🔥 Exciting news 🔥 Encrypted media and pinned messages🖼🔐📌
Now you can share files and media in Cordn, and it is end-to-end encrypted. Also messages can now be pinned to the top of the chat. ✨
We added a new application spec to Cordn that defines how to encrypt and decrypt media for the chat. A photo or document is sealed on your device before it ever leaves, with a key derived from the group's own shared session, and only members can derive the same key to unlock it. The coordinator and the storage layer only ever see opaque bytes. They can store and relay the file, but they can't read it.
For storage, the default is Blossom, though the spec doesn't mandate it. That keeps Cordn aligned with the Nostr ecosystem's media layer while leaving room for other backends. The practical size limit for a file comes from whatever server you choose.
In the web app you can now upload and share files and media straight into your groups. You can configure which servers Cordn uses for uploads, and we ship a curated list of Blossom servers that are friendly to opaque encrypted bytes.
Any media link you paste into a message also renders inline now, so an image or video URL shows up as a preview instead of a bare link. And under Config → Media you can choose whether images and avatars load automatically, useful on a metered connection.
The second feature is pinned messages for groups. Anyone in a group can pin a message, and pinned ones gather in a carousel at the top of the chat. Jump straight to any of them, or open the full list to see them all and unpin. Each pin shows who pinned it.
A lot of media polish landed alongside:
• Tap any image to open it full-screen: zoom in or out (even past 100%), drag to pan, double-tap to fit, and save a copy.
• Download any shared file or image straight from its message menu.
• Media you've opened stays loaded when you scroll away and come back.
• Links, mentions, and previews now render in the message info panel too, not just in the chat.
• Avatars and banners respect your "load avatars" choice everywhere: chat bubbles, profile cards, and the group and direct-message list.
The complete list is available at
https://cordn.net/chat/news
Aren't you using Cordn yet? Just start chatting at
https://cordn.net/
If you like the project and want to see it grow, please consider contributing in any way you can. Every bit counts, report a bug, contribute with your expertise, send some sats. We are building this together in the open 💛
There's an expectation so basic it barely feels worth saying: if you join a group on your laptop, it should be on your phone too. Your account, your groups, on whatever device you're holding.
Until now, Cordn couldn't do that, and getting there took real engineering (and almost 2 weeks of work). This is one of the largest changes Cordn has shipped, because the obvious-sounding behavior required a genuinely non-obvious design.
The hard part is that MLS, the encryption protocol Cordn groups run on, doesn't hand you multi-device for free. There are two honest ways to add a device, and they pull in opposite directions.
The way the standard envisions makes each device its own member of the group, with its own keys and its own state. That's a legitimate model with real virtues: you can revoke a single device, and one compromised device doesn't compromise the others. It also has real costs: adding a device means an explicit invite every time, if you join a group you need to invite all your devices, and the group's membership structure reveals how many devices you run. In practice, people who wanted multi-device today were already doing a rough version of this by hand. They'd create a second account on the new device and add it to the group as a separate member.
We went the other way. Your devices share one identity inside every group. One set of keys, one membership, the same state replicated across all of them. Link a device once with a connection string, and from then on:
- A group you join or create on one device appears on the others, automatically.
- Remove a group from your list, and it's gone everywhere.
- Nothing to invite, nothing to babysit.
Because every device is the same member, the group can't tell how many you're running either, so your hardware footprint stays yours.
Under the hood this required solving a stack of genuinely hard problems: how devices reconcile state, how offline catch-up recovers messages without losing them, how deletions stick across the fleet, what happens when two devices act at once. The good news is you don't have to think about any of it. Turn on sync, link your devices, and the complexity stays out of sight.
This isn't free, and we want to be straight about the trade. Sharing the same state across devices means we give up per-device security. But the catastrophic case is losing your account key and your connection string together, but even then MLS's forward secrecy and post-compromise security still hold, rekeying/rotating the string recovers you, and no one else in your groups is affected.
Importantly, this doesn't replace the standard approach. It's an alternative, and both are legitimate. The RFC's per-device model gives you security properties ours trades away; ours gives you seamless sync and a hidden device count it structurally can't. Multi-device is entirely opt-in: nothing changes unless you explicitly turn it on and link devices. If you prefer the manual, per-device way, you can keep right on doing it. Nothing is forced on you.
We worked hard to catch the edge cases, and it's mature enough to depend on. But it's new, so treat it as experimental, and if you hit a bug, tell us.
The full design (every decision, every tradeoff, every invariant) is in the spec: 
