Messages are encrypted in your browser before they ever leave it, using a key derived from your private key and the other person's public key (ECDH P-256 + AES-GCM). The server only ever stores and relays ciphertext — it cannot read your messages. Since there is no identity verification, anyone can register any username, so this protects message content, not identity.