Zero-Trust Mission

About Zevra

A zero-knowledge encrypted chat platform engineered by Bazil Suhail to make private communication accessible to everyone. No compromises. No backdoors. Just pure mathematics.

Auth

SRP-6a

Cipher

AES-256-GCM

Exchange

X25519

Telemetry

None

SRP-6aX25519Ed25519AES-256-GCMPBKDF2 · 100KAES-KWDouble RatchetZero TelemetryClient-Side OnlyForward Secrecy
SRP-6aX25519Ed25519AES-256-GCMPBKDF2 · 100KAES-KWDouble RatchetZero TelemetryClient-Side OnlyForward Secrecy
Our Mission

Privacy Should Not Be a Luxury

Zevra was created by Bazil Suhail to solve a fundamental problem: private communication shouldn't require a cryptography degree. Our zero-knowledge architecture seals every message and file on your device before it ever reaches a relay — proving that real privacy and a smooth UX can coexist cleanly.

How Zevra Protects You

Zero-Trust, Zero-Knowledge

Payloads are sealed with AES-256-GCM. Session keys are agreed with X25519 and signed by Ed25519. Authentication runs over SRP-6a, so the password itself never crosses the network — and even a total server compromise reveals no plaintext.

0K+

Active Privacy Users

0M+

Encrypted Messages

0+

Countries Served

0

Data Breaches

The Stack

The Technology Behind Zevra Chat

Every component of the encryption stack is purpose-built for zero-knowledge, real-time communication.

SRP-6a Authentication

Secure Remote Password (RFC 5054, 2048-bit MODP) means your password never travels the network. Only a cryptographic verifier reaches the server, and it is useless to an attacker without an offline dictionary break.

X25519 / Ed25519 Keys

Every session mints ephemeral X25519 key pairs, signed with long-lived Ed25519 identity keys. Private key material is generated and kept inside the device keystore — never uploaded.

AES-256-GCM Sealing

Messages and files are sealed with authenticated encryption: a fresh 12-byte IV per message, 128-bit auth tag, and any bit-flip in transit is rejected before your client ever renders it.

Stateless Multi-Node Relay

Redis Pub/Sub and BullMQ workers keep delivery sub-10ms while nodes stay disposable. Session state lives in Redis, so any node can serve any request and scaling out is a restart.

Zero-Knowledge by Construction

The relay routes sealed blobs it has no key for. A full database dump yields ciphertext, hashed usernames, and room IDs — nothing that describes what you actually said.

Open Source & Auditable

Every primitive ships from audited libraries (@noble/curves, @noble/hashes) plus the native Web Crypto API. Trust is derived from code you can read, not from a policy page.

Also In The Box
Group E2EEDouble Ratchet forward secrecyEphemeral in-memory storageSelf-destructing buffersPeer-to-peer meshWebRTC + LiveKit callsReal-time presence & receiptsZero telemetry
Threat Model

What the Relay Can — and Cannot — See

What the server sees
  • Encrypted ciphertext (base64)
  • IV + auth tag (base64)
  • Username (hashed)
  • Room / channel IDs
  • Connection timestamps
What the server never sees
  • Plaintext messages
  • Encryption keys
  • Message content
  • File & media content
  • User passwords
  • Key exchange parameters
  • Call audio / video streams
Built With

The Full Stack, Line by Line

Frontend

Next.js 16 · React 19 · TypeScript 5

Styling

Tailwind CSS 4 · Motion (Framer)

State

Zustand 5 · persisted locally

Real-Time

Socket.IO 4 · WebSocket transport

Client Store

Dexie 4 · IndexedDB

Cryptography

Web Crypto · @noble/curves · @noble/hashes

Voice / Video

WebRTC P2P · LiveKit SFU fallback

3D / Shader

OGL · Plasma background

Scrolling

Lenis smooth scroll

HTTP

Axios · token interceptors

Linting

OxLint · TypeScript strict

Runtime

Bun 1.3+ · Node 18+

BS

Bazil Suhail

Creator & Lead Developer

The Vision

Built with a Privacy-First Vision

Bazil Suhail created Zevra with a clear conviction: everyone deserves access to truly private communication. The architecture was designed from the ground up on battle-tested protocols — SRP-6a, X25519, Ed25519, AES-256-GCM — so that no trust is ever placed in the server.

The result is a platform where your identity, conversations, and data remain exclusively yours. No surveillance. No data mining. No compromises.

Ready to Experience True Privacy?

Free, open source, and mathematically verified. Every message you send is sealed before it leaves this device.