Security Update March 2026 4 min read

BurnChat v2.9 — Claim Your Name, Lock It Down 🔐

Two new commands let you own your nickname in any room. Plus a major security pass: password hashing, XSS protection across the board, rate-limited admin endpoints, and a dozen bug fixes. Same ephemeral promise. Much harder to break.

Nickname Registration & Login

BurnChat is anonymous by design. No accounts, no emails, no sign-ups. But there was a problem: anyone could join a room and take your name. If you stepped away for five minutes, someone else could show up as "you."

Now you can reserve your nickname inside any room. Two new commands make it work:

CommandWhat it does
/register nickname passwordReserve your current nickname with a password. Must be your active nick. Password must be at least 4 characters. Limit: 100 registrations per room.
/login nickname passwordReclaim a registered nickname. If someone else is using it, they get bumped to a random name. Your password is hashed with SHA-256 — even BurnChat can't read it.

How it works

When you register, the server stores only a SHA-256 hash of your password — the plaintext is never saved. If someone tries to join with your registered name, they're automatically assigned a random suffix (like yourname-742) and told to use /login to reclaim it.

If you /login while someone else is squatting on your nick, they get force-renamed to a random fallback. Your identity follows your password, not your connection.

This is still ephemeral. Registrations live in RAM, scoped to the room. When the room burns or the server restarts, every registration vanishes. No database. No persistence. No trace. It's identity protection that's as temporary as the conversation itself.

Security Hardening

This release includes a comprehensive security audit and fixes across the entire codebase. Here's what changed:

Passwords are now hashed everywhere

Room passwords, admin passwords, and registered nickname passwords are all stored as SHA-256 hashes. Previously, room and admin passwords were stored in plaintext in RAM. Now an attacker with memory access would only see hashes.

XSS protection

Every piece of server-supplied data rendered via innerHTML is now escaped through a client-side escHtml() function. This covers room rules, announcements, warnings, poll options, the online list, dice results, /me actions, room info, and snake game stats. Defense in depth: the server already escapes most data, and now the client does too.

Admin endpoint hardening

The admin API now uses timing-safe password comparison (crypto.timingSafeEqual) to prevent timing attacks. We also added rate limiting: more than 10 failed attempts per minute from the same IP will lock you out. Brute force won't work.

Bug Fixes

We squashed a lot of bugs in this release. The highlights:

Memory safety

Unbounded collections were a slow memory leak. The banned list, mute list, and registered nicknames map all now have hard caps (200, 200, and 100 respectively). A malicious admin can no longer grow these lists indefinitely.

New Commands Summary

CommandDescription
/register name passReserve your current nickname with a password
/login name passReclaim a registered nickname in the current room

These join the existing 39+ slash commands. Type /help in any room to see the full list.

🔐

Try BurnChat v2.9

Create a room. Register your name. Burn it when you're done.

Open BurnChat