How to Create a Password-Protected Chat Room on Shareli

By default, private rooms on Shareli generate a secure, random cryptographic key that is embedded in the URL. But what if you want to add an extra layer of human-verifiable security? You can now set a custom password for your private rooms.

Why Use a Password?

When you create a standard private room, the URL contains both the Room ID and the Secret Key (e.g., #12345:AbcDefGhi). If someone intercepts that full link, they can read the messages.

By setting a password, the URL only contains a flag indicating a password is required (e.g., #12345:pwd=1). You can safely send this URL over insecure channels (like a public Slack channel or a standard email) and send the password over a different channel (like an SMS or a phone call). Without both pieces, the data is completely unreadable.

How the Encryption Works (Zero-Knowledge)

When you set a password, Shareli does not send your password to our servers. Instead, we use your password in your web browser to generate an encryption key.

• Your password and the unique Room ID are combined.
• They are run through a cryptographic algorithm called PBKDF2 with 100,000 iterations to generate a strong 256-bit AES-GCM key.
• This key is used locally on your device to encrypt and decrypt all text and files.

Because the server only routes the encrypted data and never sees your password or the derived key, this setup is completely zero-knowledge and end-to-end encrypted.

How to Create a Password-Protected Room

1. Click the New Private button on the sidebar.
2. A prompt will appear asking for an optional password.
3. Type your secure password and hit "Create Room".
4. Share the URL with your colleague. When they open the link, the browser will ask them to enter the password before they can see any messages.

If you prefer the standard random key (which requires no manual typing), simply leave the password field blank when creating a room.

Total Privacy and Ephemeral Storage

Even with password protection, Shareli remains 100% ephemeral. There are no user accounts, no databases, and your password-protected room will automatically self-destruct along with all its data when the room timer expires.