Skip to content

IRC Encryption

Relay supports an IRC-compatible symmetric encryption format for channel messages and private messages. This protects message contents from IRC network observers, while keeping encrypted conversations compatible with Relay's normal message flow.

Relay decrypts messages before rendering, storing, searching, generating link previews, or sending notifications. This feature is therefore not end-to-end encryption against the Relay server itself.

How It Works

Encrypted messages use the following wire format:

+relaycrypt:v1:<base64url(nonce || ciphertext || tag)>

Relay uses XChaCha20-Poly1305 with a 32-byte key and a fresh random nonce for each IRC message. The message context includes the kind of message and the normalized target, so both clients must use the same key and target.

Passphrases are converted into encryption keys with Argon2id. Use a strong, unique passphrase and share the resulting key only with the people or clients that should be able to read the conversation.

Commands

Use these commands in Relay's chat input:

/encrypt generate <target>
/encrypt set <target> <passphrase>
/encrypt set-key <target> <base64-key>
/encrypt list
/encrypt remove <target>
  • /encrypt generate creates a random key for a channel or private-message target and opens a secure dialog showing the key for sharing.
  • /encrypt set derives a key from a passphrase and opens the same secure key dialog. The passphrase itself is not stored.
  • /encrypt set-key imports an existing base64-encoded key.
  • /encrypt list shows the targets with configured keys.
  • /encrypt remove removes the key for a target.

Configure the same key for every Relay client that needs to participate in the encrypted conversation. Secret-bearing encryption commands are excluded from Relay's input history.

Key Storage And Limitations

Encryption keys are stored in the user's account data with restrictive file permissions. They are not included in synchronized browser settings or message history. Keep the Relay account data protected and do not share keys beyond the intended conversation.

Relay does not currently implement FiSH or FiSHLim compatibility. If a client does not have the correct key, an encrypted message remains unavailable instead of being silently displayed as plaintext.