Since no one else has explicitly brought this up: <a href="https:&#x2F;&#x2F;tonyarcieri.com&#x2F;whats-wrong-with-webcrypto" rel="nofollow">https:&#x2F;&#x2F;tonyarcieri.com&#x2F;whats-wrong-with-webcrypto</a> (also see Matasano&#x27;s &quot;JavaScript Cryptography Considered Harmful&quot;, etc.). There is nothing that a service like this will protect you from that you don&#x27;t already get while using TLS in just about every insecure&#x2F;non-E2EE chat service.<p>If you&#x27;re looking for actually secure communication that runs as a Web app, my startup Cyph (cyph.com) is the only option that exists. This is because we put in the time to build it correctly; the root page of our application is a permanently pinned (TOFU) bootstrap that validates&#x2F;executes signed application packages, and the scheme to accomplish this was rigorously vetted in a 12-day audit.<p>Edits:<p>* Here&#x27;s how it works: <a href="https:&#x2F;&#x2F;www.reddit.com&#x2F;r&#x2F;encryption&#x2F;comments&#x2F;4027ci&#x2F;how_2_spacex_alums_are_using_encryption_for_good&#x2F;cyywmc8" rel="nofollow">https:&#x2F;&#x2F;www.reddit.com&#x2F;r&#x2F;encryption&#x2F;comments&#x2F;4027ci&#x2F;how_2_sp...</a><p>* Here&#x27;s Cure53&#x27;s audit report: <a href="http:&#x2F;&#x2F;cyph.team&#x2F;cure53report" rel="nofollow">http:&#x2F;&#x2F;cyph.team&#x2F;cure53report</a>