PHP Secure Chat: Chat box between users using encrypted messages

Recommend this page to a friend!
  Info   View files Example   View files View files (10)   DownloadInstall with Composer Download .zip   Reputation   Support forum   Blog    
Last Updated Ratings Unique User Downloads Download Rankings
2020-02-17 (8 months ago) RSS 2.0 feedNot enough user ratingsTotal: 1,034 This week: 1All time: 3,522 This week: 232Up
Version License PHP version Categories
cchat 2.2GNU General Publi...5PHP 5, Cryptography
Description Author

This package implements chat box between users using encrypted messages.

It can output HTML and JavaScript to implement a chat box between users.

They use a commonly agreed password to encrypt the messages using BlowFish before they are sent to the server via AJAX.

The server stores the encrypted messages in a MySQL database before they are delivered and decrypted to other chat users with the same password.

Innovation Award
PHP Programming Innovation award nominee
January 2017
Number 12

Prize: One ebook of choice by Packt
When you want to implement a chat system between users of your application or site, there is always the concern that the messages may be viewed by people that manage the site, or even by spies and secret services because messages may have to be stored in the server before delivering them to the other users in the chat.

One way to avoid this problem is to implement end to end cryptography. This means that messages are encrypted before sent from the origin user and only decrypted by the destination users.

This package provides a solution to implement such approach in PHP. It uses some JavaScript to encrypt messages before sending from the origin user browser using the Blowfish algorithm.

It uses a secret key that only the origin and destination users know about. This way messages may be securely stored on the server database to be able to deliver to the recipient later when he is not online, without the risk of a third party viewing the messages without knowing the secret password.

Manuel Lemos
Picture of Martin Latter
  Performance   Level  
Name: Martin Latter is available for providing paid consulting. Contact Martin Latter .
Classes: 7 packages by
Country: United Kingdom
Age: ???
All time rank: 147264 in United Kingdom
Week rank: 74 Up5 in United Kingdom Up
Innovation award
Innovation award
Nominee: 4x



Lightweight end-to-end encrypted chatbox, with an emphasis on speed and minimalism.

[1]: ![cchat][1]


Uses a previously agreed password with the recipient, avoiding any initial key exchange across a network.


  • Lightweight (45kB).
  • All data encrypted by the browser's JavaScript.
  • Uses only PHP, MySQL, and JavaScript.
  • POST AJAX used (GET AJAX data would be recorded in server logs).
  • Coded to PHP 5.3 and using legacy JavaScript event handlers for maximum server-client compatibility.


  • SHA-256-hashed key.
  • Blowfish cipher in CBC-mode (base64 display overlays binary-encrypted data).
  • Messages stored encrypted in the database.

The Blowfish block cipher is simple, strong, and fast. Its speed is ideal for JavaScript implementation.


  1. Clone the repository (or extract the ZIP archive) into a suitable directory in the server's web directory e.g.

    `cd /var/www/html`

    `sudo git clone`

  2. On Linux/BSD servers, set appropriate file ownership / permissions e.g. for Debian-based distros, Apache is www-data:

    `sudo chown -R www-data:<your_user_name> CChat/`

    `cd CChat`

    `sudo chmod 664 install.php classes/cchat.class.php`

  3. Edit the configuration section details in install.php (line 18 onwards): username, passwords, database, host etc.
  4. Edit the relevant constants in /classes/cchat.class.php (line 18 onwards) to conform to the credentials used in install.php
  5. Run install.php through the server (which, if you have root MySQL access, should mean set-up is complete):


  6. View CChat's index.php in a browser, which if install.php ran correctly, should display without connection errors to the server, and display init: test as the first message.


  7. Alter the timezone if required: index.php (line 5): `date_default_timezone_set('Europe/London')`



  1. message display
  2. your name
  3. your password (use a strong password, previously agreed, to share messages with a recipient)
  4. your message

The decrypt button will decrypt existing encrypted messages in field 1, if the correct password is present in field 2.

Enter your name in field 2, password in field 3, and a message in field 4, then click the chat button.

A page refresh (encrypted messages displayed) or the wrong password will result in gibberish displayed in field 1.

Default Timings

The AJAX polling is 6 seconds between server checks for new messages (change the iCheckFreq variable (in microseconds) /js/cchat.js (line 17)).

The last hour's messages are displayed in field 1 (change the MESSAGE_BUFFER constant /classes/cchat.class.php (line 24)).

Character Set Limitation

Unicode character encoding is unfortunately not possible with the present JavaScript Blowfish cipher encryption (the reason the database remains as latin1 encoding).

Known Bugs

  1. Intermittent duplicate message bug (refresh page and it disappears): /js/cchat.js (line 294).
  2. Some intermittent line break character removal when using Linux and Windows browser clients together.


  • Nils Reimers for the Blowfish cipher implementation in JavaScript.
  • Angel Marin and Paul Johnston for the SHA-256 hash function implementation in JavaScript.
  • Matthew of JS Classes for testing / revision suggestions.
  • Karl, who asked me to create a 'shoutbox' in 2010.


  • To God (I narrowly escaped death in 1992).
  • To Sofia.


CChat is released under the GPL v.3.



Won a JS Classes Innovation Award (August 2016).

  Files folder image Files  
File Role Description
Files folder imageclasses (1 file)
Files folder imagecss (1 file)
Files folder imageincludes (2 files)
Files folder imagejs (2 files)
Files folder imagesql (1 file)
Accessible without login Plain text file index.php Example Example script
Accessible without login Plain text file install.php Example Example script
Accessible without login Plain text file Doc. Documentation

  Files folder image Files  /  classes  
File Role Description
  Plain text file cchat.class.php Class Class source

  Files folder image Files  /  css  
File Role Description
  Accessible without login Plain text file cchat.css Data Auxiliary data

  Files folder image Files  /  includes  
File Role Description
  Accessible without login Plain text file check.php Example Example script
  Accessible without login Plain text file update.php Example Example script

  Files folder image Files  /  js  
File Role Description
  Accessible without login Plain text file bf.js Data Auxiliary data
  Accessible without login Plain text file cchat.js Data Auxiliary data

  Files folder image Files  /  sql  
File Role Description
  Accessible without login Plain text file cchat.sql Data Auxiliary data

 Version Control Unique User Downloads Download Rankings  
This week:1
All time:3,522
This week:232Up

For more information send a message to info at phpclasses dot org.