SECURITY • MAY 2026

Frame-by-Frame Encryption via Insertable Streams.

We already implemented ECDH End-to-End Encryption (E2EE) for keystrokes, but encrypting a live 60fps pair-programming video feed is significantly harder. Traditionally, developers had to pipe raw Canvas frames through JavaScript, encrypt them, and send them over WebSockets—a process that destroys framerates and introduces massive latency.

NitroIDE achieves absolute zero-knowledge video conferencing by utilizing the experimental WebRTC Insertable Streams API (often called the Breakout Box API). This allows us to intercept the hardware-encoded video frames before they hit the network, and apply AES-GCM encryption natively.

The Breakout Box Pipeline

When you start a screen share, the browser's hardware encoder compresses your screen into H.264 or VP8 frames. The Insertable Streams API exposes these encoded frames as a ReadableStream. We pipe this stream through a Web Worker, encrypt the raw byte payload using the Web Crypto API, and pipe it back into the RTCRtpSender.

// Intercepting encoded WebRTC frames for custom encryption
const sender = peerConnection.addTrack(videoTrack);
const streams = sender.createEncodedStreams();

// Pipe the encoded frames through a custom TransformStream
const transformStream = new TransformStream({
  transform: async (encodedFrame, controller) => {
    // 1. Extract the raw encoded video bytes
    const view = new Uint8Array(encodedFrame.data);

    // 2. Encrypt the frame via AES-GCM using our shared ECDH key
    const cipherText = await crypto.subtle.encrypt(aesAlgorithm, sharedKey, view);

    // 3. Replace the frame payload and send it over the wire
    encodedFrame.data = cipherText;
    controller.enqueue(encodedFrame);
  }
});

streams.readable.pipeThrough(transformStream).pipeTo(streams.writable);

Preserving Metadata: We carefully encrypt only the frame payload, leaving the RTP header unencrypted. This allows the underlying WebRTC routing servers (TURN/STUN) to efficiently route the packets and manage bandwidth drops, without ever having the cryptographic ability to actually view the pixels.

Absolute Enterprise Privacy

Even if an attacker compromises the signaling server, or a rogue ISP intercepts the UDP packets, all they will capture is high-entropy, mathematically uncrackable noise. Your proprietary code screenshare remains securely locked between the two communicating browsers.

Share Securely.

Start a video call in your workspace with mathematically guaranteed privacy.

Launch Collaborative IDE