diff --git a/nodejs/client/safechat.js b/nodejs/client/safechat.js
index 9304f1b..5dc1458 100755
--- a/nodejs/client/safechat.js
+++ b/nodejs/client/safechat.js
@@ -1,51 +1,10 @@
 #!/usr/bin/env nodejs
 
-var safechat = function(keyserver) {
-  var hkp = new openpgp.HKP(keyserver)
-  return {
-    client: {
-      user: null,
-      createUser: function(name, host, password, success, fail) {
-        openpgp.generateKey({
-          numBits: 4096,
-          userIds: [{name: name, email: name+'@'+host}],
-          passphrase: password
-        }).then(function(keyPair) {
-          user = {
-            name: name,
-            email: name+'@'+host,
-            numBits: 4096,
-            key: {
-              pub: keyPair.publicKeyArmored,
-              priv: keyPair.privateKeyArmored
-            }
-          }
-          hkp.upload(user.key.pub).then(function() {
-            success(user)
-          }).catch(function(e) {
-            fail('upload key failed', e)
-          })
-        }).catch(function(e) {
-          fail('generating key pairs failed', e)
-        })
-      },
-      setUser: function() {
-        
-      }
-    },
-    server: {
-    }
-  }
-}
-
 try {
 
   var package = require(__dirname+'/../package.json')
-  var config = require(package.path.config)
-  var io = require('socket.io-client')
   var program = require('commander')
-  var openpgp = require('openpgp')
-  var fs = require('fs');
+  var fs = require('fs')
   
   program
     .version(package.version)
@@ -58,24 +17,27 @@ try {
     .option('-k, --key <file>', 'pgp key file [key.pgp]', 'key.pgp') 
     .parse(process.argv)
 
-  openpgp.initWorker()
-  openpgp.config.aead_protect = true
-  var client = safechat(program.keyserver).client;
+  var client = require(__dirname+'/../safechat/client')(program.url, program.keyserver)
   
   fs.stat(program.key, function(err, stats) {
     if (err) {
       console.log('generate keys')
-      client.createUser(program.name, program.host, program.password,
-                        function(user) {
-                          fs.writeFileSync(program.key, JSON.stringify(user))
-                          console.log('new user credentials created')
-                        },
-                        function(msg, e) {
-                          console.log("**** ERRROR:", msg, e)
-                        })
+      client.create(program.name, program.host, program.password,
+                    function(user) {
+                      fs.writeFileSync(program.key, JSON.stringify(user))
+                      console.log('new user credentials created')
+                    },
+                    function(msg, e) {
+                      console.log("**** ERRROR:", msg, e, e.stack)
+                    })
     } else if (stats.isFile()) {
-      client.user = JSON.parse(fs.readFileSync(program.key))
-      console.log("user:", client.user.name)
+      client.login(JSON.parse(fs.readFileSync(program.key)), 
+                   function(user) {
+                     console.log('user successfully restored:', user.email)
+                   },
+                   function(msg, e) {
+                     console.log("**** ERRROR:", msg, e, e.stack)
+                   })
     } else {
       console.log('**** ERROR: cannot read file', program.key)
     }
diff --git a/nodejs/makefile.am b/nodejs/makefile.am
index 6b65a81..c5719da 100644
--- a/nodejs/makefile.am
+++ b/nodejs/makefile.am
@@ -8,7 +8,7 @@
 ##       1         2         3         4         5         6         7         8
 ## 45678901234567890123456789012345678901234567890123456789012345678901234567890
 
-EXTRA_DIST = @PACKAGE_NAME@.js package.json.in public routes sockets views database
+EXTRA_DIST = @PACKAGE_NAME@.js package.json.in public routes sockets views database safechat client
 
 nodejsdir = ${pkgdatadir}/nodejs
 
diff --git a/nodejs/package.json.in b/nodejs/package.json.in
index 472794d..9990856 100644
--- a/nodejs/package.json.in
+++ b/nodejs/package.json.in
@@ -4,6 +4,7 @@
   "documentation": "https://dev.marc.waeckerlin.org/doc/safechat/",
   "private": true,
   "dependencies": {
+    "browserify": "^14.3.0",
     "commander": "^2.9.0",
     "ejs": "~2.5.2",
     "express": "2.5.8",
diff --git a/nodejs/safechat/client.js b/nodejs/safechat/client.js
new file mode 100644
index 0000000..b8cf0dc
--- /dev/null
+++ b/nodejs/safechat/client.js
@@ -0,0 +1,83 @@
+module.exports = function(chatserver, keyserver) {
+
+  var package = require(__dirname+'/../package.json')
+  var config = require(package.path.config)
+  var io = require('socket.io-client')
+  var openpgp = require('openpgp')
+  openpgp.initWorker()
+  openpgp.config.aead_protect = true
+    
+  var module = function() {
+    var _hkp = new openpgp.HKP(keyserver)
+    var _user = null
+    
+    this.login = function(user, password, success, fail) {
+      _user = user
+      _hkp.lookup({query: _user.email}).then(function(key) {
+        var data = (new Date()).toLocaleString()+' '+_user.name+' '+_user.email
+        console.log('data:', data)
+        var pubkeys = openpgp.key.readArmored(key)
+        var privkey = openpgp.key.readArmored(_user.key.priv).keys[0]
+        privkey.decrypt(password)
+        if (pubkeys.keys.length==1) {
+          openpgp.encrypt({
+            data: data,
+            publicKeys: pubkeys.keys[0],
+            privateKeys: privkey
+          }).then(function(ciphertext) {
+            openpgp.decrypt({
+              message: ciphertext,
+              publicKeys: openpgp.key.readArmored(_user.key.pub).keys[0],
+              privateKey: privkey
+            }).then(function(plaintext) {
+              if (data==plaintext) {
+                success(_user)
+              } else {
+                fail('local key does not match key on server')
+              }
+            }).catch(function(e) {
+              fail('decryption failed', e)
+            })
+          }).catch(function(e) {
+            fail('encryption failed', e)
+          })
+        } else {
+          fail('more than one public key on server', pubkeys.keys)
+        }
+      }).catch(function(e) {
+        fail('check key on server failed', e)
+      })
+    }
+    
+    this.create = function(name, host, password, success, fail) {
+      var _this = this
+      openpgp.generateKey({
+        numBits: 4096,
+        userIds: [{name: name, email: name+'@'+host}],
+        passphrase: password
+      }).then(function(key) {
+        _user = {
+          name: name,
+          email: name+'@'+host,
+          numBits: 4096,
+          key: {
+            pub: key.publicKeyArmored,
+            priv: key.privateKeyArmored
+          }
+        }
+        _hkp.upload(_user.key.pub).then(function() {
+          console.log('key successfully uploaded')
+          _this.login(_user, password, success, fail)
+        }).catch(function(e) {
+          fail('upload key failed', e)
+        })
+      }).catch(function(e) {
+        fail('generating key pairs failed', e)
+      })
+    }
+    
+  }
+
+  return new module();
+  
+}