Privacy First
End-to-End Encryption
Optional E2EE for your meetings. The server relays encrypted media — only participants can decrypt. Your keys, your data, your control.
How It Works
Three simple principles that keep your meetings private from server to screen.
Toggle E2EE On
Enable E2EE per room in the settings. A toggle — not a config file edit.
Share the Key
Encryption keys live in the URL fragment — never sent to the server. Share the link securely with participants.
Blind Relay
The LiveKit SFU forwards encrypted frames without decryption. The server never sees your video or audio content.
Zero-Knowledge Architecture
Client-Side Key Generation
Encryption keys are generated in the browser. Never transmitted to or stored on the server.
Blind SFU Relay
LiveKit forwards encrypted RTP frames as-is. No decryption, no inspection, no recording of content.
Insertable Streams API
Encryption operates at the WebRTC frame level via RTCRtpSender and RTCRtpReceiver transforms.
Web Worker Isolation
Cryptographic operations run in a dedicated background thread. The main UI thread never handles raw keys.
Architecture
Data never touches the server in cleartext. Here is how the encrypted path works end to end.
Media Feed
Frame payload
Outbound Pipeline:
Relaying encrypted frames
Server can read frames (plaintext)
SFU Pipeline:
Decoded Output
Frame payload
Inbound Pipeline:
Platform Support
E2EE works across every Bedrud client. Each platform uses its LiveKit SDK's native E2EE support.
Web
Android
iOS
Desktop
Key Features
What makes Bedrud E2EE different from platform-controlled encryption.
Per-Room Control
Enable E2EE on individual rooms. Keep public rooms open and secure sensitive meetings.
Zero-Knowledge Server
Your self-hosted server never holds encryption keys. Even you — the infrastructure owner — cannot decrypt participant media.
Recording Not Possible
When E2EE is enabled, the server cannot record or transcribe meeting content. Privacy is enforced by the encryption layer.
Fully Auditable
Every line of the encryption pipeline — from key generation to frame transform — is open source under Apache 2.0.
Try It Yourself
Join a live demo meeting with E2EE enabled. No account, no install, no commitment.