Thumbnail

R0TT3D

Sergio Yazdi & Ian Hoell

Inspiration

We wanted to make encrypted messaging feel less intimidating and more fun to explore. The RowdyHacks XII heist theme was a natural fit, so we built a vault-inspired chat app featuring playful heist-themed language, silly BrainRot, and a crew of AI heist operators.

What it does

R0TT3D is a browser-based messenger where end-to-end encryption is on by default for every one-to-one chat. Messages are encrypted on your device before they’re sent, and the Matrix server relays ciphertext that only chat participants’ devices can decrypt. You create an account with a 24-word recovery phrase, find friends by username, and can optionally verify a device by matching a set of emojis. Messages can wait for someone to come back online. After a message is decrypted, it’s saved in encrypted local history. Senders can see when it’s been received, and it’s marked read after it’s displayed.

The message viewer also lets you peek at the encrypted server payload in RotCode, our brainrot-inspired encoding for Matrix ciphertext.

Alongside those encrypted chats, there are nine Gemini-powered heist NPCs. They’re a separate experience: NPC messages go through our platform to Google Gemini and are not end-to-end encrypted.

How we built it

The client is built with React, TypeScript, and Vite. We use the Matrix JavaScript SDK and its Rust/WASM crypto engine for encrypted rooms and device keys. A self-hosted Synapse server handles accounts and message delivery, PostgreSQL stores its data, and Docker Compose runs the demo stack.

We built RotCode as a versioned codec and wired it into the Matrix message flow. The browser also encrypts saved chat history with AES-GCM. NPC replies use a separate server-side Gemini integration, which keeps the API key out of the browser.

Challenges we ran into

The trickiest part was figuring out what “sent,” “received,” and “read” should actually mean when messages are encrypted and people go offline. A message showing up on your screen doesn’t mean it reached the other person, so we added encrypted delivery acknowledgements and made read status depend on the message being decrypted and shown. We also had to sort through key backup, recovery, device changes, duplicate events, and receipt timing.

On the product side, we iterated on scrolling, spacing, responsive layouts, and making security state understandable without letting it overwhelm the chat experience.

Accomplishments that we’re proud of

We got a working end-to-end encrypted messenger running and gave it a personality. It brings together username discovery, emoji-based device checks, encrypted chat history, delivery indicators, and nine NPCs with their own voices.

We’re especially happy that people can open a message and see the server payload rendered in RotCode. It makes a part of encrypted messaging that ususally happens behind the scenes feel a little more hands-on.

What we learned

We learned that building a messenger is about a lot more than encrypting text. People also need to manage devices, recover accounts, rotate keys, send messages while someone’s offline, and understand what’s happening without fighting the interface. Getting all of that to work together was a big part of this project.

What’s next for R0TT3D

We want to make account recovery work more smoothly on a new browser, improve the chat experience, and explore more ways to configure the AI characters. We’d also like to host R0TT3D on a public domain with the proper protections in place.