Handbook

How QxChat works, written down for people who want to check. Start with the first two pages; the rest is the protocol reference, byte for byte.

Start here

Accounts, rooms, friends and devices: what QxChat does and what the server can see.

One Rust program, one TOML file, SQLite or PostgreSQL. Install, configure and update.

Server modules, the two transports, what lives in memory and what is stored.

Passwords, 12 recovery words, Argon2id hashing and session tokens.

WebSocket operations, room lifecycle and the AES-256-GCM message envelope.

Add-only friend requests through blind mailboxes the server cannot link.

Syncing your devices through a relay that stores and reads nothing.

Device keys, room-scoped keys and hybrid ECDSA P-256 + ML-DSA-65 signatures.

Every hash, KDF, key size and wire format, byte for byte.

Rate limits, anonymous quota tokens, the proof-of-time challenge and CAPTCHA.

What shipped compared with the original design, listed openly.