A privacy-first, terminal-based peer-to-peer messenger with end-to-end encryption. Your messages never touch a server. No accounts. No surveillance. Just secure, direct communication.
paste this in PowerShell, or see all install options ↓
Multi-layer cryptography: X25519 key exchange, AES-256-GCM message encryption, and Ed25519 message signing. Every message is authenticated and tamper-proof.
After handshake via signaling, all traffic flows directly peer-to-peer via Cloudflare tunnels. The server never sees your messages or keys — ever.
Your identity is your cryptographic keypair, generated locally. No email, no phone number, no registration. Just launch and connect.
Clean, distraction-free TUI built with BubbleTea. Works over SSH, on remote servers, and anywhere a terminal runs. No browsers, no Electron.
Download one file. Run it. Works on Linux, macOS, and Windows. No runtime, no npm, no pip, no Docker. Just a single Go binary.
TOFU peer verification alerts you if a peer's key ever changes, protecting against man-in-the-middle attacks after the first successful connection.
// 03 — Architecture
On first run, DecentChat generates your X25519 encryption keypair and Ed25519 identity keypair locally. Your private keys never leave your device.
Your public keys and Cloudflare tunnel URL are shared with the signaling server (Supabase). This enables peer discovery — nothing else.
Select a peer by their truncated ID. DecentChat initiates a direct P2P connection via their tunnel URL and performs X25519 key exchange.
All messages are encrypted with the shared AES-256-GCM key and signed with Ed25519. The signaling server is now completely out of the picture.
// Architecture Diagram
// 04 — Comparison
| Feature | Traditional Messengers | DecentChat |
|---|---|---|
| Message Storage | Stored on company servers | ✓ Never stored anywhere |
| Encryption Control | Trust the server's encryption | ✓ You control the keys |
| Identity | Email, phone, or account required | ✓ Cryptographic keypair only |
| Point of Failure | Central server = single failure point | ✓ Direct P2P, no middle-man |
| Metadata | Extensive metadata collection | ✓ Minimal metadata, privacy-first |
| Server Breach Risk | All messages exposed on breach | ✓ Nothing to breach — no storage |
// 05 — Cryptography
Elliptic curve Diffie-Hellman key exchange. Establishes a shared secret between peers without transmitting private keys. Industry-standard, efficient, and mathematically robust.
Authenticated encryption providing both confidentiality and integrity in a single operation. Messages cannot be read or tampered with during transit — guaranteed.
Every message is digitally signed for authentication and non-repudiation. You can always verify who sent a message and that it hasn't been altered.
// 06 — Installation
Windows users can install with a single PowerShell command. Linux/macOS users clone the repo and build. Keys are generated automatically on first run.
Run in PowerShell as Administrator. Downloads the binary, installs it locally, and adds it to your PATH automatically.
decentchat and start chatting
// Quick Start
// 07 — Get Involved
Open source, community-driven, and built for people who take privacy seriously. Star the repo, open an issue, or send a PR.