GitHub - gh0st68/CryptIRC: Self-hosted encrypted IRC client. Rust backend with 24/7 connectivity, Signal Protocol E2E for DMs, AES-256-GCM encrypted logs and channel keys. Native apps for Windows/Linux/macOS plus installable PWA for iOS/Android.

End-to-end encrypted IRC. Self-hosted. Always on.

_{Your server holds the connection. Your device holds the key.
The server can't read a single thing it stores for you — and that's architectural, not a policy.}

cryptirc.com  ·  Theme Gallery  ·  Hosted client  ·  Downloads

$ git clone https://github.com/gh0st68/CryptIRC.git && cd CryptIRC
$ sudo bash deploy/deploy.sh yourdomain.com you@yourdomain.com

  [✓] dependencies resolved        [✓] systemd units hardened
  [✓] TLS provisioned (Caddy)      [✓] irc-core daemon online
  [✓] both binaries built          [✓] https://yourdomain.com ready

_{One command. Debian · Ubuntu · Arch. Nothing else to configure.}

Don't want to run your own? Use ours — free.
client.twistednet.org/cryptirc
_{Your vault key is derived from your passphrase on your device. The passphrase is never sent to the server or stored anywhere. Logs, DMs, credentials and notes are encrypted with that key before they touch disk — even we can't read them.}

Support · bugs · hanging out:  irc.twistednet.org  →  #dev · #twisted
_{👻 built by gh0st}

_{Installable PWA — same client, on your phone.}

What is CryptIRC?

CryptIRC is a self-hosted, encrypted IRC client that keeps you connected to IRC 24/7 from any device. Your server maintains persistent connections to all your IRC networks — so you never miss a message, even when all your devices are off. When you come back, your full history is waiting, encrypted and synced.

No plugins. No telemetry. No third parties. You own everything.

🤖 AI Assistant & Bots

CryptIRC ships a full server-side bot suite that runs 24/7 on your connection — even when every device is off — and replies as your own nick. Everything is off until you turn it on, each bot has its own access controls and per-channel scope, and all output is rate-limited server-side so it can't flood.

The AI chatbot plugs into any major model — OpenAI/ChatGPT, Anthropic/Claude, xAI/Grok, Google/Gemini, Perplexity, OpenRouter, Groq, Mistral, or your own self-hosted OpenAI-compatible endpoint — or sign in with your ChatGPT subscription (OAuth) instead of pasting an API key. Then:

• Talk to it in any channel, in DMs, or privately with /ai. Your key is encrypted in your vault — nobody else can read it.
• It's a real agent, not a parrot. It knows its own nick and (opt-in) your channels, topics and who's in them — and it can actually look around: ask "who's in #dev?" and it runs names/who/whois or joins the channel, reads the result, then answers.
• Let it run the channel. With /aido it can op, voice, kick, ban, set the topic and more — bounded to a safe allowlist by default (or fully unrestricted YOLO mode, owner-only). Every action lands in an encrypted audit log.
• Per-person memory that auto-clears, a strong built-in persona, and a custom system prompt if you want one.

19 built-in bots, all free and off by default:

🤖 AI Chatbot · 🌦 Weather · 📖 Urban Dictionary · 📚 Wikipedia · 📗 Dictionary · 🪙 Crypto price · 🕐 World time · 💱 Currency · 😂 Jokes · 💬 Quotes · 🧠 Facts · 🎱 8-ball · 🎲 Dice · 🪙 Coin flip · 🗒 Quote DB · 👀 Seen · ✉️ Tell (offline messages) · 📝 Notes · ❓ Help

Channel protection & moderation — auto-op / auto-voice on join, flood protection and a bad-word filter with a warn → kick → kick+ban ladder and an exempt list, and an IP/host logger that records joins to your private encrypted log. All per-channel, all audited.

Available Everywhere

The desktop apps and PWA give you push notifications, offline caching, and a native app feel. The web version works anywhere with a browser. And when you'd rather stay in the terminal, there's a full TUI that connects to the same account at the same time — see below.

🖥️ Terminal Client

A real TUI — not a stripped-down fallback. It logs into the same account as the web app and runs at the same time as your browser: same messages, same vault, same encrypted logs, same server-side bots.

weechat-style layout — networks and channels on the left, members on the right, a status bar with your nick, lag and unread activity. Mouse works: click a buffer to switch, wheel to scroll. Plus Alt+1..9 to jump, Tab to cycle nick completion, paged scrollback, and the full slash-command set built the way the web client builds it.

52 built-in themes — real terminal colourschemes, switchable live with /theme and remembered:

$ cd tui && cargo build --release
$ ./target/release/cryptirc-tui -s https://your.server/cryptirc -u yournick

It talks the same WebSocket protocol the browser does, so it needs no changes to the server or the daemon — full details and key bindings.

Encryption — Everything is Encrypted

CryptIRC encrypts everything before it touches disk. The server cannot read your messages, logs, or credentials.

• Encrypted logs — every message stored on the server is encrypted with your personal vault key (AES-256-GCM). Even the server admin can't read them.
• Signal Protocol E2E for DMs — private messages use the same encryption as Signal: X3DH key agreement + Double Ratchet with authenticated headers. Forward secrecy and deniability built in.
• Channel encryption — set a pre-shared AES-256-GCM key on any channel. Only people with the key can read messages.
• Encrypted credentials — IRC passwords, NickServ passwords, SASL secrets are all encrypted at rest with your vault key. Never stored in plaintext.
• Encrypted notepad — private notes encrypted server-side with your vault key.
• Vault system — your master passphrase derives an encryption key via Argon2id. Lock the vault and the key is zeroed from memory. Auto-lock after configurable idle time.
• Zero-knowledge architecture — the server is a dumb relay. It cannot decrypt anything.

Key Features

• 24/7 connectivity — your server stays connected to IRC around the clock, logs everything encrypted, and syncs across all your devices
• Updates without disconnecting — IRC connections live in a small, always-on background process, separate from the web server. Routine updates and restarts no longer part/rejoin you from every channel — only a change to that background process itself would ever require reconnecting
• Multi-network — connect to as many IRC networks as you want simultaneously
• Multi-device sync — messages, favorites, settings, unread counts sync across all your devices in real-time
• Push notifications — get notified on your phone or desktop when someone DMs or mentions you, even when the app is closed
• 227 themes (64 animated — starfields, rain, aurora, Matrix code — plus a pixel-perfect mIRC Win95 skin and a Discord theme) + 140 fonts and a live theme gallery. Customize any of them — hit ✎ on any theme to fork it into your own editable copy — and put your own picture behind any theme, with opacity, blur and dim so your chat stays readable
• 🐑🦀👻🐟👽 Desktop pets — 25 of them. The five originals (the classic '95 eSheep that wanders, climbs walls, naps and gets abducted; a furious Angry Crab; a Ghost; a Calm Fish you can feed; a Little Alien flying saucer) plus 20 more — jellyfish, paper plane, hot-air balloon, manta, moth, snail, firefly, hedgehog, teacup, desk lamp, wind-up key, rubber duck, survey probe, Lumen, Vesper relay, data wisp, ghost lantern, paper crane, toddle cap and a moody cloud — each with 50 different behaviours. The new ones are deliberately unobtrusive: they keep to the edges and off the text you're reading, rest far more than they move, are silent, and clicks pass straight through. Up to three at a time, paused entirely when the window isn't focused, and off unless your system asks for reduced motion
• Resizable columns — drag the divider at the edge of the channel list, the edge of the user list, or between the nicknames and the messages. Double-click a divider to reset it. Widths are remembered and sync across your devices
• In-app News & changelog with an auto-versioning build badge, so you always see exactly what changed
• Full IRCv3 support — 17 user-toggleable capabilities including typing indicators, away-notify, server-time, message-tags, plus SASL PLAIN/EXTERNAL and nick MONITOR
• 100+ slash commands — everything from /ascii art to /ud Urban Dictionary lookups
• Nick monitoring — track when specific users come online/offline with push alerts
• Inline media — images, videos, YouTube rich cards, audio player, link previews
• Mobile-first PWA — swipe gestures, safe-area support, works perfectly on iOS and Android
• Deploy in one command — the installer builds both binaries and sets everything up on any Linux server

Deployment

• Two small Rust binaries — the web server and the always-on IRC daemon — one cargo build for both
• Interactive deploy script for Debian/Ubuntu and Arch Linux with Caddy, Postfix, and systemd
• Automatic HTTPS via Caddy + Let's Encrypt
• Hardened systemd units with full sandboxing (ProtectSystem, PrivateTmp, restricted syscalls, no capabilities)
• Routine update.sh redeploys restart only the web server — the IRC daemon (and everyone's connections) stays up
• Automatic backups on update — last 5 snapshots of all user data kept in /var/lib/cryptirc-backups/
• Existing Caddyfile backed up before overwriting — safe for servers already running Caddy

Quick Start

# Clone
git clone https://github.com/gh0st68/CryptIRC.git
cd CryptIRC

# Deploy (Debian/Ubuntu) — single command, sets up everything
sudo bash deploy/deploy.sh yourdomain.com admin@yourdomain.com

That's it. Visit https://yourdomain.com, register an account, unlock your vault, and connect. You can sign in with either your username or your email.

Features

Themes & Personalization

227 built-in themes — 163 static + 64 animated — each hand-tuned across a full palette: five background layers, two border tiers, three text weights, matched accents and its own status colors. 90 ship an illustrated backdrop drawn in SVG. Highlights include a pixel-perfect mIRC skin with real Windows-95 window chrome, HexChat, XChat and irssi skins that copy each client's actual layout, not just its palette (right-aligned nick column with the separator rule for the GTK pair; black terminal, -!- status lines and the cyan status bars for irssi, in the two-bar adv_windowlist arrangement most people run) and a Discord theme with its familiar dark UI.

Browse the live Theme Gallery →
_{every theme rendered as a live miniature IRC window in its own palette — search, filter and preview all 227}

Make any of them yours

Hover any theme and hit ✎. The editor opens on that exact theme — its colors, its animation, its artwork all loaded — and saving gives you your own copy, marked ★. The original is never touched, so you can always go back.

Your own background, on any theme. Upload an image or paste an https:// link and it sits behind every theme you switch to. Opacity, blur, dim and tiling are all on sliders — and they work on the built-in artwork too, so a theme you liked but found too busy can simply be turned down. Uploads stay on that device; a linked image follows you everywhere.

…and ~180 more — see them all in the gallery.

Encryption & Security

• Per-user vaults -- each user has their own passphrase and encryption key (Argon2id KDF + AES-256-GCM)
• Signal-protocol E2E for direct messages -- X3DH key agreement + Double Ratchet with authenticated headers
• Channel encryption -- pre-shared AES-256-GCM keys for group channels
• Encrypted logs -- every line encrypted at rest with the user's vault key
• Encrypted notepad -- private encrypted notes stored server-side
• Encrypted credential storage -- IRC passwords, NickServ passwords, and SASL secrets never stored in plaintext
• Vault lock/unlock -- locking the vault zeros the key from memory and disconnects IRC
• Vault auto-lock -- configurable idle timer (5min–2hrs) automatically locks the vault
• Client TLS certificates -- generate and manage ECDSA P-256 certs for SASL EXTERNAL
• Zero-knowledge architecture -- the server cannot read your messages or credentials
• SASL PLAIN protection -- refuses to send credentials over unencrypted connections
• Upload metadata stripping -- all uploads are automatically scrubbed of metadata before being saved to disk:
  • JPEG: strips all APP1–APP15 markers (EXIF, XMP, IPTC, GPS coordinates, camera make/model, lens info, timestamps) while preserving APP0 (JFIF), quantization tables, Huffman tables, and image data
  • PNG: removes all ancillary chunks (tEXt, iTXt, zTXt, eXIf, dSIG, tIME) while preserving critical chunks (IHDR, PLTE, IDAT, IEND) and safe ancillary chunks (tRNS, gAMA, cHRM, sRGB, iCCP, pHYs)
  • Video/Audio (MP4, WebM, MP3, OGG, WAV, FLAC): uses ffmpeg to strip all metadata containers (-map_metadata -1) while copying streams untouched — no re-encoding, no quality loss
• Block private messages -- +g mode with one-time notification per sender (3-hour cooldown)
• Session manager -- view and revoke active sessions across devices
• Message expiry -- configurable auto-delete of local message buffers (1hr–7days)
• Client-side rate limiting -- configurable flood protection (200ms–3sec between messages)
• Timing-safe comparisons -- registration codes use constant-time comparison with no length oracle
• XSS hardened -- no inline onclick injection, prototype-pollution-safe E2E objects, comprehensive HTML escaping
• CSP headers -- Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy
• Password complexity -- requires uppercase, lowercase, digit, and special character

IRC & IRCv3

• Full IRC protocol support -- channels, DMs, modes, kicks, bans, CTCP, the works
• IRCv3 capabilities (17 user-toggleable): away-notify, account-notify, extended-join, server-time, multi-prefix, cap-notify, message-tags, batch, echo-message, invite-notify, setname, account-tag, userhost-in-names, chghost, labeled-response, typing indicators, standard-replies (plus SASL, negotiated separately; nick MONITOR is a separate feature)
• IRCv3 CAP toggle -- enable/disable individual capabilities per network in settings
• SASL PLAIN & EXTERNAL authentication
• Multi-network support -- connect to as many networks as you want simultaneously
• Nick monitoring -- track when users come online/offline with push notifications
• KeepNick -- irssi-style nick keeper with ISON polling, QUIT/NICK event detection, and auto-reclaim
• Auto-identify -- automatically send NickServ IDENTIFY on connect (encrypted credential storage)
• Auto-rejoin on kick -- automatically rejoin channels after being kicked (with saved channel keys)
• Channel key manager -- store and auto-send channel keys (+k) when joining
• Multi-device sync -- messages you send on one device appear on all your other devices
• Typing indicators -- see when someone is typing (IRCv3 draft/typing)
• Server-time -- accurate timestamps from the IRC server
• ZNC playback detection -- detects and batches ZNC buffer playback with summary markers
• Self-signed cert detection -- popup warning with one-click fix for ZNC/bouncer TLS errors
• Status message condensing -- Lounge-style grouped join/part/quit (Show All / Condense / Hide)
• Configurable join/part/quit message filtering
• Infinite scroll -- load older messages from encrypted server logs on demand

Interface

• Lounge-style layout -- clean input bar, grouped nick list, collapsible panels
• Mobile-first PWA -- installable on iOS/Android with swipe gestures and safe-area support
• iOS PWA keyboard handling -- works perfectly with iOS keyboard accessory bar
• Collapsible panels -- sidebar and nick list collapse on desktop with persistent state
• Nick list grouped by role -- Owners, Admins, Operators, Half-Ops, Voiced, Users
• Nick context menu -- whois, query, slap, monitor, notes, kick/ban/voice/op based on power level
• Clickable nicks in messages -- nick mentions in chat text are colored and clickable
• Smart tab completion -- prioritizes most recent speakers, with Tab cycling
• @nick autocomplete -- type @ to search and insert channel nicks
• #channel autocomplete -- type # to autocomplete channel names
• Inline media previews -- images, videos (.mp4/.webm/.mov), YouTube rich cards with title/author
• Inline audio player -- .mp3, .ogg, .flac, .wav, .m4a, .aac, .opus with playback controls
• GIF picker -- type /gif <search> (or /giphy) for a smooth in-line grid of results, navigable by tap or arrow keys + Enter. Powered by Giphy or Tenor -- the admin picks the provider and can set a shared key so it works for everyone with no setup, or each user can supply their own
• Image lightbox -- click to zoom, scroll wheel zoom, pinch-to-zoom on mobile, pan when zoomed
• Link previews -- server-side metadata fetcher with admin whitelist (SSRF protected)
• Pastebin -- share text snippets with password protection and expiration
• URL shortener -- built-in /shorten command creates short redirect URLs with interstitial page
• Smart paste -- paste multi-line text and it auto-offers "send as pastebin?" instead of flooding
• Split view -- view two channels side by side on desktop (/split)
• Read markers -- "new messages since you were away" divider line in channels
• User notes -- attach private notes to any nick (right-click menu or /note)
• Seen database -- /seen nick tracks last message time and channel
• Channel stats dashboard -- most active users with bar chart (/stats)
• ASCII art generator -- /ascii text sends block-letter art to channel
• Urban Dictionary -- /ud word looks up and sends definitions
• DND mode -- Do Not Disturb with scheduled quiet hours (/dnd)
• Encrypted notepad -- private auto-saving notes, encrypted with vault key
• mIRC color formatting -- Ctrl+K color picker, Ctrl+B/U/I/O for bold/underline/italic/reset
• Topic bar with mIRC color rendering and edit/copy/view menu
• Emoji picker with colon autocomplete (:wave: style)
• Slash command autocomplete -- type / to see all 100+ commands
• Search -- search messages in current channel with highlighted results
• File uploads -- drag-and-drop or paperclip, with automatic metadata stripping for images, video, and audio (configurable max size from admin panel)
• My Uploads panel -- view, manage, and delete your uploaded files
• Desktop & mobile push notifications -- iOS PWA support, suppressed when app is focused or DND active
• Smart unread badges -- gray for regular messages, red for mentions and DMs
• Mentions panel -- chat bubble icon with red dot badge for unseen mentions
• Custom highlight words -- tag-based UI to add/remove trigger words for notifications
• Persistent state -- everything syncs server-side (themes, favorites, unread, mentions, notes, keys, etc.)
• Network drag-and-drop -- reorder networks with all their channels (desktop drag + mobile hold-to-drag)
• Channel drag-and-drop -- reorder channels within a network
• Favorites filter -- funnel icon filter bar to show only favorited channels
• Messages inbox -- an optional pinned tab at the top of the sidebar that gathers every DM from all your networks into one unified inbox, iMessage-style (toggle in Appearance ▸ Messages tab)
• Encryption indicators -- SVG lock/unlock icons on every channel and DM in the sidebar
• Mobile lag indicator -- ping time shown next to channel name in topbar
• SVG icon settings menu -- clean Lucide-style line icons, scrollable on small screens
• Standalone security panel -- vault auto-lock, message expiry, rate limit, PM blocking, spellcheck, link previews
• 140 fonts -- monospace, sans-serif, serif, display, and cursive/handwriting, mostly from Google Fonts
• Clear all data -- one-click deletion of logs, notepad, and pastes with confirmation

Admin

• Admin panel -- user management, live stats (total / online), registration settings
• GIF Picker settings -- choose the provider (Giphy or Tenor), the mode (Off / per-user own-key / shared server key), and store the server-held Giphy + Tenor API keys (never exposed to users)
• Max upload size -- admin-set per-file upload cap (1–500 MB)
• Link preview controls -- pick a mode (Off / Whitelist approved-domains-only / All HTTPS links, with private IPs blocked) plus the domain whitelist
• Registration modes -- open, invite-code, or closed (persists across reboots)
• User management -- disable, delete, promote to admin, toggle upload permission
• All admin settings persist to disk with mutex protection (survives server restarts)

Commands

All 100+ commands show in the / autocomplete dropdown. Type / to browse.

Channel:

Messaging:

Identity & Info:

User Modes:

Mass Operations:

Moderation:

Services:

IRCOp:

Encryption:

Tools:

Connection:

Client:

Fun & Emotes:

Keyboard Shortcuts:

Settings

Accessible from the sidebar gear menu:

Deployment

• Two small Rust binaries (web server + always-on IRC daemon) -- one cargo build for both
• Interactive deploy script for Debian/Ubuntu and Arch Linux with Caddy, Postfix, and systemd
• Automatic HTTPS via Caddy + Let's Encrypt
• Hardened systemd units with full sandboxing
• Routine updates restart only the web server -- IRC connections stay up through them

Architecture

The IRC connection itself lives in a small always-on daemon (irc-core), separate from the web server (cryptirc) that does everything else. Routine web-server updates and restarts never touch the daemon, so nobody's IRC connection drops.

The terminal client speaks that same WebSocket protocol, so a browser and a TUI can be signed into one account simultaneously — the web server fans every event out to all of a user's sessions.

Browser (PWA) ------.
cryptirc-tui -------+   (both, at the same time, same account)
  |-- E2E encryption (Signal protocol, Web Crypto API)
  |-- Per-user vault unlock (Argon2id KDF -> AES-256-GCM)
  '-- WebSocket --> cryptirc (Rust/Axum, web server)
                      |-- Per-user encrypted log storage
                      |-- Push notifications (Web Push / VAPID)
                      |-- Pastebin with password protection
                      |-- URL shortener with interstitial page
                      |-- File uploads with metadata stripping
                      |-- Session management
                      |-- Email verification (Postfix)
                      '-- Unix socket --> irc-core (always-on daemon)
                                            |-- IRC connections (TLS + IRCv3)
                                            |-- SASL / registration / CAP negotiation
                                            |-- Reconnect + backoff
                                            '-- Survives web server restarts

Tech Stack

Configuration

Requirements

• Rust 1.78+
• Linux — Debian 12, Ubuntu 22.04+, or Arch Linux (dedicated installer for each)
• A domain name with an A record pointing to your server (or a bare IP for a self-signed cert)
• Ports 80 and 443 open

License

Private. All rights reserved.