GitHub - gh0st68/CryptIRC: Self-hosted encrypted IRC client. Rust backend with 24/7 connectivity, Signal Protocol E2E for DMs, AES-256-GCM encrypted logs and channel keys. Native apps for Windows/Linux/macOS plus installable PWA for iOS/Android.

End-to-end encrypted IRC client for the web

🎨 Browse the live Theme Gallery · Launch the hosted client · Download apps

For support, bugs, or just want to stop by:
irc.twistednet.org — #dev & #twisted

👻 Developed by gh0st

Don't feel like setting up your own? Use ours — free.
Register at https://client.twistednet.org/cryptirc
_{Your vault key is derived from your passphrase on your device. The passphrase is never sent to the server or stored anywhere. All your logs, DMs, credentials, and notes are encrypted with that key before they touch disk — even we can't read them.}

_{Installable PWA — same client, on your phone.}

What is CryptIRC?

CryptIRC is a self-hosted, encrypted IRC client that keeps you connected to IRC 24/7 from any device. Your server maintains persistent connections to all your IRC networks — so you never miss a message, even when all your devices are off. When you come back, your full history is waiting, encrypted and synced.

No plugins. No telemetry. No third parties. You own everything.

Available Everywhere

The desktop apps and PWA give you push notifications, offline caching, and a native app feel. The web version works anywhere with a browser.

Encryption — Everything is Encrypted

CryptIRC encrypts everything before it touches disk. The server cannot read your messages, logs, or credentials.

• Encrypted logs — every message stored on the server is encrypted with your personal vault key (AES-256-GCM). Even the server admin can't read them.
• Signal Protocol E2E for DMs — private messages use the same encryption as Signal: X3DH key agreement + Double Ratchet with authenticated headers. Forward secrecy and deniability built in.
• Channel encryption — set a pre-shared AES-256-GCM key on any channel. Only people with the key can read messages.
• Encrypted credentials — IRC passwords, NickServ passwords, SASL secrets are all encrypted at rest with your vault key. Never stored in plaintext.
• Encrypted notepad — private notes encrypted server-side with your vault key.
• Vault system — your master passphrase derives an encryption key via Argon2id. Lock the vault and the key is zeroed from memory. Auto-lock after configurable idle time.
• Zero-knowledge architecture — the server is a dumb relay. It cannot decrypt anything.

Key Features

• 24/7 connectivity — your server stays connected to IRC around the clock, logs everything encrypted, and syncs across all your devices
• Multi-network — connect to as many IRC networks as you want simultaneously
• Multi-device sync — messages, favorites, settings, unread counts sync across all your devices in real-time
• Push notifications — get notified on your phone or desktop when someone DMs or mentions you, even when the app is closed
• 172 themes (32 animated — starfields, rain, aurora, Matrix code — plus a pixel-perfect mIRC Win95 skin: title/menu/tool/status bars, <nick> brackets, [HH:MM] timestamps) + 139 fonts, a live theme gallery, and a full custom theme editor
• 🐑🦀👻 Desktop pets — three to pick from (desktop, mobile, or both): the classic '95 eSheep (wanders, climbs walls, naps, UFO abduction), a furious Angry Crab (scuttles sideways, snaps its claws, eats shrimp, naps, digs — drag it around, and it pesters the sheep), and a friendly Ghost (floats freely, fades through walls, the odd spooky "BOO!"). The sheep and crab are draggable
• In-app News & changelog with an auto-versioning build badge, so you always see exactly what changed
• Full IRCv3 support — 17 capabilities including typing indicators, away-notify, SASL, MONITOR
• 100+ slash commands — everything from /ascii art to /ud Urban Dictionary lookups
• Nick monitoring — track when specific users come online/offline with push alerts
• Inline media — images, videos, YouTube rich cards, audio player, link previews
• Mobile-first PWA — swipe gestures, safe-area support, works perfectly on iOS and Android
• Single Rust binary — deploy in one command on any Linux server

Deployment

• Single binary — one cargo build and you're done
• Interactive deploy script for Debian/Ubuntu and Arch Linux with Caddy, Postfix, and systemd
• Automatic HTTPS via Caddy + Let's Encrypt
• Hardened systemd unit with full sandboxing (ProtectSystem, PrivateTmp, restricted syscalls, no capabilities)
• Automatic backups on update — last 5 snapshots of all user data kept in /var/lib/cryptirc-backups/
• Existing Caddyfile backed up before overwriting — safe for servers already running Caddy

Quick Start

# Clone
git clone https://github.com/gh0st68/CryptIRC.git
cd CryptIRC

# Deploy (Debian/Ubuntu) — single command, sets up everything
sudo bash deploy/deploy.sh yourdomain.com admin@yourdomain.com

That's it. Visit https://yourdomain.com, register an account, unlock your vault, and connect.

Features

Themes & Personalization

172 built-in themes — 140 static + 32 animated (starfields, forest rain, aurora, Matrix code, the UFO/eSheep alien sequence, synthwave grids, and more), including a pixel-perfect mIRC skin with full Windows-95 window chrome. Each is hand-tuned across a 10-color palette. Plus a full custom theme editor (build your own, drop in a background image, customize link colors) and a separate mobile theme, so your phone and desktop can look completely different.

🎨 Browse the live Theme Gallery →
_{every theme rendered as a live miniature IRC window in its own palette — search, filter, and preview all 171}

A taste of the range:

…and ~140 more — see them all in the gallery.

Encryption & Security

• Per-user vaults -- each user has their own passphrase and encryption key (Argon2id KDF + AES-256-GCM)
• Signal-protocol E2E for direct messages -- X3DH key agreement + Double Ratchet with authenticated headers
• Channel encryption -- pre-shared AES-256-GCM keys for group channels
• Encrypted logs -- every line encrypted at rest with the user's vault key
• Encrypted notepad -- private encrypted notes stored server-side
• Encrypted credential storage -- IRC passwords, NickServ passwords, and SASL secrets never stored in plaintext
• Vault lock/unlock -- locking the vault zeros the key from memory and disconnects IRC
• Vault auto-lock -- configurable idle timer (5min–2hrs) automatically locks the vault
• Client TLS certificates -- generate and manage ECDSA P-256 certs for SASL EXTERNAL
• Zero-knowledge architecture -- the server cannot read your messages or credentials
• SASL PLAIN protection -- refuses to send credentials over unencrypted connections
• Upload metadata stripping -- all uploads are automatically scrubbed of metadata before being saved to disk:
  • JPEG: strips all APP1–APP15 markers (EXIF, XMP, IPTC, GPS coordinates, camera make/model, lens info, timestamps) while preserving APP0 (JFIF), quantization tables, Huffman tables, and image data
  • PNG: removes all ancillary chunks (tEXt, iTXt, zTXt, eXIf, dSIG, tIME) while preserving critical chunks (IHDR, PLTE, IDAT, IEND) and safe ancillary chunks (tRNS, gAMA, cHRM, sRGB, iCCP, pHYs)
  • Video/Audio (MP4, WebM, MP3, OGG, WAV, FLAC): uses ffmpeg to strip all metadata containers (-map_metadata -1) while copying streams untouched — no re-encoding, no quality loss
• Block private messages -- +g mode with one-time notification per sender (3-hour cooldown)
• Session manager -- view and revoke active sessions across devices
• Message expiry -- configurable auto-delete of local message buffers (1hr–7days)
• Client-side rate limiting -- configurable flood protection (200ms–3sec between messages)
• Timing-safe comparisons -- registration codes use constant-time comparison with no length oracle
• XSS hardened -- no inline onclick injection, prototype-pollution-safe E2E objects, comprehensive HTML escaping
• CSP headers -- Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy
• Password complexity -- requires uppercase, lowercase, digit, and special character

IRC & IRCv3

• Full IRC protocol support -- channels, DMs, modes, kicks, bans, CTCP, the works
• IRCv3 capabilities: away-notify, account-notify, extended-join, server-time, multi-prefix, cap-notify, message-tags, batch, echo-message, invite-notify, setname, account-tag, userhost-in-names, chghost, labeled-response, typing indicators, standard-replies, MONITOR
• IRCv3 CAP toggle -- enable/disable individual capabilities per network in settings
• SASL PLAIN & EXTERNAL authentication
• Multi-network support -- connect to as many networks as you want simultaneously
• Nick monitoring -- track when users come online/offline with push notifications
• KeepNick -- irssi-style nick keeper with ISON polling, QUIT/NICK event detection, and auto-reclaim
• Auto-identify -- automatically send NickServ IDENTIFY on connect (encrypted credential storage)
• Auto-rejoin on kick -- automatically rejoin channels after being kicked (with saved channel keys)
• Channel key manager -- store and auto-send channel keys (+k) when joining
• Multi-device sync -- messages you send on one device appear on all your other devices
• Typing indicators -- see when someone is typing (IRCv3 draft/typing)
• Server-time -- accurate timestamps from the IRC server
• ZNC playback detection -- detects and batches ZNC buffer playback with summary markers
• Self-signed cert detection -- popup warning with one-click fix for ZNC/bouncer TLS errors
• Status message condensing -- Lounge-style grouped join/part/quit (Show All / Condense / Hide)
• Configurable join/part/quit message filtering
• Infinite scroll -- load older messages from encrypted server logs on demand

Interface

• Lounge-style layout -- clean input bar, grouped nick list, collapsible panels
• Mobile-first PWA -- installable on iOS/Android with swipe gestures and safe-area support
• iOS PWA keyboard handling -- works perfectly with iOS keyboard accessory bar
• Collapsible panels -- sidebar and nick list collapse on desktop with persistent state
• Nick list grouped by role -- Owners, Admins, Operators, Half-Ops, Voiced, Users
• Nick context menu -- whois, query, slap, monitor, notes, kick/ban/voice/op based on power level
• Clickable nicks in messages -- nick mentions in chat text are colored and clickable
• Smart tab completion -- prioritizes most recent speakers, with Tab cycling
• @nick autocomplete -- type @ to search and insert channel nicks
• #channel autocomplete -- type # to autocomplete channel names
• Inline media previews -- images, videos (.mp4/.webm/.mov), YouTube rich cards with title/author
• Inline audio player -- .mp3, .ogg, .flac, .wav, .m4a, .aac, .opus with playback controls
• Image lightbox -- click to zoom, scroll wheel zoom, pinch-to-zoom on mobile, pan when zoomed
• Link previews -- server-side metadata fetcher with admin whitelist (SSRF protected)
• Pastebin -- share text snippets with password protection and expiration
• URL shortener -- built-in /shorten command creates short redirect URLs with interstitial page
• Smart paste -- paste multi-line text and it auto-offers "send as pastebin?" instead of flooding
• Split view -- view two channels side by side on desktop (/split)
• Read markers -- "new messages since you were away" divider line in channels
• User notes -- attach private notes to any nick (right-click menu or /note)
• Seen database -- /seen nick tracks last message time and channel
• Channel stats dashboard -- most active users with bar chart (/stats)
• ASCII art generator -- /ascii text sends block-letter art to channel
• Urban Dictionary -- /ud word looks up and sends definitions
• DND mode -- Do Not Disturb with scheduled quiet hours (/dnd)
• Encrypted notepad -- private auto-saving notes, encrypted with vault key
• mIRC color formatting -- Ctrl+K color picker, Ctrl+B/U/I/O for bold/underline/italic/reset
• Topic bar with mIRC color rendering and edit/copy/view menu
• Emoji picker with colon autocomplete (:wave: style)
• Slash command autocomplete -- type / to see all 100+ commands
• Search -- search messages in current channel with highlighted results
• File uploads -- drag-and-drop or paperclip, with automatic metadata stripping for images, video, and audio (configurable max size from admin panel)
• My Uploads panel -- view, manage, and delete your uploaded files
• Desktop & mobile push notifications -- iOS PWA support, suppressed when app is focused or DND active
• Smart unread badges -- gray for regular messages, red for mentions and DMs
• Mentions panel -- chat bubble icon with red dot badge for unseen mentions
• Custom highlight words -- tag-based UI to add/remove trigger words for notifications
• Persistent state -- everything syncs server-side (themes, favorites, unread, mentions, notes, keys, etc.)
• Network drag-and-drop -- reorder networks with all their channels (desktop drag + mobile hold-to-drag)
• Channel drag-and-drop -- reorder channels within a network
• Favorites filter -- funnel icon filter bar to show only favorited channels
• Encryption indicators -- SVG lock/unlock icons on every channel and DM in the sidebar
• Mobile lag indicator -- ping time shown next to channel name in topbar
• SVG icon settings menu -- clean Lucide-style line icons, scrollable on small screens
• Standalone security panel -- vault auto-lock, message expiry, rate limit, PM blocking, spellcheck, link previews
• 139 fonts -- monospace, sans-serif, serif, display, and cursive/handwriting, mostly from Google Fonts
• Clear all data -- one-click deletion of logs, notepad, and pastes with confirmation

Admin

• Admin panel -- user management, stats, registration settings
• Link preview whitelist -- admin controls which domains get metadata fetched
• Registration modes -- open, invite-code, or closed (persists across reboots)
• User management -- disable, delete, promote to admin
• All admin settings persist to disk with mutex protection (survives server restarts)

Commands

All 100+ commands show in the / autocomplete dropdown. Type / to browse.

Channel:

Messaging:

Identity & Info:

User Modes:

Mass Operations:

Moderation:

Services:

IRCOp:

Encryption:

Tools:

Connection:

Client:

Fun & Emotes:

Keyboard Shortcuts:

Settings

Accessible from the sidebar gear menu:

Deployment

• Single binary -- one cargo build and you're done
• Interactive deploy script for Debian/Ubuntu with Caddy, Postfix, and systemd
• Automatic HTTPS via Caddy + Let's Encrypt
• Hardened systemd unit with full sandboxing

Architecture

Browser (PWA)
  |-- E2E encryption (Signal protocol, Web Crypto API)
  |-- Per-user vault unlock (Argon2id KDF -> AES-256-GCM)
  '-- WebSocket --> CryptIRC Server (Rust/Axum)
                      |-- IRC connections (TLS + IRCv3)
                      |-- Per-user encrypted log storage
                      |-- Push notifications (Web Push / VAPID)
                      |-- Pastebin with password protection
                      |-- URL shortener with interstitial page
                      |-- File uploads with metadata stripping
                      |-- Session management
                      '-- Email verification (Postfix)

Tech Stack

Configuration

Requirements

• Rust 1.78+
• Linux (Debian 12 / Ubuntu 22.04+ recommended)
• A domain name with an A record pointing to your server
• Ports 80 and 443 open

License

Private. All rights reserved.