Proof of concept: end-to-end encryption in Jitsi Meet
There&#x27;s a lot of discussion here about key exchange, and how you need to trust whatever service is managing the keys. From the demo, it looks like the key is basically a password. If you can share the password out-of-band through another secure channel (perhaps post it in a Signal chat or something), then your meeting should be secure. It can even be included as part of the link.<p>But then doesn&#x27;t the Jitsi web server have to access password when you enter it on their website&#x2F;have it in the link? Nope! It looks like they&#x27;re putting the password in an anchor fragment in the URL, which is not sent to the web server [1]. So all encryption&#x2F;decryption is being done client side (and is therefore real end-to-end encryption).<p>Yes, it&#x27;s possible the web server is sending you evil JavaScript that is extracting your password anyway, but at least that&#x27;s something you can in principle check. For all end-to-end encryption to work, you have to know your client is not compromised.<p>[1] <a href="https:&#x2F;&#x2F;stackoverflow.com&#x2F;a&#x2F;3081862" rel="nofollow">https:&#x2F;&#x2F;stackoverflow.com&#x2F;a&#x2F;3081862</a>