FEATURES

Everything you need,
nothing you don't.

MeshTalk does encrypted peer-to-peer messaging and not much else. That's the point.

End-to-End Encryption

Every message is encrypted with ephemeral X25519 keys and AES-256-GCM. The transport layer adds its own authenticated encryption on top. Even if someone intercepts your traffic, they see nothing.

  • → Ed25519 identity signing for all peer authentication
  • → Per-chunk forward secrecy for file transfers
  • → The control service never sees plaintext
peer_a creates ephemeral X25519 keypair
peer_a signs handshake with Ed25519 identity
peer_b verifies signature, derives transport keys
→ HKDF-SHA256 → directional AES keys
→ session confirmed with key proof
$ meshtalk
✓ LAN peer discovered: Alice (a3f8...c12)
✓ TCP connection established
$ Hello Alice!
Alice: Hey! Connected via LAN, no internet needed.

LAN-First Discovery

MeshTalk broadcasts on UDP port 24890 to find peers on your local network. No router configuration, no STUN, no internet connection needed. The lower peer ID opens an authenticated TCP connection to the higher.

  • → Zero-configuration peer discovery
  • → Works on air-gapped networks
  • → Automatic path selection: LAN > direct UDP > relay

Remote Connections

When peers are on different networks, MeshTalk uses STUN to punch through NATs. Direct UDP is preferred; the embedded DERP relay is the fallback for restrictive networks.

  • → STUN-assisted NAT hole punching
  • → Reliable, fragmented, authenticated UDP transport
  • → Embedded DERP relay when direct fails
STUN → discover public endpoint
UDP → hole punch via NAT mapping
SIGN → Ed25519 handshake proof
HKDF → derive transport keys
→ authenticated encrypted channel
fallback: DERP relay over wss://
$ meshtalk room create "Project Team"
✓ Room created. Invite copied to clipboard.
meshtalk-group:a3f8c12...b91.7e2d...f4a.encrypted_metadata
$ meshtalk group_send "Project Team" "Meeting at 3?"
✓ Sent to Alice (delivered)
✓ Queued for Bob (offline)

Named Group Chats

Create named rooms with invite links. Each message is encrypted independently for every group member — no shared group key. Offline members get durable queue entries that flush on reconnect.

  • → Per-recipient E2EE (no group key)
  • → Offline message queuing with delivery status
  • → Local-only history, no server-side replay

File Transfer

Send files up to 50 MiB directly to peers. Each chunk is individually encrypted with a fresh ephemeral key. Supports image preview, resume on partial transfers, and group file fan-out.

  • → Up to 50 MiB per file, chunked E2EE
  • → Image preview for received images
  • → Clipboard paste to send (Ctrl+V)
OFFER → file metadata (name, size, chunks)
CHUNK → individually E2EE with ephemeral key
ACK → completion status or missing ranges
→ resume from where you left off