Can you use an encrypted messenger without installing an app?

Q: Is browser-based encryption as safe as an installed app?

It is a genuinely harder trust model: a browser client is re-delivered by the server on every visit, so you are trusting the server each time, while an installed app is fetched once and verified by an app store — the higher-assurance tier. Good mitigations include serving the client from a locked-down origin with a strict content-security policy, making no third-party requests, and running the same audited-style cryptographic code path (for Sendant, the same WASM-compiled X3DH and Double Ratchet code as its native app). Sendant has not yet been independently audited; an audit is planned. If you face a sophisticated adversary, install the app; the browser is the low-friction tier.

Q: What is the difference between an ephemeral chat room and a messenger?

Persistence. An ephemeral room (Chitchatter, LOCK.PUB and similar tools) gives you an encrypted conversation that exists only while the page is open: no durable identity, no contact list, no message history, and usually both people must be online at the same time. A messenger gives you a persistent identity, saved contacts, message history, and delivery to people who are offline when you hit send.

Locked-down work laptop, library computer, borrowed phone, an iPhone where another app isn't happening — there are plenty of good reasons to want end-to-end encryption with nothing to install. Here's an honest survey of what actually exists.

Direct answer: yes — but almost every no-install option is an ephemeral chat room, not a real messenger. As of 2026, only one identifier-free messenger offers a persistent, full-featured client that runs entirely in the browser: Sendant. Ephemeral rooms like Chitchatter are genuinely good for one-off conversations; the "web versions" of WhatsApp and Signal secretly require the phone app anyway; Wire's real browser client requires an email account.

Last updated July 6, 2026 — WhatsApp linking now offers a code option alongside QR; Chitchatter/LOCK.PUB re-verified. Living page — corrections welcome.

Option 1: the ephemeral room tools

Tools like Chitchatter and the LOCK.PUB class of encrypted-room sites deserve real credit. They are genuinely end-to-end encrypted, need no account of any kind, and the whole experience is: open a URL, share it with the other person, start talking. For a one-off sensitive conversation — a journalist taking a first contact, two people who need ten private minutes — they're excellent, and they're the fastest path to encryption that exists.

The honest limits are structural, not flaws: the room is the product. There's no persistent identity, no contact list, and no message history — close the tab and the conversation is gone. In most of these tools both parties need to be present at the same time, because there's nowhere for a message to wait. That makes them ephemeral rooms, not messengers. If you'll ever want to message the same person twice, you'll feel the gap immediately.

Option 2: the "web version" that needs an app anyway

This is where most people get caught. WhatsApp Web looks like a browser messenger, but it only unlocks after you link it to a phone that's already running the WhatsApp app (by QR scan or a one-time code) — no installed app, no WhatsApp Web. Signal Desktop is one step further from no-install: it's itself an installed application, and it too must be linked to a phone already running Signal. (Signal has no browser version at all, and has said it won't build one — full explainer: does Signal have a web version?) Threema's web and desktop clients follow the same pattern, linking to its paid phone app.

None of this is a criticism of those products — the companion model is a deliberate security choice, and all three are solid encrypted messengers. But call it what it is: these are companions to an installed app, not no-install messengers. If you can't install the phone app, the "web version" is a locked door.

Option 3: the web client that needs an account

Wire is the closest thing to an exception among the established players: it has a real, standalone browser client that doesn't piggyback on a phone. It's a polished, well-regarded product. The catch is registration — creating a Wire account requires an email address, so while it clears the no-install bar, it doesn't clear the no-identifier bar. If your goal is simply "encrypted messaging in a browser" and an email address doesn't bother you, Wire is a legitimate answer. If the identifier is the problem, it isn't.

Option 4: the persistent no-install lane

This is the lane Sendant occupies, and as far as we can tell it occupies it alone: it is the only identifier-free messenger with a persistent, full-featured no-install browser client. Open app.sendant.io and you get a real messenger — persistent identity, contact list, message history, delivery to people who are offline via an offline mailbox — with no phone number, no email, and no account. Your identity is a cryptographic key generated on your device. The browser client runs the same WASM-compiled X3DH + Double Ratchet crypto path as Sendant's native app, and it's built for throttled, restricted, or intermittent networks. Because it's a browser app, it works on iPhone right now, in Safari — no App Store required. Full comparison: Sendant vs Signal.

The honest browser-trust note: a browser client is re-delivered by the server on every visit, which makes it a harder trust model than an installed app that's fetched once and verified by an app store. Treat the browser as the low-friction tier and an installed app as the higher-assurance tier. Sendant has not yet been independently audited — an audit is planned — and we'd rather say that plainly than let you assume otherwise.

The no-install options, side by side

Four questions decide whether a tool actually solves this problem. Teal edge marks a yes.

Tool	Truly no install?	No account / identifier?	Persistent (history & contacts)?	E2E encrypted?
Chitchatter / LOCK.PUB-class rooms	Yes — open a URL	Yes — no account at all	No — ephemeral rooms; both parties usually must be present	Yes
WhatsApp Web	No — requires a phone already running the WhatsApp app	No — phone number required	Yes — mirrors the phone app	Yes
Signal Desktop	No — an installed app, linked to a phone running Signal; no browser version exists	No — phone number required	Yes	Yes
Threema web / desktop	No — links to the paid Threema phone app	Partly — a random Threema ID, no phone number needed, but the paid app is	Yes	Yes
Wire (web)	Yes — real standalone browser client	No — email address required to register	Yes	Yes
Sendant	Yes — browser client at app.sendant.io	Yes — no phone, email, or account	Yes — persistent identity, contacts, history, offline mailbox	Yes — WASM-compiled X3DH + Double Ratchet

Fact-check us: every row above is meant to survive scrutiny. If a row is wrong or goes stale, tell us and we'll correct it — this is a living page. More head-to-heads on the compare hub.

Common questions

Is browser-based encryption as safe as an installed app?

It's a genuinely harder trust model, and anyone who tells you otherwise is selling something. A browser client is re-delivered by the server on every visit, so you're trusting the server each time; an installed app is fetched once and verified by an app store, which makes it the higher-assurance tier. What mitigation looks like: serving the client from a locked-down origin with a strict content-security policy, making no third-party requests, and running the same cryptographic code path as the native app — in Sendant's case the same WASM-compiled X3DH + Double Ratchet code. Sendant hasn't been independently audited yet (an audit is planned). Practical rule: browser for low friction, installed app when the stakes are highest.

Can I use WhatsApp or Signal purely in a browser?

No. WhatsApp Web only works after you link it to a phone that already runs the WhatsApp app (via QR scan or a one-time code), and Signal has no browser version at all — Signal Desktop is an installed application that must be linked to a phone already running Signal. Both are companions to the phone app. Details: does Signal have a web version?

What's the difference between an ephemeral room and a messenger?

Persistence. An ephemeral room gives you an encrypted conversation that exists only while the page is open: no durable identity, no contact list, no message history, and usually both people must be online at once. A messenger gives you an identity that survives the tab closing, saved contacts, message history, and delivery to someone who's offline when you hit send — with Sendant, via an offline mailbox. Rooms are great for one-off conversations; a messenger is for people you'll talk to again.

Does a no-install messenger work on iPhone?

Yes — the browser is the loophole. Anything that truly runs in a browser runs in Safari on an iPhone, with nothing from the App Store. That's exactly how Sendant works on iPhone right now, in the browser: open app.sendant.io in Safari and you have a persistent encrypted messenger with no app installed. More in the FAQ.

Try the no-install lane in 30 seconds

No phone number, no email, no install — open the web app and see for yourself, or read the full comparison hub.

Open web app Sendant vs Signal