ChatCrypt

A full-stack real-time chat application built with the MERN stack. Encryption is on the roadmap, not yet implemented.

---

Overview

ChatCrypt is a real-time messaging app with a Node.js/Express/MongoDB backend and a React (Vite) frontend. Messages are delivered live over Socket.io, users authenticate via JWT, and images are hosted through Cloudinary.

Current status: messages are stored and transmitted as plaintext. The server and database can read every message. Despite the project's name, no encryption is implemented yet — see Roadmap below for what's planned.

Features

• Real-time messaging — Socket.io-based live message delivery
• User authentication — register, login, and session management via JWT
• Image sharing — uploads handled through Cloudinary
• Responsive UI — React frontend styled for desktop and mobile

Architecture

ChatCrypt/
├── backend/
│   └── src/
│       ├── controllers/   # auth, message logic
│       ├── middleware/    # auth guards
│       ├── models/        # User and Message schemas (plaintext `text` field)
│       ├── lib/            # db, socket.io, cloudinary
│       └── index.js        # Express app entry point
├── frontend/
│   └── src/
│       ├── components/     # chat UI, sidebar, auth screens
│       └── App.jsx
└── package.json

Tech Stack

Layer	Technology
Runtime	Node.js
Framework	Express.js
Database	MongoDB (Mongoose)
Real-time	Socket.io
Frontend	React (Vite)
Auth	JWT
Media	Cloudinary

Getting Started

Prerequisites

• Node.js 18+
• A MongoDB connection string
• A Cloudinary account (for image uploads)

Installation

git clone https://github.com/tijaruS/ChatCrypt.git
cd ChatCrypt

cd backend && npm install && cd ..
cd frontend && npm install && cd ..

Environment Variables

Create a .env file in backend/ (do not commit this file — see Security Notes):

PORT=5000
MONGODB_URI="your-mongodb-connection-string"
JWT_SECRET="your-jwt-secret"
CLOUDINARY_CLOUD_NAME="..."
CLOUDINARY_API_KEY="..."
CLOUDINARY_API_SECRET="..."

Running the App

# backend
cd backend
npm start
# server runs on http://localhost:5000

# frontend
cd frontend
npm run dev

Security Notes

• No message encryption yet. Messages are stored as plaintext in MongoDB and sent as plaintext over Socket.io. Anyone with database or server access can read them.
• .env should never be committed. If a real .env was ever pushed to this repo, treat every secret in it as compromised: rotate the JWT secret, MongoDB credentials, and Cloudinary keys, and add .env to .gitignore.

Roadmap Toward End-to-End Encryption

Planned work to make this genuinely end-to-end encrypted (Signal-style):

• Generate a per-user identity keypair client-side on registration; private key never leaves the device
• Adopt a vetted protocol implementation (e.g. libsignal) for key agreement (X3DH) and per-message key ratcheting (Double Ratchet) instead of a static key
• Change the Message schema to store ciphertext only, with the server relaying blobs it cannot read
• Encrypt images client-side before upload, so Cloudinary and the server only ever see ciphertext
• Add key-verification UI (safety numbers) so users can confirm they're talking to the right device/identity

Author

Surajit Das — @tijaruS