wa-scramble-app

Electron desktop wrapper around WhatsApp Web that encrypts outgoing text client-side before it leaves your machine, and disguises the ciphertext as ordinary-looking English sentences so it doesn't stand out in the chat. Nothing about this changes what WhatsApp itself can see at the transport level (it still gets a text message) — the point is that the content is unreadable to WhatsApp, any server in between, or a bystander scrolling past your screen, without looking overtly like "encrypted data."

How it works

• Each installation has one long-term identity keypair (ECDH, P-256), generated on first run and stored in vault.json in the app's user data directory.
• To message someone, you need their public key — get it from them out of band (in person, a call, another already-trusted channel) and add them as a contact in File → Identity & Contacts…, matched to the exact chat title WhatsApp shows for them.
• Sending a message while a contact is configured derives a shared AES-256 key via ECDH + HKDF, encrypts with AES-GCM, and encodes the result as a handful of grammatically-normal-looking sentences before typing it into WhatsApp's real composer.
• Receiving does the reverse automatically: any bubble that decodes and decrypts against a known contact's key is replaced in place with the plaintext, tagged "decrypted".
• If you try to send in Encrypt mode to a chat with no contact key on file, the app refuses to send rather than silently falling back to plaintext — you'll always know when a message wasn't protected.

Setup

npm install
npm start

On first launch a WhatsApp Web window opens; log in as usual (QR scan). Open File → Identity & Contacts… to see your public key and add contacts. Use Debug → Run Self-Test to sanity-check the crypto/stego round-trip without needing a real conversation.

Sharing with someone who has nothing installed

npm start needs Node + this repo. To hand someone a thing they can just double-click with no Node, no npm, nothing pre-installed:

npm install
npm run dist

This bundles the whole Electron runtime into dist/WA Scramble-win32-x64/ (~250 MB — that size is the Chromium/Node runtime, not the app). Zip that folder and send it. They unzip and run WA Scramble.exe inside — nothing else required, no install, no admin rights.

Two things to warn them about:

• Windows SmartScreen will likely flag the exe as "unrecognized publisher" on first run (it isn't code-signed — that costs a paid certificate). They'll need "More info" → "Run anyway".
• It only builds for the OS you run npm run dist on. Run it on Windows for a Windows build; there's no macOS/Linux build target configured here.

Threat model / limitations

• This protects message content, not metadata — WhatsApp (and Meta) still see who you're talking to, when, and how often.
• The camouflage in src/stego.js produces syntactically plausible but semantically nonsensical sentences. That defeats a human skimming the chat or a naive keyword filter. It is not validated against a classifier or model specifically trained to detect this scheme — treat it as obfuscation on top of real encryption, not as a guarantee of being undetectable.
• Loading web.whatsapp.com in a non-standard client and injecting a script into it is outside WhatsApp's intended usage and could in principle trigger account action from WhatsApp's side; that's a product/ToS risk independent of the crypto.
• Regenerating your identity (Settings → Regenerate Identity) breaks decryption of anything sent to your old key — contacts need your new public key before they can reach you again.
• vault.json (identity private key + contacts) is stored as plaintext JSON in Electron's userData folder. Anyone with local file access to your machine can read it.