--- title: "How to Create Your Own Decentralized Messenger Protocol - Build it yourself" url: https://daily.dev/posts/how-to-create-your-own-decentralized-messenger-protocol---build-it-yourself-z9tasfswr source_url: https://karboosx.net/post/5j7jdDM3/how-to-create-your-own-decentralized-messenger-protocol type: article source: "Programming Digest" published: 2026-08-10T03:41:07.260Z updated: 2026-08-10T03:41:40.685Z tags: ["javascript", "encryption"] reading_time: 15 upvotes: 0 comments: 0 language: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # How to Create Your Own Decentralized Messenger Protocol - Build it yourself **[Programming Digest](https://daily.dev/sources/programmingdigest)** · 15 min read · 0 upvotes · 0 comments ## Summary A hands-on walkthrough for designing a federated, decentralized messaging protocol called lnchat from scratch. Covers the core concepts of federation (inspired by SMTP/email), user identity using domain-scoped handles, server discovery via .well-known JSON files, end-to-end encryption using X25519 keys and HPKE (with the hpke-js library), and server-to-server request signing using Ed25519 keys. The post details the full message flow: client-side key generation with the Web Crypto API, a resolve_users endpoint for public key exchange, a send_messages federation endpoint, and a canonical request signing scheme to prevent spoofing and replay attacks. Security considerations like SSRF prevention and key transparency are also noted. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How does server-to-server request signing work in a federated messaging protocol to prevent spoofing? Each server generates an Ed25519 key pair and publishes the public key in its .well-known discovery file. When sending a federation request, the sender builds a canonical string (version, method, URL, source domain, target domain, timestamp, request ID, and SHA-256 hash of the body), signs it with its private key, and sends the signature in an LNChat-Signature header. The recipient fetches the sender's discovery file, retrieves the public key, and verifies the signature against the same canonical string. _Teams building federated or distributed APIs track signing patterns and protocol design decisions on daily.dev._ ### How do I use HPKE for end-to-end encryption in a JavaScript messaging app with X25519 keys? Use the hpke-js library with DhkemX25519HkdfSha256, HkdfSha256, and Aes256Gcm. Create a sender context with the recipient's public key, call sender.seal(plaintext) to get the ciphertext, and send both sender.enc (the encapsulated key) and the ciphertext to the server. The recipient uses their private key to recover the symmetric key and decrypt. This avoids the cost of direct asymmetric encryption on the full message body. _Developers implementing E2E encryption in web apps find relevant cryptography patterns and library discussions on daily.dev._ ### How should a federated protocol use .well-known files for server discovery? A federated server must serve a JSON file at GET /.well-known/.json containing the protocol version, endpoint URLs, and server public keys. Endpoint URLs are declared in the discovery file rather than enforced as fixed paths, allowing each server to choose its own routes without collisions. Clients and remote servers fetch this file first to learn where to resolve users, send messages, and verify signing keys. _Protocol designers and backend engineers building server-to-server systems share discovery and federation approaches on daily.dev._ ## Similar posts on daily.dev - [How should group chats work in decentralized systems?](https://daily.dev/posts/how-should-group-chats-work-in-decentralized-systems--gbru0d40j) · Hacker News · 0 upvotes · 0 comments - [Seizing the means of messenger production](https://daily.dev/posts/seizing-the-means-of-messenger-production-9r784ont3) · Stack Overflow Blog · 0 upvotes · 0 comments - [The Long Tail of Work Left Until ActivityPub Has E2EE](https://daily.dev/posts/the-long-tail-of-work-left-until-activitypub-has-e2ee-zx7yeq1dk) · Dhole Moments · 0 upvotes · 0 comments --- Tags: [#javascript](https://daily.dev/tags/javascript), [#encryption](https://daily.dev/tags/encryption) [View this post on daily.dev](https://daily.dev/posts/how-to-create-your-own-decentralized-messenger-protocol---build-it-yourself-z9tasfswr)