Security

Hama has no accounts and no sign-up. A space is created with one tap and lives at a short link such as hama.top/r/7Kp2mQa. Because there is no identity to attach a space to, everything below rests on two things: the link, and the key.

The three access modes

Every space is in exactly one of three modes. There is no other combination, and no mixed state.

• Public - content is stored as plain text. The space is listed in Hama search and its chat messages and shared text are indexed by content, along with the title, description and tags. Anyone can find and open it.
• Private + Open - Zero-Knowledge. The encryption key is carried in the URL fragment (#k=...). Anyone who has the complete link can read the space; anyone who does not, cannot.
• Private + Password - Zero-Knowledge. The key is derived in your browser from the password using Argon2id. The password itself never leaves your device.

Turning on a password automatically makes a space Private. A public space with a password does not exist anywhere in Hama.

What Zero-Knowledge guarantees

For Private spaces, all encryption and decryption happens in your browser. That means:

• The server receives and stores ciphertext only. It never receives the key.
• A complete dump of the database would reveal nothing readable from a private space - only encrypted blobs and operational metadata such as timestamps and sizes.
• Hama administrators have no technical ability to decrypt private content. There is no staff tool, no master key and no override.
• Passwords are never sent to the server, never stored, and never recoverable. Hama cannot recover a forgotten password.

What Zero-Knowledge does not protect

Encryption solves one problem well and several others not at all. Honestly:

• A public space is plain text by design. Nothing about it is encrypted or hidden, and that is the point of the mode.
• Whoever has the link can read a Private + Open space. The key is part of the link, so forwarding the link forwards the access.
• Whoever has the password can read a Private + Password space. Sharing it over an insecure channel shares the space too.
• Weak passwords can be attacked offline. Someone who has already obtained the ciphertext can guess passwords on their own hardware, at their own pace. Argon2id makes each guess expensive, but it cannot rescue a short or common password.
• Hama cannot control content after it is read. Any legitimate participant can copy, screenshot or re-share what they see.
• Hama cannot defend a compromised device. Malware, a hostile browser extension, a shared computer or a shoulder-surfer all sit on the plaintext side of the encryption.

How the key in the link works

In a Private + Open space, the key lives after the # in the address. Browsers treat that fragment as a purely local part of the URL: it is never included in the HTTP request, so it does not reach Hama servers, server logs, or any intermediary. Your browser hands it to the page, and the page uses it to decrypt.

The practical consequence is that a link without the fragment is useless, and a link with it is the whole secret. Treat it like a password: send it over a channel you trust, and do not paste it anywhere public.

Passwords and key derivation

When you set a password, your browser derives a key from it with Argon2id, a memory-hard function chosen specifically to make large-scale guessing slow and expensive. A per-space random salt means work done against one space is worthless against another.

Pick something long. A passphrase of several unrelated words beats a short password with substituted characters, and length matters more than any symbol you add.

Ciphers and keys

• Each private space gets a random 256-bit key, generated in the browser.
• Content is encrypted with a modern authenticated cipher - XChaCha20-Poly1305 or AES-256-GCM - so tampering with stored ciphertext is detected rather than silently decrypted.
• In password mode, the space key is wrapped by the key derived from your password, so changing the password does not require re-encrypting the whole space.

Files and voice messages

In private spaces, files and voice messages are encrypted in your browser before upload, and their names are hidden from the server as well. Maximum file size is 49 MB. Voice messages can be up to 10 minutes.

Because the server only ever sees ciphertext, it cannot scan uploads for malware. Downloads are therefore always delivered as attachments rather than opened in the browser, and you should only open files from people you trust.

What Hama never logs

The following are never written to logs, analytics or backups:

• Message content and shared text
• Passwords and encryption keys
• URL fragments
• Plain file names from private spaces
• Long-term raw IP addresses

Hama does not sell data, shows no advertising, and does not build user profiles. Operational records keep counts and sanitized technical details only.

Links do not leak

Space pages, admin pages and API routes are served with X-Robots-Tag: noindex, nofollow, noarchive, nosnippet and Referrer-Policy: no-referrer. Search engines are told not to index them, and following an outbound link from inside a space does not hand your address to the destination site.

Deletion

Inactive spaces are permanently deleted every day at 00:00 UTC. A space that still has someone in it at that moment survives to the next day's run, so the time between a space emptying and its deletion is not fixed - it can be seconds or up to about 24 hours. The creator can delete a space instantly at any time, which removes everyone and erases all of its content.

What we ask of you

• Use a long, unrelated-words passphrase for password-protected spaces.
• Share links carefully - for Private + Open spaces, the link is the key, so treat it as a secret.
• Remember that there is no recovery. If the content matters, keep your own copy somewhere durable.
• Do not put anything confidential in a public space.
• Open files only from people you trust.