Why · 01
Transport agnostic
End-to-end encrypted between peers. Re-encrypted at every hop. Bluetooth, Ethernet, UDP, Tor, Serial — same protocol, same mesh.
FIPSFree Internetworking Peering System
A self-organizing encrypted mesh that works over anything you can send packets through.
Why · 02
Same apps, new plumbing.
If it works over IP today, it works over FIPS — your stack doesn't notice.
⬡fren.fips×
Hacker News
Mail
⬡Hello from fren.fips 👋
This page is served straight from a peer on the FIPS mesh.
No DNS provider. No certificate authority. No exit node.
View source →Why · 03
Self-organizing
Connect to one peer, become reachable from anywhere — bloom filters propagate by gossip. When the root dies the tree converges on a new one without losing most of its structure.
Learn & Discover
Start here.
Learn
Understand the protocol from first principles — the layer stack, cryptography, routing, and packet formats.
Discover Peers
Run a node, find peers via Nostr, and join a mesh that no one controls. Your keypair is your address.
How It Works
Architecture at a glance
Four layers. Each one does exactly one job. Each one is independently replaceable.
Application InterfaceNative API (npub-addressed datagrams) or IPv6 TUN adapter for legacy apps
spec →
FSP — Session ProtocolEnd-to-end Noise XK encryption between any two nodes
spec →
FMP — Mesh ProtocolHop-by-hop Noise IK encryption, spanning tree, bloom filters, routing
spec →
TransportPluggable: UDP, Ethernet, WiFi, Bluetooth, Tor, Serial, ...
spec →
end-to-end encrypted (Noise XK)
hop-by-hop encrypted (Noise IK)
Identity
Your keypair is your address
Your node identity is a Nostr keypair (secp256k1). From that single keypair, three things are deterministically derived — no registration, no authority, no coordination.
npubApplication identity
The human-readable identifier you share with others. Used by the native API for addressed datagrams.
node_addrRouting identifier
SHA-256 hash of the public key. Opaque to the mesh — nodes route by this address without knowing who you are.
fd00::/8IPv6 address
Deterministically derived for legacy app compatibility. Lets unmodified applications reach any node by IPv6 address.
Get Involved
Here's the code. Here's how to run it.
Tell us what breaks.
Run It
Install from GitHub releases, grab a tarball, or build from source. OpenWRT packages available. Docker test meshes for quick experimentation without hardware.
View releases →Break It
Test it. Find bugs. Stress the protocol. Try to break the encryption, flood the mesh, disconnect nodes at the worst moment. We want to know what fails before it matters.
Open an issue →Read the Specs
The design docs cover everything: protocol layers, packet formats, cryptography, routing algorithms. Start with the architecture overview, then dive into specific layers. 10+ specification documents.
Browse docs →Talk About It
Discussion happens on Nostr. Follow the contributors and check the relevant threads.
Join the conversation →