[geal]

From what I see:

* everything is done server side -> trust issues

* no encryption, just indexed by a hash -> that means the messages are not store encrypted on the server

I would recommend people stay away from your solution, and instead use something like Zerobin: http://sebsauvage.net/paste/ It encrypts everything using SJCL, and if I am worried with the server sending me a modified version of the JS code, I can still keep the code on my own computer but use it to send to the server.

[1337Coder]

Yes, it is encrypted on the server. That hash is just a key to get your message. Its not the message itself.