StrangR: Exposed

Checked 3 October 2026. Client bundle index-BxW-GTpl.js.

StrangR says it is the safest place to talk to a stranger.

The live app is at strangr93.vercel.app. The page calls itself anonymous, account-free, moderated, and 18+. The JavaScript and the signup API tell a plainer story: a 30-day account, a display name the server picks for you, an age field that starts at 13, and chat text the server can read.

Several other websites use the word Strangr. This page is about this deployment and the API it calls, strangr-90k3.onrender.com. The site does not name an operator, a company, or a privacy policy.

0
Routes for the Community Guidelines the homepage says you agree to.
13
Youngest age the settings form accepts, under an "18+ Only" badge.
30 days
Session cookie set by the first request, before you pick a name.
930
Points required before the client will send an image or a voice note.

What opened when a new session started

The homepage asks you to pick Male, Female, or "Prefer not to say." That click sends POST /api/auth/initialize. On 3 October 2026 a fresh call returned a user who had not typed a name. The server had already chosen one.

Names returned for new sessions that day included Tom, Shrek, Joker, Batman, Sailor Moon, and Wolverine. The account also got a 10-character hex username, points: 0, and is_new_user: true. Age, country, and topic were empty. The response set this cookie:

strangr_session=<uuid>; Max-Age=2592000; Path=/; HttpOnly; Secure; SameSite=None

Thirty days. The browser will send it to the API on a different host from the page, which is what SameSite=None is for. The UI and the chat server are not the same site: the page is on Vercel, the API is a Render service behind Cloudflare.

What a stranger sees

When someone joins a room, the client stores their username, display name, age, gender, country, and topic. The subtitle under the name is the word "Anonymous" only when age, gender, and country are all blank. The display name is still the name the server assigned, or whatever you later type into Settings.

Settings says the topic line "is visible to other users when you are in a room." The username field says "Your username is your permanent identity."

What "encrypted" means in this build

On a 1-on-1 match, the composer footer reads "Encrypted in transit ยท Anonymous." The send function in the bundle is:

this.socket.send(JSON.stringify(e))

The socket is wss://strangr-90k3.onrender.com/ws. TLS ends at that server. The bundle has no crypto.subtle calls and no end-to-end encryption library. Text, and the JSON headers on images and voice notes, are readable by whoever operates the API.

Pages