Skip to content

WaChat

Security

Security and privacy

The key on your device. The data in your browser and your Drive. The web reading directly. No server of ours sees a single message — and here is precisely why.

  1. The key stays with you
  2. Your Drive, hidden folder
  3. The web reads directly

Not a promise — an architecture. The path is your phone or browser → your Drive → your browser. There is no stop at our place.

We can't read your messages. By design.

What we see — and what we don't

We can see

  • That an account exists and when it last signed in
  • Your subscription state and price group
  • Generic usage events such as "chat opened" (if analytics is on)

We cannot see

  • Any message, name or phone number
  • Any photo, voice note or document
  • Your 64-digit key or passphrase
  • The other files in your Google Drive

The full data path

1) Your WhatsApp backup is decrypted with your key on your device — in the browser's background worker or inside the Android app. 2) Messages go to a local database; media stays as files named by their hash. 3) If you choose, backups are uploaded to the hidden app folder (appDataFolder) of your own Google Drive with the drive.appdata scope only. 4) WaChat Web reads the same files from Drive straight into the browser with your own token.

What our server holds

Your account id (Firebase Auth), your subscription state (plan, expiry, price group), and — only if you link a browser through the app — a Drive refresh token encrypted with Cloud KMS per linked device, revocable from the app. No chat file, no media, no WhatsApp key, no passphrase.

Linking a browser with a code

The browser generates a key pair and an 8-character single-use code valid for 3 minutes. The app approves it with your account token, and the server encrypts the sign-in token to the browser's public key — so even someone who could read the record could not use it.

Optional passphrase encryption

AES-256-GCM with a key derived by PBKDF2 (200,000 iterations) from a passphrase you choose. The salt is stored with the backup; the passphrase is not. Forget it and there is no recovery — not even by us.

Permissions

Android: Drive (appdata only), access to the WhatsApp folder through the system file picker, optional contacts for names, notifications, the camera only to scan a web-linking code, biometrics for the optional app lock (checked on the device, never sent), and an optional battery-optimisation exemption so nightly backups can run. Web: nothing beyond the files and folders you pick yourself; storage persistence is requested so the browser does not evict your chats.

Responsible disclosure

Everything above matches the privacy policy and the Google Play data-safety form. If you find a weakness, write to security@wachatplus.com; we answer within two business days and credit reporters who wish to be named.

Keep the whole conversation.

Import your first chat in under a minute — free, in your browser, no account.