WebRTC Relay Server
Introduces two WebRTC peers, then gets out of the way.
A single-file, one-dependency WebSocket relay that solves WebRTC's bootstrapping problem: two peers need to swap connection details before they can talk directly, but have no channel to do it over until they're already connected. WebRTC Relay Server mints a one-time connection key, relays the handshake, and forgets both peers the instant they pair up. It's the signaling server behind Privatta's internet P2P mode — and it's open source, so anyone can run their own instead of trusting ours.
What it does.
WebRTC peers can't introduce themselves.
Two machines that want to talk directly first have to exchange SDP offers and ICE candidates — but they have no channel to trade them over until they're already connected. WebRTC Relay Server is the one thing standing between them: a WebSocket relay that carries just enough information to get a direct connection started, then has nothing left to do.
- Relays SDP/ICE payloads only — never files, never credentials
- Closes its own connection the moment the data channel opens
- No database, no persistence — the entire state is one in-memory Map
One-time keys instead of accounts.
The initiating peer sends create; the server mints an unguessable 32-character key and hands it back. That peer shares the key with exactly one other person, out of band. The second peer presents it via join — the server checks it against the live room table, and a key it never issued is refused outright. No client ever picks its own key, and no room outlives its 5-minute handshake ceiling.
- Keys are ~190 bits of CSPRNG entropy — unguessable, never client-chosen
- join never creates a room; an unknown or expired key is refused
- A third peer presenting a valid key is turned away without disturbing the pair
It can't log what it has no parameter for.
The logging function takes one fixed string and nothing else — no format argument, no object parameter, no way to pass an IP address, a connection key, or a payload through it even by accident. That's a property of the code, not a promise in a privacy policy, and the file is short enough to read in one sitting to confirm it yourself.
- One dependency (ws), which itself has zero transitive dependencies
- npm ls --all proves the entire audit surface in one command
- Open source — read it, or run your own instance instead of ours
1function log(event) {2 if (config.silent) return;3 // fixed string only — no IP, key,4 // or payload can pass through here.5 process.stdout.write(`[signaling] ${event}`);6}
Everything else it does.
One dependency, forever
Just ws, which has zero transitive dependencies of its own. The entire audit surface is one file plus one well-known library.
Nothing lingers
A room is deleted the instant either peer disconnects, or after a 5-minute handshake ceiling if nobody ever pairs. No sweep job, no tombstones.
Deploy your way
One file, no database. Run it via systemd + nginx, Docker, or one-click on Railway, Render, or Heroku.
Not just for Privatta
It's a generic WebRTC rendezvous point. Any project that needs to introduce two peers and step out of the way can point at it — or fork it.
Questions we hear often.
This is the public signaling server behind Privatta's internet P2P mode. Point any WebRTC client at it — or run your own instance from the source above and use that instead.
Talk to the team that actually builds the software.
Pilot deployments, volume licensing, product demos, security questionnaires — all handled by engineers and product leads, not a routing layer. We respond within one business day.
Send us a message
Leave your details and we'll follow up within one business day.