# iroh

iroh is a networking library that lets two machines open a direct, authenticated connection to each other by public key instead of IP address. The tagline is "IP addresses break, dial keys instead." You give it the other node's key, it figures out how to reach that node — punching through NATs, falling back to a relay when it can't — and hands you an encrypted QUIC connection. The addressing is location-independent: a node keeps its identity when its IP changes, and there is no central server in the data path. It's built by n0 and runs in production on hundreds of thousands of devices.

## How it works

Each node is an endpoint identified by an Ed25519 public key. To connect, iroh tries direct paths first (using discovery to find candidate addresses), attempts hole-punching for NAT traversal, and falls back to a relay server if a direct path can't be established — the relay just forwards encrypted packets, it never sees plaintext. Connections are QUIC, so they're encrypted end-to-end at the transport layer and multiplexed: one connection carries many independent bidirectional streams. Protocol selection rides on QUIC's ALPN negotiation, so a single endpoint can speak several protocols and dispatch by ALPN.

The design splits into a plain transport layer and an optional set of ready-made protocols on top. You can compose from existing protocols (blob transfer, documents, gossip) or treat iroh as a clean abstraction over "dumb pipes" and build your own protocol directly on the QUIC streams. SDKs exist beyond Rust, including a Swift SDK for mobile.

## Where it shows up

[[mesh-llm]] is a good worked example. Every node in that system — whether it serves models or only sends requests — boots an iroh endpoint as its identity and only network surface. "Route inference to a peer" and "stream activations to the next pipeline stage" become the same primitive as "talk to localhost," just with a different endpoint ID, and the mesh runs its own gossip and admission layer on top of iroh's transport. The pattern generalizes: iroh gives you authenticated NAT-traversing QUIC between any two machines, and you build the application protocol above it.

The key-addressed, location-independent model overlaps with [[yggdrasil-network]], which derives an IPv6 address from each node's public key. The difference is layer and intent — Yggdrasil is a full overlay routing network presenting a normal IP interface to everything above it, while iroh is a library you call to open specific connections between specific peers, with the relay/hole-punch machinery hidden behind the dial. iroh's endpoint IDs are also a concrete instance of the [[stateful-agent-routing]] idea: a routable name that identifies a process, not a server or an IP.

## Notes

The relay fallback means iroh degrades to a client-server-like path when direct connectivity fails, but the relays are operated infrastructure — for the public relay you depend on n0's servers, or you run your own. Transport encryption protects data in flight between endpoints; it says nothing about what a peer does with the data once it arrives, which is why applications like Mesh LLM still need trusted-peer meshes for anything sensitive.

Repo: [github.com/n0-computer/iroh](https://github.com/n0-computer/iroh) — ~11.7k stars, dual-licensed Apache-2.0 / MIT.