Hush Relay offers experimental self-hosted encrypted messaging via PHP

Valentyn Rukhaylo released Hush Relay on November 1, 2026, an experimental self-hosted messaging system designed for privacy-conscious users. The project combines a browser-based progressive web app with a minimal PHP relay server, allowing individuals to run their own encrypted communication channels without relying on third-party platforms or app stores.

What happened

The release introduces a lightweight alternative to mainstream messengers by stripping away traditional account systems and centralized infrastructure. The application consists of two primary components: a client-side web interface built with plain HTML and JavaScript, and a server-side relay written as a single PHP file. This architecture ensures that all cryptographic operations occur within the user's browser, while the server acts merely as a storage medium for encrypted data packets.

Users can deploy the relay on extremely modest hardware, including a $5 virtual private server, a Raspberry Pi, or even a spare Android phone running Termux. The system supports deployment on standard shared hosting environments, making it accessible to those without dedicated DevOps resources. The developer emphasizes that the tool is intended for everyday privacy and educational purposes rather than high-risk scenarios involving state-level adversaries.

Key details

• Zero-knowledge relay: The PHP backend stores encrypted messages but cannot read their content or identify the sender due to sealed sender techniques.
• No account required: Identity is derived from locally generated cryptographic keys, eliminating the need for phone numbers or email registration.
• Forward secrecy: The protocol implements a Double Ratchet algorithm, ensuring that compromised devices cannot decrypt previously captured messages.
• Cross-device migration: Users can transfer their identity to a new device by scanning a QR code and verifying a 12-digit safety number.
• Interoperable relays: Different users can operate their own relays in different jurisdictions, and these relays can communicate with each other.
• Experimental status: The code has undergone internal adversarial review but lacks independent audit by external cryptographers.

Background

End-to-end encryption ensures that only the communicating users can read the messages, preventing intermediaries from accessing the content. Hush Relay utilizes WebCrypto APIs within the browser to handle these heavy cryptographic lifts, a standard approach for modern web-based security tools. The "Double Ratchet" algorithm mentioned in the documentation is a well-known cryptographic protocol used by Signal and other secure messengers to provide forward secrecy. This means that if an attacker steals a session key, they cannot use it to decrypt past messages, as the keys evolve with every exchange.

The concept of a "dumb relay" is central to this design. In traditional messaging apps, the server often manages user identities, contact lists, and message routing logic. In Hush Relay, the server simply holds encrypted blobs of data until the recipient retrieves them. This reduces the attack surface significantly, as the server operator has no insight into who is talking to whom, beyond basic metadata like IP addresses and message timing. The use of PHP, a widely supported server-side language, allows this to run on almost any existing web hosting plan without specialized containerization or database setup.

Why it matters

For teams and individuals who self-host their software, control over communication infrastructure is a growing priority. Many organizations are wary of relying on proprietary messaging platforms that may change terms of service, suffer outages, or face regulatory pressure to hand over data. Hush Relay offers a way to maintain private communication channels using infrastructure the team already controls. Because it runs on standard shared hosting or low-cost VPS instances, the barrier to entry is remarkably low compared to building a custom chat solution from scratch.

However, the experimental nature of the project requires careful consideration. The developer explicitly warns against using this tool for high-stakes situations where physical safety or legal protection is on the line. Without an independent security audit, there may be undiscovered vulnerabilities in the implementation of the cryptographic primitives or the web interface. For IT managers, this presents a trade-off: the benefit of total data sovereignty versus the risk of using unaudited security software. It serves well for internal team chats or casual private conversations, but not for protecting sensitive intellectual property or whistleblower communications.

What you can do

• Test locally: Clone the repository and run the included serve script to test the interface on your local machine using two browser windows.
• Deploy on existing hosting: If you have a cPanel or Apache-based shared hosting plan, upload the web folder to try the relay without managing a server.
• Verify contacts: Always compare safety numbers with your contacts through a separate channel to prevent man-in-the-middle attacks.
• Backup recovery words: Write down the six-word recovery phrase provided during setup, as this is the only way to restore access if you lose your device.
• Monitor updates: Follow the repository for security patches, as the project is marked experimental and likely to undergo rapid changes.
• Assess risk: Do not use this tool for communications where failure could result in severe personal or professional harm.