Every room has a short code like K7P3XR. It's a label peers use to find each other for the WebRTC handshake. The code alone reveals nothing about the conversation.
The real secret is the passphrase. Your browser derives a 256-bit AES-GCM key from it using PBKDF2, then encrypts every message before it leaves your device. The server never sees the passphrase or the key.
When you create a room, the passphrase travels in the link's fragment (#key=…), which browsers never send to the server. Share the link and the recipient can unlock the room; without it, the conversation is unreadable.
Messages flow directly between browsers over encrypted WebRTC data channels. Nothing is stored on a server — when everyone leaves, the conversation is gone.
No accounts, no servers storing your words, and a key that never leaves the link. Keep the link private, and your conversation stays private.