see the product shape before installing.
What you get
The mock below only simulates a slice of the UI. The shipped BurnerChat binary on Linux and macOS includes the full surface described here.
Compose plaintext locally. The app derives a token (Argon2id + ChaCha20-Poly1305 in the real build). You can copy the token and move it however you like — USB, Signal, paper — without ever enabling Tor.
Optional. Start Tor, publish a mailbox onion to a contact out of band, send tokens through the mailbox. Peers decode only with the right key material. Tor inactive ⇒ Tor paths refuse to send/decode.
Authenticated TLS 1.3 delivery to a paired peer on a selected LAN or private-tunnel interface. Disabled by default. Explicit per send — never a silent Tor fallback.
Large files become opaque .cryptshare blobs with password tokens. Extract path is hardened against zip-slip. Direct file streaming lands in a receiver-owned inbox.
Save peers with Tor mailbox credentials and/or LAN Direct pins (Ed25519 identity). Pairing is out of band — QR / manual paste — not automatic discovery.
Linux Leak Tests and Harden helpers check DNS / posture / ports. Session hygiene warnings remind you about extensions, screen share, and profiling risks on remote UI.
Operator path
This is the real product flow. In the interactive mock, Encode / Decode / Send buttons only simulate outcomes so you can see the screens without installing Go or Tor.
Linux: .deb / AppImage / tarball. macOS: app / DMG. The UI binds to loopback by default (127.0.0.1). Remote UI on LAN is opt-in and separate.
My ID shows a per-install device key. Give it to a peer through a channel you already trust (in person, existing messenger). It is not a Tor onion and not a password for your disk vault.
Paste their pairing blob (bc1://…onion?t=… style in the real app) and optionally pin a LAN Direct endpoint. Tor credentials and LAN pins are independent.
Type plaintext → Encode. You get an opaque token. At this point nothing has left your computer. You can stop here and move the token yourself.
Tor mailbox if both sides have Tor up and paired. LAN Direct if you share a network and completed Direct pairing. The UI will not silently switch transports.
Inbox / Receive → Decode. Plaintext appears only on their machine. LAN Direct can also “Use” an inbox item into Messages. Notifications (if enabled) stay generic — no sender names or previews by default.
Transport choice
Pick based on threat model. Neither replaces the other; both are optional relative to offline token handoff.
| Dimension | Tor mailbox | LAN Direct | Offline token only |
|---|---|---|---|
| Network exposure | Onion service path; Tor required on both ends | Peer/network sees IPs, timing, size | Whatever channel you use to move the token |
| Default state | Tor inactive until started | Receiver disabled until enabled | Always available after Encode |
| Pairing | Mailbox / onion credential out of band | Ed25519 pin + endpoint / CIDR profile | Device key understanding only |
| Silent fallback | Never. Real app refuses to cross transports without an explicit user action. | ||
| Best for | Remote peers, stronger metadata hiding | Same LAN / WireGuard CIDR you already trust | Air-gap, USB, or existing messenger |
Trust boundary
What the product promises — and what it does not. Demo pages cannot prove cryptography; install the real binary to exercise it.
Interactive mock · fake keys, tokens, and peers · follow the coach text on each tab
Simulated. Real builds never upload this key. Phone remote UI shows the same key for the same instance — it is not a second identity.
Tor mailbox send/decode in Messages will refuse while Tor is inactive — same as the real app.
Call media uses that tool’s network — not Tor. Leave blank to disable calling.
~/.burnerchat/ · macOS Application SupportReal crypto: Argon2id KDF + ChaCha20-Poly1305 (documented as xchacha_* aliases in older notes). This demo only base64-wraps a JSON stub.
Tor-required tokens refuse decode when Tor is down in the real app. Demo decode always works for bc1tok.demo.v1.* so you can see the plaintext panel.
Revoke / rotate mailbox bearer tokens exist in the real app (atomic, restart-safe). Not simulated here.
Authenticated, interface-scoped listener. TLS 1.3 + pinned peer identity. Not anonymous.
.cryptshare blobDemo does not read disk or upload. Packaging, digests, and quotas exist only in the installed binary.
Only when you need remote mailbox delivery. Keep it off for pure offline token exchange. Confirm both peers show TOR ACTIVE before Tor sends.
Same subnet or shared private tunnel you already operate. Pair pins first. Enable receiver deliberately. Disclose to users that Direct leaks network metadata.
Opt-in listener (e.g. port 18765) for viewing this instance on a phone. Prefer tunnel; use pairing tokens; watch hygiene warnings (extensions, screen share).
BurnerChat is built for operators who want local-first messaging with optional anonymity networks — not a hosted chat SaaS. Development is tracked in the project sprint backlog (extract safety, release gates, direct delivery, UI hardening).
Supported runtime: Linux and macOS. Windows runtime ended (legacy tree only). Public macOS notarized DMG is a release gate on Apple hardware.
Demo donate placeholders (not real wallets — do not send funds)
bc1qexampledemobtc00000000000000000000000xExamp1eDemoEthAddress0000000000000000004DemoMoneroAddressNotReal000000000000000000000000000000000000000000000000000000000000DemoSoL1111111111111111111111111111111111111Closed beta
Public installers are not linked from this page yet. Builds are scrubbed for host paths and PII before any Release upload. Until that pipeline is public, request access on Discord.
When public Release assets exist, this section will point at checksummed packages only — never a raw laptop folder upload.
FAQ
Straight answers. Expand any item.
No. It is a static marketing + educational mock for Cloudflare Pages. The real app is a local Go binary with an embedded UI, Tor integration, CryptShare, and LAN Direct.
No. Encode produces a decorative bc1tok.demo.v1.* string. Treat every token and key on this page as fictional.
No. Offline encode + manual token handoff works with Tor off. Tor is for mailbox delivery when both peers choose it.
No. It authenticates peers and encrypts the application payload, but the network path still sees endpoint IPs and traffic patterns. Use it when you already trust the LAN/tunnel topology.
Request beta access on Discord — DM nancarrowm (see Beta access). Public GitHub/GitLab Release links will appear here only after packages pass the release PII/path scan.
Yes. Upload index.html (this folder) to Cloudflare Pages with no build step, or any static host. Attach your custom domain in the Pages dashboard.