Text and files are AES-GCM encrypted in your browser before upload when a passphrase is set. Both people must use the same passphrase. File names, sizes, timestamps and sender are not encrypted. Passphrases cannot be recovered. A compromised device or browser can still read your chat.