MabMess

How does it work?

Flutter Riverpod Node.js Socket.io AES-256-GCM

MabMess is a modern, secure, cross-platform communication platform built on the Flutter framework. The aim of the project is to give the user complete privacy through end-to-end encryption (E2EE) while offering advanced features – with an emphasis on clean code and the user’s own control over their data.

1. System architecture

Client side (Frontend)

  • Framework: Flutter (Dart) – Android, iOS, Windows.
  • State management: Riverpod 2.x
  • Local database: Drift (SQLite)
  • Communication: WebSocket (Socket.io) + HTTPS (Dio)

Server side (Backend)

  • Runtime: Node.js
  • Database: MySQL
  • Real-time engine: Socket.io
  • File storage: temporary media storage with automatic deletion after delivery.

2. Security and encryption (E2EE)

Unlike ordinary apps, MabMess does not encrypt only on the way to the server, but directly between the end devices.

  • Key exchange: ECDH over the X25519 curve.
  • Symmetric encryption: AES-256-GCM, a unique key for every message.
  • Identity: an EC key pair per device; when pairing a desktop, the identity is transferred from the phone over a one-time encrypted channel.
  • Safety numbers: verification of a contact’s identity by a numeric key fingerprint.

3. Key features of the app

Real-time messaging

  • Delivery states: Pending → Sent → Delivered → Read.
  • Real-time typing indicators, including in groups.
  • Editing and “Delete for everyone” (physical removal of the data at all recipients).
  • Emoji reactions to messages.

Multimedia and files

  • Automatic photo/video compression (limit up to 75 MB).
  • Audio messages with waveform visualisation.
  • Media gallery in a carousel and a full-screen viewer.
  • PDF and ZIP support with an integrated viewer.

Advanced message types

  • GPS location sharing with the address and opening in external maps.
  • Polls in 1-to-1 and group chats with real-time results.
  • Events – proposing a date and voting on it.

4. Cross-platform synchronisation

MabMess keeps all devices in sync without a central cloud.

Pairing via QR code: exchange of public keys, encryption of the phone’s identity with the key from the QR code and secure transfer of history and contacts.

Automatic sync (peer-to-peer): as soon as two devices are online, ChatSyncService starts – texts first, then media in the background, prioritising the newest messages.

5. Server logic (Backend)

The MabMess server works as an “intelligent postman”, not as an archivist.

  • Temporary buffering: offline messages are queued and deleted immediately after delivery.
  • Privacy first: the server never sees the content of 1-to-1 messages, only the metadata needed for delivery.
  • Self-cleanup: uploaded media are kept only as long as needed for delivery (60 s after confirmation by default).
  • Push gateway: integration with Firebase Cloud Messaging (FCM).

6. Integrations and UX extras

  • A custom secure keyboard that does not send data to OS vendors.
  • Biometric security (fingerprint / Face ID).
  • Option to block screenshots throughout the app.
  • Adaptive design from small phones to widescreen monitors.
  • Tray integration on Windows – minimise to the system tray.

7. Update system

  • Android: checks version.txt on the server, downloads the APK directly in the app and offers to install it.
  • Windows: downloads the .exe installation package, exits cleanly and launches the installer to overwrite the files.

This system is designed to provide all the comfort of a modern chat with no compromises on privacy. All data belong to the user, and the server serves only as a temporary intermediary for their transfer.

Back to MabMess