Client masking
05Each client frame uses a new unpredictable masking key, repeated across its payload bytes.
Terms in this drawing
Related RFCs and changes
“Updates” changes part of an earlier RFC. “Obsoletes” replaces it. This list shows selected related documents.
DIAGRAM§ 5.3 ↗
RFC 6455 · § 5.3EXAMPLE
3 / 3
03
Recover the original payload.
The server uses the transmitted key; anyone observing the key can also undo the mask.
Protocol participantThreat or exceptionProtocol controlSimplified drawings · precise section references
Read the updated RFC section ↗
Mask every client frame; use TLS for confidentiality.
- The client chooses a fresh unpredictable 32-bit masking key for every frame, including control frames.
- Payload byte i is XORed with key byte i modulo 4. The receiver uses the same operation to recover it.
- Masking protects intermediaries from attacker-chosen wire patterns; the key travels with the frame, so masking does not hide content.
The byte example is deliberately tiny. Masked client frames and unmasked server frames are required even when TLS is used.
Read the RFC section ↗Diagrams simplify the RFC. Read the linked sections for complete requirements.
Privacy