Zwisper

欲说还休。私密便笺藏在你的应用消息中。端到端加密。

Say it without saying it. Keep chatting where you already are. The words everyone sees stay normal. The note only your contact can read rides inside them, encrypted, and opens by itself on their side. No new app, no new group chat, and nobody has to switch. WRITE On the sites you turn Zwisper on for, such as Gmail, Slack or WhatsApp Web, focus a text field and a small "Hidden note" pill appears. Pick a contact or a one-time password, type the note, and it is folded into the message you had already written as zero-width characters. The visible text does not change by a single letter. Before you send, Zwisper checks that the editor actually kept the note, and tells you plainly if it did not. READ Zwisper looks for notes on the pages you open. A message carrying one gets a purple underline, and the toolbar icon shows how many are on the page. Notes from your contacts open on the page by themselves and are marked verified. A note from anyone else asks for the password they gave you. CONTACTS One shared key per person. Your contacts are encrypted on disk under a master passphrase you choose, and the keys are held in memory only while the vault is unlocked. It locks itself again after a timeout you set. SITES YOU CHOOSE Zwisper works only on the sites you choose, and on none until you do. When you install it, a welcome page lets you pick yours: Gmail, Outlook, Slack, WhatsApp Web, Teams, Discord and more, or any address you paste. Chrome asks you once to allow exactly those. On any other site Zwisper stays off and cannot read the page, until you turn it on there from the side panel. Settings lists every site and takes any of them back. A ONE-MINUTE TOUR The welcome page ends with a practice chat that uses the real thing: open a hidden note with its password, then hide one in a reply of your own. Nothing in it is sent anywhere. REVEAL LINKS For people who have not installed Zwisper, you can send a link instead. The message text travels in the link's fragment, which browsers never send to a web server, and the note is decrypted in the reader's own browser. PRIVACY There is no server and no account. Your notes, your contacts and your settings never leave your device, and nothing is ever sent from the pages you use Zwisper on. The one thing Zwisper sends is a crash report when its own panel or background breaks: the error and where in Zwisper's code, never a note, a contact, a password or a page address. You can turn crash reports off in Settings. There is no analytics and no advertising. Notes use Zwisper's own authenticated format: Argon2id key derivation, AES-256-GCM encryption, and an optional Ed25519 signature so a note can be cryptographically attributed to the sender. CONVERSATIONS When both people have Zwisper, a back-and-forth becomes a forward-secret conversation: each message advances the keys, so a message stays private even if a later key is compromised, and messages that arrive out of order or go missing still open. This runs entirely between the two devices, with no server. HONEST LIMITS Zwisper is private, not invisible to a determined adversary, and it is worth knowing exactly where the edges are. A screenshot of a message destroys the note inside it. Some platforms strip zero-width characters when you hit send, which is why the compose card checks the editor and why reveal links exist. And a platform can tell that a message carries invisible characters even though it cannot read what they say. Zwisper is for keeping a note between two people in an ordinary conversation. It is not a tool for hiding from an adversary who is actively looking.