Docs

Last edited: October 14, 2026

Private DMs on Vulture use end-to-end encryption to protect message text, images and reactions. Your browser encrypts their contents before sending them, and they are decrypted on your and the recipient's devices. The server stores the encrypted messages. Note that groupchats and Global chat are not end-to-end encrypted.

To access your encrypted messages, you create a Chat PIN containing 4–8 case-sensitive letters or numbers. This is separate from your account password and protects a backup of your private encryption key. Vulture stores that encrypted backup with your account, allowing you to restore access on another device by signing in and entering your PIN. The PIN itself stays in your browser.

Message contents are protected with AES-256 encryption, while Curve25519 allows the message encryption keys to be protected for both participants. Each message also carries an Ed25519 digital signature, which the receiving browser checks to verify the sender and detect tampering. Your key backup uses Argon2 to slow down attempts to guess its PIN, but a short or predictable PIN is still easier to guess.

Encryption protects what you send, but Vulture still needs delivery information such as the participants, timestamps and upload sizes. It also cannot prevent a recipient from copying or sharing a message. Reporting a DM shares a readable copy of that message and its attached images with moderators, without unlocking the rest of the conversation.

Resetting your Chat PIN or completing account recovery removes your access to previous encrypted DMs. Changing your PIN requires this same reset process. The other participant retains their access, and submitted moderation evidence is preserved. Ordinary password changes and incorrect PIN attempts do not remove your encrypted history.