SecureChat

A secure real‑time chat with AES‑GCM encryption, peer‑to‑peer calling, and a unique security layer that detects risky messages, impersonation, and scams to protect trust and community.

Comment

SecureChat — Hackathon Project

Inspiration

Encryption isn’t the problem — people are. Messaging apps focs heavily on protecting messages, but real‑world attackers rarely break encryption. Instead, they target users through phishing links, impersonation, and social‑engineering scams. A clear example is the WhatsApp Verification Code Scam, where attackers tricked users into giving away their login codes and then impersonated them to target their friends. One malicious message can lead to account takeover, financial loss, or exposure of private conversations.

Encrypted apps protect messages — but they don’t protect users.
So we built SecureChat: a trustworthy chat platform that delivers fully encrypted communication and actively protects people from the attacks encryption alone cannot stop.

What it does

SecureChat is a real‑time communication platform that protects both messages and people.

Core Features

  • End‑to‑end AES‑GCM encrypted messaging
  • WebRTC peer‑to‑peer audio/video calling
  • WebSocket instant messaging

Security Innovations

  • Risk‑Aware Message Analysis
    Explains why a message or link is dangerous and provides safe next steps.

  • Impersonation Detection
    Warns users when a new account closely resembles an existing friend.

  • Community‑Powered Protection
    Anonymous scam reports are shared with affected users without exposing private conversations.

SecureChat doesn’t just secure messages — it protects trust, identity, and community.

How we built it

We built SecureChat by combining real‑time communication technologies with a custom security layer designed to protect users from social‑engineering attacks.

Backend Architecture

  • Flask handles routing, authentication, encryption key exchange, and security logic.
  • Flask also serves as the WebRTC signaling server, managing SDP offers, answers, and ICE candidates.

Real‑Time Messaging

  • Implemented using WebSockets for instant, bidirectional communication.
  • Before delivering a message, the backend performs lightweight analysis to detect:
    • suspicious domains
    • risky patterns
    • impersonation signals

Peer‑to‑Peer Calling

  • Built with WebRTC, allowing audio/video to flow directly between users.
  • Our signaling flow ensures stable connections even across NATs.

End‑to‑End Encryption

Messages are encrypted using AES‑GCM.
We generate symmetric keys per conversation and ensure encryption happens before messages leave the client.
The server never sees plaintext.

Security Layer Modules

  • Risk‑Aware Message Analysis
    Domain reputation checks + pattern matching, designing impersonation detection that avoids false positives

  • Impersonation Detection
    Ensuring encrypted messages remain compatible with real‑time analysis

  • Community‑Powered Protection
    Anonymous reporting system that warns only affected users, building community‑powered protection without leaking private conversations

All warnings are generated without decrypting messages, preserving end‑to‑end privacy.

Challenges we ran into

  • Handling WebRTC signaling, ICE candidates, and NAT traversal
  • Designing impersonation detection that avoids false positives
  • Ensuring encrypted messages remain compatible with real‑time analysis
  • Building community‑powered protection without leaking private conversations
  • Managing encryption keys securely across devices
  • Balancing strong security with smooth user experience

Accomplishments that we're proud of

  • Combined encryption with user‑centric security
  • Real‑time phishing detection
  • Early impersonation warnings
  • Anonymous community scam alerts
  • Privacy‑preserving threat intelligence
  • Stable real‑time messaging and calling

What we learned

  • How WebRTC works behind the scenes
  • How to create signaling servers and ICE candidates for peer‑to‑peer communication
  • How to design security systems that protect people, not just data
  • How to balance usability with strong protection
  • Deep understanding of real‑world cybersecurity threats

What's next for SecureChat

We plan to expand SecureChat with:

  • Secure file sharing
  • AI‑powered scam detection
  • Multi‑device compromise detection
  • AI‑powered professional writing support

Built With

Share this project:

Updates

Submission history