Start here

What is Pug Network?

Pug Network is a relay for end-to-end encrypted, ephemeral chat rooms. A room is a URL. Open it in two browsers and you are talking. Close them and the room — along with every byte that ever lived in it — is gone.

It is built on a single conviction:

That conviction shows up as four commitments, listed below. Together they are the product. Anything that erodes one of them is a breaking change to Pug Network's identity, not just its code.

The four commitments

1. No accounts

No signup, no email, no profile, no identity. There is nothing to remember, nothing to recover, nothing to phish. A room is a URL — share it with the people you want in the conversation, and that is the entire onboarding flow.

2. No persistence

Rooms live only in memory. When the last participant leaves, when the TTL expires, or when the creator hits Purge, the room is gone. There is nothing on disk to subpoena, nothing in a backup to leak, nothing in cold storage to exfiltrate, and nothing on a seized hard drive to recover.

3. No server-side plaintext

Messages are end-to-end encrypted in the browser with AES-256-GCM. The server relays opaque ciphertext and never holds the key — the key lives in the URL fragment (#…), which by design is never sent to the server. See Trust model for the full explanation.

4. No unnecessary code

Every dependency is a supply-chain risk. The Go reference implementation has zero third-party dependencies — Go standard library only, no go.sum file. The JavaScript implementation runs on three runtime packages and self-hosts every client asset.

What is it for?

• Two journalists comparing notes on a sensitive story.
• A founder and a lawyer discussing terms before anything is in writing.
• Two clinicians coordinating about a specific patient outside the EHR.
• An incident response team triaging a breach without leaving a Slack trail.
• Any conversation where not having a record is a feature, not a bug.

What is it not for?

Pug Network is not trying to replace Slack, WhatsApp, or Signal. It does not keep history, push to your phone when you are offline, sync across devices, or store a contact list. If you need any of those things, use a tool that was built for them. See What it is not for the explicit list.

Two implementations, one philosophy

The same protocol is implemented twice:

• JavaScript (Node.js + Express + Socket.IO) — what powers the live site you are reading this on. Easy to deploy on Render, any VPS, or a container. See Deploy on Render.
• Go — the reference implementation. Single static binary, zero third-party dependencies, hand-rolled WebSocket. Recommended for on-prem, air-gapped, and highest-assurance deployments. OpenBSD is the recommended target. See Self-host the Go build.

Both implementations are kept feature-parity at the protocol level. If they ever diverge, the Go spec wins.