Concord — peer-to-peer, end-to-end encrypted chat

Three claims, and the price of each

Every one of these is a real property with a real cost. Both halves are stated here because a privacy claim without its cost is marketing.

No account

Your identity is an Ed25519 keypair on your device. No signup, no email, no phone number, no username table — nothing to breach and nothing to subpoena.

Costs: lose every device and your passphrase, and the identity is gone. There is no reset link, because there is nobody to send one.

No message store

History lives on the devices of the people in the conversation and nowhere else. A guild is one MLS group; removing a member is a rekey, not a flag in a database.

Costs: if everyone in a conversation loses their devices, the conversation is gone. Nothing is backed up for you.

No server in the middle

Peers connect to each other. The one optional node — a rendezvous — introduces peers and forwards ciphertext it cannot read.

Costs: two people behind home routers usually cannot reach each other unaided. Somebody in the group has to run that node.

Will it actually work for you?

This is the honest hard part, and the reason most peer-to-peer chat apps quietly disappoint. Two peers can only talk if at least one can accept an incoming connection, and home routers refuse. Find your row.

Where you both are	What it takes	What it costs
Same Wi-Fi	Nothing. Peers shout at the local network and dial whatever answers.	Desktop to desktop only — Android's sandbox blocks the socket, and many work networks drop the packets.
Tailscale / WireGuard	Nothing. Every machine already has an address the others can dial.	Everyone has to be on the same mesh. Best option for a private group.
One side can port-forward	One router rule. Invite codes carry that address, so the other side dials directly.	That person's home IP is inside every invite code they hand out.
Neither side can	Somebody runs a rendezvous — Docker, a small VPS, or fly.io, in about five minutes.	One machine has to exist. It does not have to be yours; a friend's works, and their invite code points your app at it automatically.

Inside the app, Can people reach me? (Ctrl+K) reports which row you are actually in and offers the one thing to do about it. There is a fourth discovery rung — bootstrapping off the public IPFS DHT — off by default, because it solves finding rather than reaching and it costs metadata.

What it looks like

A Concord channel: message list, member panel and the moments row — A channel, its members, and the moments row.

Guild settings: roles, banned members, invites, custom emoji, events and ownership — Guild settings — roles, bans, invites, emoji, events, ownership.

A poll posted in a channel — Polls, events and calendars are built in.

The same channel rendered in a light theme — One of more than twenty themes.

Also in the box: encrypted attachments, local full-history search and Markdown export, an encrypted offline mailbox so a DM lands while you are away, meeting rooms browser guests can join with no install, multi-device linking by QR code, a soundboard that synthesises its sounds rather than shipping audio files, and a meme editor. Emoji, typefaces, icons and sounds are compiled into the binary — no CDN learns your IP and the moment you opened the app.

How it works

Removing the server means answering the questions a server answers for free. There are four, and each has a mechanism and a price.

Identity

A keypair is the account. A peer's network address derives from its public key, so dialling the right address and completing the handshake is the identity check, with out-of-band fingerprint comparison closing the first-contact gap.

Discovery

Four mechanisms tried in order: the local network, addresses remembered from past sessions, invite codes pasted by hand, and a distributed hash table. Only the last involves infrastructure.

Reachability

Two peers behind home routers punch a hole through their NATs; when that fails they fall back to a circuit relay that forwards ciphertext it is not an endpoint of.

Membership

MLS (RFC 9420) holds one ratchet tree per guild, and a signed, replayable governance log decides who may change it. Removing a member rekeys the group.

DESIGN.md is the long version: fourteen sections that define each term on first use and state the cost beside every benefit.

What Concord does not protect

Taken from the project's own threat model, not softened for this page. If one of these is a dealbreaker, better to find out here than after you have moved your friends.

Metadata is not hidden. Your IP is visible to the peers you connect to and to any rendezvous you use. Concord authenticates identities; it does not conceal them.
Not everything is encrypted at rest. Message bodies and your identity seed are. MLS group state — including leaf private keys — the peer list, sender keys and timestamps are on disk in the clear.
History during catch-up is attested by whoever serves it, not re-verified per original sender, so an ordinary member could forge a message attributed to someone else in a backfill.
A removed member can still observe membership churn. Commits are signed but not encrypted, and a former member still knows the group identifier. Content stays sealed.
Insiders are not the threat model. Encryption keeps outsiders out; it was never meant to stop someone you invited.
The crypto has not been independently audited. Concord implements MLS through a vendored third-party library with documented local changes. Using an IETF standard beats inventing a ratchet, but it is not the same thing as an audit.

SECURITY.md carries the full list and how to report something privately.

Get started

One file per operating system. Run it and your browser opens on the app — no installer, no dependencies, no admin rights. Or build it yourself in two commands.

git clone https://github.com/ZahakJ/concord && cd concord
make web            # builds the Svelte UI into the Go binary
./bin/concord-web   # then open http://127.0.0.1:8787

Unlock with a passphrase — the first unlock creates your identity — then create a guild and share its invite code. Before you invite anyone, check the reachability table: on the same Wi-Fi or a Tailscale mesh it simply works, and otherwise one person in the group needs to run a rendezvous.

Releases are signed: every download is listed in a SHA256SUMS manifest with a detached signature, and the app verifies that signature before it will update itself. Windows flags unsigned executables — WINDOWS.md covers the bypass and the fallback.

Download the latest release Contribute