Anonymous video calls without accounts.
Video calls where nobody can see your face, hear your real voice, or write down your name. Your face and voice are transformed on your own device before anything is sent. No accounts, no ads, no analytics, no subscriptions.
We don’t store call content, call history, participant identities, or room records. On 1:1 calls, four spoken words prove nobody is in the middle before audio unmutes. What Faraday does and doesn’t protect against →
Start private call →Who it’s for
- Sources talking to a journalist without being on camera as themselves.
- Survivors reaching a support line, lawyer, or friend from a household where the call cannot be on a logged-in account.
- Activists and dissidents coordinating without their identities crossing a corporate video service.
- Privacy-sensitive professionals — lawyers, counsellors, clergy, clinicians — who want a conversation that doesn’t live in a vendor’s database. Faraday has not been through a HIPAA or other regulatory compliance review; your organization is responsible for deciding whether it fits your obligations.
- Anyone who wants to talk face-to-face with a stranger online without handing over a face or a name.
What’s new · October 2026
- Schedule meetings in advance. Hosts can now create a signed, shareable link for a future conference—no accounts, no database, no identity collected. The link is the meeting. Add it to your calendar with a single click (.ics download, zero server state).
- Flat rooms, scheduled lounge. Ad-hoc rooms join straight in — no host, no moderator. Scheduled rooms hold early arrivals in a waiting room with a quiet lounge mix (v1s1t0r practice mix) until the door opens. Raise-hand, a host badge, and host mute-all are live in conferences.
- Short-auth verification (1:1). On 1:1 mask calls, both sides see four random words—say them out loud to prove the line is private. Conference SAS is on the roadmap.
- Anonymous handles & signed tokens. No accounts, no emails, no phone numbers. Conference handles are random two-word names generated in your browser. The room link is the key — share it only with the people you want in the room.
- Android first. Native app live on Google Play. A GrapheneOS / sideloadable APK is coming soon. iOS native app comes after launch; the web works on iOS Safari today.
Why it exists
Every mainstream video app is built around an account. The account is the product. Your face, your voice, your contact list, the timestamps of who you spoke to and for how long — all of that is the asset, and you are renting access to it.
Faraday inverts that. There is no account, because there is nothing to attach an account to. Your face is destroyed in your own browser before a single byte is encrypted. Your voice is mangled before it is sent. On 1:1 calls the relay is a dumb pipe that cannot decrypt what passes through it. When both peers hang up, the six-character code disappears from memory and the conversation is gone.
What it is not: a tool for hiding from a state-level adversary who already owns your device. If your phone is compromised, no website can save you. Faraday raises the cost of mass surveillance, casual identification, and corporate data harvesting. It is not a Pegasus shield.
What it is
- MASK CALL — anonymous WebRTC video calls. The obfuscation layer is powered by Glitch Pixel Studio (GPS): your face becomes a real-time shader pass and your voice is pitch-shifted and distorted, all on your device. You get a new random look and voice every session, so nobody can recognise your mask from one call to the next.
- FULL-FRAME 1:1 — the peer fills the whole video area; your own masked self-view sits in a Zoom-style picture-in-picture corner.
- SPOTLIGHT CONFERENCE — click any tile in a group call to pin it big with everyone else as a sidebar of thumbnails. Click again to return to grid.
- SCREEN SHARE — share a tab, window, or full screen in 1:1 calls and conferences. Replaces your masked video for the duration; swaps back instantly when you stop. (Desktop browsers only — mobile WebRTC doesn’t expose screen capture.)
- CURTAIN — Faraday occupies your camera and microphone so other apps can't use them while it's running.
- TONE — acoustic-curtain tone in the room. Privacy theater you control.
Transparency & verification
The canonical description of what is running today lives at /security. None of it is independently verified yet. That gap matters, especially for the people we built this for, so here is exactly where we are.
Shipped & verifiable today
- Open
chrome://webrtc-internalson a 1:1 call: the only ICE candidates arerelaycandidates onturn.faraday.cam, and all media is DTLS-SRTP. - The TURN relay enforces
use-auth-secretwith 1-hour HMAC credentials — minted by/api/turn-creds, no static passwords in the client bundle. - No analytics, no third-party trackers, no fonts or scripts loaded from any third-party origin. Verifiable via DevTools and any uBlock-style extension.
- Strict CSP, HSTS preload, Permissions-Policy, COOP, CORP, X-Frame-Options DENY shipped in response headers.
In progress
- Public source release of the mask shader, voice DSP, signaling broker, and unlock-code HMAC scheme. Delayed from Q3 2026; no new date yet. Next status update on this page by 2026-12-31. Still blocking on: (1) secrets fully rotated out of git history, (2) TURN / signaling configs templated so deployment can’t leak credentials, (3) the HMAC unlock scheme reviewed by an outside cryptographer so we don’t ship a bad design publicly.
- Independent third-party security review. We are actively looking for one. If you are a security researcher or auditor who works on WebRTC, browser-side crypto, or privacy tools, we will give you full source access ahead of the public drop — email security@faraday.cam.
- Reproducible builds for the Android APK + GrapheneOS sideload (target alongside Play public launch).
Not yet
- No formal audit report exists. Anyone claiming Faraday has been “audited” today is wrong.
- No published bug-bounty program (yet). Responsible disclosure to
security@faraday.camis welcomed and acknowledged within 72 hours. - Conference rooms are not end-to-end encrypted: media is encrypted to Faraday’s media server (SFU), which forwards it to other participants. Faces and voices are masked before they leave your device, but the server operator could technically access the masked streams and chat text. 1:1 mask calls are end-to-end encrypted.
- Conferences have no four-word verification (SAS) and no manual host transfer. Host mute-all asks each participant’s app to mute itself; it is not enforced by the server.
Until the source drops and a credible reviewer signs off, the right framing for Faraday is “serious architecture, early execution.” If you are in a threat model where “trust the operator” is unacceptable — which it should be — wait for the audit.
FAQ
- Can I schedule meetings in advance?
- Yes. Hosts can create a signed, shareable link for a future conference—no accounts, no database, no identity collected. The link is the meeting. Add it to your calendar with a single click (.ics download, zero server state). Treat the link like a key: anyone who has it can join.
- Who runs a conference room?
- Nobody — rooms are flat. There are no logins, no profiles, and no in-room moderator badge. Whoever scheduled the link is the only one who knows the room exists before join time, but once people are in, every participant has the same controls (their own mic, their own camera, their own mask). The first participant in gets a host badge and a mute-all button; if they leave, the badge passes to the next participant automatically. Everyone can raise a hand. Manual host transfer is not in the current build.Scheduled rooms do hold early arrivals in a waiting room with a quiet lounge mix (the v1s1t0r practice mix, by a visitor & co-creator of faraday.cam) until the door opens at the scheduled time. Ad-hoc rooms join straight in.
- What happens if a conference link leaks?
- Whoever has the link can join. The room ID in the link is the key, and there is no password or approval step today.What the signed tokens do protect: the media server only accepts a join that carries a 60-second HMAC token bound to that room and role, so a captured join token is useless a minute later, and a scheduled-meeting link can’t be reused for a different room. The full chain is: link →
/api/conference/token→ 60-second join token → media server. See /security for what each piece protects. Use a fresh room for each sensitive meeting and share the link over an encrypted channel. - Is this end-to-end encrypted?
- 1:1 mask calls: yes. Media flows over WebRTC with DTLS-SRTP — the keys are negotiated directly between the two browsers. The Faraday relay forwards encrypted packets but cannot decrypt them, and the four spoken words let you detect a man-in-the-middle.Conferences: no. Each participant’s media is encrypted to Faraday’s media server (SFU), which decrypts and re-encrypts it for everyone else. Your face and voice are already masked before they leave your device, so the server only ever handles masked streams — but it is not end-to-end encryption.
- Do you log anything?
- No accounts, no signup, no email, no phone number, no analytics, no third-party trackers. We don’t store call content, call history, participant identities, or room records. The signaling broker keeps a 6-character code in memory only while you're online so a peer can find you.What is written somewhere: a signed 30-day unlock cookie in your own browser if you paid, CSP violation reports, and requests to known scanner paths (e.g.
/.env), which are logged with IP and user agent. Our hosting providers also see ordinary connection metadata. Details in the Privacy Policy. - Can the server see my video or hear my voice?
- Nobody — including us — ever receives your unmasked face or real voice: the visual mask and voice DSP run entirely in your browser before anything leaves the device. On 1:1 calls the TURN relay is a dumb byte-pump — it can see the size and timing of your encrypted packets but not the contents. In conferences the media server handles the (already masked) streams in decrypted form in order to forward them.
- What happens if your TURN server is compromised?
- For 1:1 calls, an attacker with full control of the relay still cannot decrypt the call: DTLS-SRTP keys never touch the server. They could observe metadata (who relayed with whom, when, for how long) and theoretically drop your traffic. They cannot impersonate a peer without the four spoken words failing to match. A compromised conference media server, by contrast, could see the masked streams and chat.
- Why a 6-character code instead of a username?
- Usernames are identifiers. Faraday avoids identifiers. The code is minted in your browser with
crypto.getRandomValuesand held in memory only — no sessionStorage, no localStorage, no cookie. Reload the tab and you get a new code; close the tab and it’s gone. Share it once over a side channel (Signal, iMessage, in person) and the call disappears the moment you hang up. - Will my friends know it's me?
- Only by what you tell them. Every time you start your camera, Faraday rolls a new random look and voice, so your mask isn’t a persistent signature that someone could learn and spot again in another call. Agree on a word or a detail over a channel you already trust if you need to know who’s who. You can still adjust the sliders during a session.On 1:1 mask calls there’s also cryptographic proof the line itself is private: both peers compare four spoken words on screen before the audio unmutes. Conference rooms don’t have the four-word check, and are encrypted to our media server rather than end to end.
- Can I share my screen?
- Yes — in both 1:1 mask calls and conference rooms. Hit SHARE SCREEN, pick a tab/window/full screen from your browser’s picker, and your masked video swaps to the screen capture for the duration. Hit STOP SHARING (or use your browser’s stop-share UI) and you’re back to your masked face.Mobile WebRTC doesn’t expose
getDisplayMedia, so screen share is desktop only today — Chrome, Firefox, Edge, and Safari 17+ on macOS work. The Android Faraday app wraps the same web page, so screen share will light up there once Capacitor exposes a screen-capture bridge in a future release. - Can I use this on iPhone?
- The website works on iOS Safari today — WebRTC, WebGL2, and getUserMedia are all supported. The browser may need a tap to enable remote audio (autoplay restriction); the page surfaces a button when that happens.A native iOS app is not shipping in the first release. Android is going first because Play Billing → signed unlock code is the payment rail we’ve built. iOS native + In-App Purchase comes after launch.
- Is the source code public?
- Not yet. The Q3 2026 target slipped; there is no new date yet, and we’ll post a status update by 2026-12-31. Three blockers stand between today and a public repo: (1) secrets fully rotated out of git history, (2) the unlock-code HMAC scheme reviewed by an outside cryptographer so we don’t ship a bad design publicly, and (3) the TURN / signaling configs templated so deployment can’t leak credentials.We know “trust the operator” is exactly the adversary model this tool is supposed to eliminate. If you are a security researcher and want pre-release access to audit before the public drop, email security@faraday.cam. See Transparency & verification for the full status.
- How many listeners can a conference have?
- Up to 100 listeners per room, plus up to 10 active participants (camera + mic). Conferences run through a self-hosted mediasoup SFU: each participant uploads one stream and the server fans it out, so nobody’s connection has to carry every other participant. The current count is shown live in the room header so you always know how big the audience is.
- Why are listeners given anonymous names?
- Listeners never expose camera, mic, or identity. To make chat readable, every listener gets a random two-word handle (e.g. quiet‑fern) generated in their browser at join time. Reload the page and you get a new handle — no account, no profile, nothing to follow you across rooms.
- Is there a chat?
- Yes — text only. 500 characters per message, one message per second per peer, no uploads, no images, no links auto-loaded. Messages pass through the conference media server, which relays them to the room without writing them to disk. They live in your browser tab while you’re in the room and disappear the moment you leave. Chat is not end-to-end encrypted.
- What costs money and what is free?
- Two tiers, both one-time fees — no subscriptions, no ads, no tracking.
- Free — receive incoming 1:1 mask calls (someone shares their code with you), and join any conference as a listener (audience seat: hear and chat, no camera/mic).
- $4.99 one-time — initiate 1:1 mask calls, host multi-party conferences, schedule rooms in advance. Every privacy and security protection is identical for free and paid users — you pay for hosting, not for safety.
The Android app is live on Google Play as a one-time paid app — the install IS the purchase. There is nothing further to buy inside the app. The GrapheneOS / sideloadable APK build and iOS App Store are still coming soon. The web unlock code is platform-agnostic: paste it into Safari on a Mac, an iPhone, Firefox on Linux — same code, same tier.
- I lost my unlock code. Now what?
- If you bought through Google Play you don’t need a code at all — just reinstall from Google Play. The install IS the purchase: the app auto-unlocks on first launch with no buttons to tap, and a fresh install on a new Android device that’s signed in to the same Google account works the same way.
If you have a manually-issued tester code (FARADAY-T2-…) and lost it: codes are deterministic — the same userId always mints the same code — so we can re-issue without storing a list anywhere. Reach out via the contact channel you originally received the code through. Codes are not one-time-use; the same code unlocks any browser, as many times as you want. - I bought the app on Android. Can I use it on my desktop too?
- Yes. Open the Android app, tap /unlock from the menu, and use the USE ON ANOTHER DEVICE button to reveal a
FARADAY-T2-…code. Paste it atfaraday.cam/unlockin your desktop browser. That browser is now unlocked for 30 days. Same code each time, so you don’t need to save it — just re-fetch from the app if you ever clear cookies. Keep the code private: anyone you give it to gets the same access until it’s rotated. - Where can I follow Faraday on social media?
- You can’t — and that’s the point. Faraday has no Twitter / X, Instagram, TikTok, Facebook, Threads, Bluesky, Mastodon, YouTube, Discord, Telegram, or Reddit account. No newsletter, no “community”, no DMs.
If you see an account claiming to be us, it is an impersonator. Do not click links, do not send money, do not paste unlock codes. The only canonical surfaces are faraday.camand the official Play listing at play.google.com/store/apps/details?id=cam.faraday.app.play. The GrapheneOS / sideloadable APK and the iOS App Store are still coming soon — any other download claiming to be Faraday is fake.
Technical specs
- Transport
- 1:1: WebRTC between the two browsers, forced through our TURN relay (TURN over TCP port 3478 by default; the TURN control channel is not TLS-wrapped, media is DTLS-SRTP encrypted end to end). Conferences: WebRTC to a self-hosted mediasoup SFU (one upload per participant, server fan-out to participants and listeners).
- Signaling
- Self-hosted PeerJS broker on turn.faraday.cam:443 (Docker, host networking)
- Media encryption
- DTLS-SRTP. 1:1: keys negotiated browser-to-browser (end-to-end). Conferences: keys negotiated with the SFU (hop-by-hop, not end-to-end).
- ICE policy
- 1:1: relay-only (
iceTransportPolicy: "relay") — no STUN, no host candidates, no public IPs exchanged with the peer; fails rather than falling back to direct. Conferences: browser connects to the SFU; other participants never learn your IP, the SFU does. - TURN credentials
- HMAC-SHA1, 1-hour TTL, minted server-side at /api/turn-creds (coturn use-auth-secret)
- Identity
- 6-char crypto-random session code, in-memory only, regenerated every page load. No accounts, no email, no phone, no persistent storage.
- Visual mask
- WebGL2 fragment shader: DATAMOSH (RGB offset + temporal smear), GLYPH (ASCII quantize), KALEIDO (radial mirror), STREAK (Asendorf luma walk)
- Person segmentation
- MediaPipe Selfie Segmenter, on-device, GPU-accelerated, always on
- Authentication
- SHA-256 of both DTLS fingerprints → 4 words from a 256-word list. Mandatory: remote audio is muted until the user confirms the words match. ~1 in 4 billion odds of a successful MITM per call.
- Destruction cascade
- averaged-blur mosaic + posterize (4 levels) + per-frame crypto-salted noise + 1-bit threshold + channel stomp. Per-session crypto seed lives in shader closure, never exposed to DOM.
- Voice mask
- CBAY DSP — pitch shift, ring modulation, noise injection, bit-crush. WebAudio, on-device.
- Telemetry
- none
- Third-party at runtime
- no third-party scripts, fonts, or models — MediaPipe WASM and segmenter model self-hosted under /wasm and /models. Infrastructure providers listed under Hosting.
- CSP
- default-src 'self'; connect-src 'self' wss://turn.faraday.cam https://turn.faraday.cam wss://turn.faraday.cam:4443 https://turn.faraday.cam:4443; frame-ancestors 'none'
- Security headers
- HSTS preload, COOP same-origin, CORP same-origin, X-Frame-Options DENY, Referrer no-referrer, Permissions-Policy locks camera/mic to self
- Hosting
- Vercel (web app + API), Hetzner VPS (TURN, signaling, conference SFU), Let's Encrypt cert, Google Play (Android distribution + payment)
- Scheduling
- Signed token, zero database, no identity collected. Hosts generate a shareable link for a future meeting; add to calendar with .ics download. The link is the meeting—no server-side record, no persistence. Possession of the link is what grants entry.
- Pricing
- Free (receive 1:1 + listen) · $4.99 one-time (initiate 1:1, host and schedule conferences). On Android the paid install is the purchase; Play users get a transfer code for desktop browsers. No subscriptions, no ads, no tracking.
- Apps
- Android first. Live on Google Play. GrapheneOS / sideloadable APK from this site is coming soon. iOS native + App Store IAP after launch. Web works everywhere today (Chromium, Firefox, Safari).
- Social media
- none — no Twitter/X, Instagram, TikTok, Facebook, Threads, Bluesky, Mastodon, YouTube, Discord, Telegram, Reddit. Any account using the Faraday name is an impersonator.
- Source
- private repo today; public release delayed from Q3 2026 (no new date yet) — blocked on secrets rotated out of git history, the unlock-code HMAC scheme being independently reviewed, and TURN/signaling configs being templated
- Browsers
- any modern Chromium / Firefox / Safari with WebRTC + WebGL2 + getUserMedia
available on
Faraday is not a Pegasus shield. It does not detect spyware already on your device, run in the background while other apps are foregrounded, or protect you from someone sitting next to you with a camera.
What it does: occupies the camera and mic while running, gives you anonymous end-to-end-encrypted 1:1 mask calls with cryptographic line verification, masked group conferences, and an acoustic curtain in the room.
No social media. Faraday has zero official accounts on any platform. If you see one, it’s not us — report and block. Canonical surfaces: faraday.cam and the official Play listing (cam.faraday.app.play). The GrapheneOS APK and the iOS App Store are still coming soon; do not trust any other “Faraday” download until they do.
Privacy PolicyTerms of ServiceSecurity & threat model
v0.1 — live. faraday.cam