Self-hostable, end-to-end encrypted, real-time messaging. A blind-relay server that cannot read your messages — proven by the build graph, not a promise. Your server. Your keys. Your rules.
$ curl -fsSL https://netherchat.com/install | bash
macOS · Linux · Windows (WSL2) · or docker run -p 3000:3000 salkreiner/netherchat
The encryption lives in the client. The server is a blind relay — it routes ciphertext and sealed key blobs it has no key to open.
The crypto package lives under tui/internal; Go's rules make it physically unreachable from
the server binary. CI fails if that ever changes. It's a property of the import graph, not marketing.
Identities are generated and stored on each device. Room keys are wrapped per-recipient with
nacl/box and relayed as opaque blobs. No escrow, no recovery — by design.
No analytics, no phone-home, ever. By default nothing is written to disk — rooms evaporate when empty. A Wireshark capture shows ciphertext only.
Honest about limits: forward secrecy is per-epoch (not per-message), and the group key-distribution layer is custom over audited primitives — slated for external review before any paid tier, with MLS (RFC 9420) as the migration target. See encryption.md.
Designed to scale to everyone else without compromising the developer experience.
X25519 + XChaCha20-Poly1305 + Ed25519, audited pure-Go and WebCrypto-grade primitives. The same crypto in the terminal and the browser.
No runtime, no dependencies. A ~7 MB FROM scratch image, or a single binary per platform. curl … | bash and you're done.
A modern TUI for power users and this web client for everyone else — both speak one documented wire protocol to the same server.
nether, abyss, ember, ghost, sprinkles, dracula, gruvbox, solarized — switch with no reload. Try the picker above.
echo "deploy done" | netherchat send #ops. Every room gets an inbound webhook for CI and alerts.
/vanish rotates the room key and clears history. Room TTLs, one-time invite tokens, invite-only rooms.
$ docker run -p 3000:3000 salkreiner/netherchat
$ curl -fsSL https://netherchat.com/install | bash
Share a one-time /break-glass link. Anyone clicks it, types a name, and they're in the room — no install, no account.