End-to-end encrypted group chat, private messages, and file transfer — right in your terminal. The server is a blind forwarder: it cannot read a single byte of your messages, even if fully compromised.

Security features demo — group chat, private messages, identity verification, TOFU key trust:

Install demo 1 — sh install.sh (no Python required):

Install demo 2 — python ui/setup.py (guided wizard):

NoEyes is a Python terminal chat tool for small groups who need real privacy. Unlike every mainstream chat app, the server never decrypts anything — it only sees encrypted bytes and routing headers, then forwards them blindly. You generate the key, share it out-of-band, and the server learns nothing about your conversations.

Who is it for?

• Developers and teams who want encrypted comms without trusting a third-party server
• Anyone who wants to self-host a private chat with true end-to-end encryption
• Security-minded users who want to understand exactly what a server can and cannot see

# 1. Run the setup wizard — installs Python, pip, and cryptography automatically
python ui/setup.py

# 2. Launch NoEyes
python ui/launch.py

ui/launch.py walks you through starting a server or connecting to one — no commands to memorize.

Both scripts install Python if missing, then hand off to setup.py automatically. install.bat works from both CMD and PowerShell — no need to run install.ps1 directly.

# 1. Install the one dependency
pip install cryptography

# 2. Generate a shared key — share this file with all participants out-of-band
python noeyes.py --gen-key --key-file ./chat.key

# 3. Start the server (does NOT need the key file)
python noeyes.py --server --port 5000

# Start without bore tunnel (LAN / static IP / custom tunnel)
python noeyes.py --server --port 5000 --no-bore

# Start without adding a firewall rule (not needed when using bore tunnel)
python noeyes.py --server --port 5000 --no-firewall

# 4. Connect clients
python noeyes.py --connect SERVER_IP --port 5000 --username alice --key-file ./chat.key
python noeyes.py --connect SERVER_IP --port 5000 --username bob   --key-file ./chat.key

Download Termux from F-Droid (recommended) or the Play Store. F-Droid link: https://f-droid.org/packages/com.termux/

The F-Droid version is more up to date and receives faster security patches.

Keep the session alive — Install tmux so NoEyes keeps running when you switch apps:

pkg install tmux -y
tmux
python ui/launch.py
# Press Volume Down + D to detach (keeps running in background)
# tmux attach   to come back

Storage permissions — file transfer will fail if u don't grant storage access(also clone NoEyes inside /storage/shared/ to access files easily):

termux-setup-storage

The chat window has a narrow sidebar on the left that always shows two sections:

• Top half \u2014 ROOMS \u2014 all rooms you have joined this session. The active room is highlighted with \u25b6.
• Bottom half \u2014 USERS \u2014 everyone currently in your active room.

Each half scrolls independently with the mouse wheel. If there are more items than fit, a +N more indicator appears at the bottom of that half.

The panel is display-only \u2014 no clickable elements, so you can drag to select and copy text freely on all platforms including Termux (no Shift+drag needed). Use /join <room> and /msg <user> to interact.

Press ^P to hide the panel and get a full-width chat view. Press again to bring it back. Works identically on Linux, Windows Terminal, Termux, and Terminus \u2014 no function key required.

Prefix any message with a !tag to color it for everyone and trigger a notification sound on the receiver's machine. Tags travel inside the encrypted payload — the server never sees them.

Examples:

!danger server is going down in 5 minutes
!req    can someone review my PR?
!ok     deployment successful
!warn   disk at 90% on prod
!?      anyone know why the build is failing?

Sounds play from sounds/ folder next to noeyes.py. Drop in .wav, .mp3, .ogg, .aiff, .flac, or .m4a files named after the sound type (e.g. sounds/danger.wav). If no file is found, falls back to the terminal bell. Use /notify off to disable all sounds.

┌──────────────────────────────────────────────────────────────┐
│  Alice ───────────────────────────────────────── Bob         │
│    │          Encrypted payload (opaque)           │         │
│    │                     │                         │         │
│    └───────────► SERVER ─┴◄────────────────────────┘         │
│                     │                                        │
│               Blind forwarder:                               │
│               reads routing header only                      │
│               { "type":"chat", "room":"general" }            │
│               forwards encrypted bytes verbatim              │
└──────────────────────────────────────────────────────────────┘

WHAT THE SERVER SEES:          WHAT THE SERVER CANNOT SEE:
  · Usernames                    · Message content
  · Room names                   · File contents
  · Event types (join/leave)     · Private message bodies
  · Frame byte length            · DH key exchange values
                                 · Ed25519 signatures

chat.key (shared secret)
    │
    ├─ HKDF("general") ──► room_key["general"]   (isolated per room)
    ├─ HKDF("dev")     ──► room_key["dev"]
    └─ HKDF("ops")     ──► room_key["ops"]

X25519 DH (per user pair, automatic on first /msg)
    alice_ephemeral + bob_ephemeral ──► shared_secret
                                              │
                                         HKDF-SHA256
                                              │
                                       pairwise_key    (private messages)
                                              │
                                  HKDF(transfer_id) ──► aes_gcm_key   (files)

passphrase + random_salt (32 bytes, os.urandom)
    │
    └─ PBKDF2-HMAC-SHA256 (390,000 iterations)
              │
         derived_key  ──► saved to ~/.noeyes/derived.key
                                      │
                          loaded directly on every subsequent run
                          (no PBKDF2 re-derivation, no static salt)

Every deployment gets a unique random salt — precomputed rainbow tables are useless. After the first run, share the key file, not the passphrase.

NoEyes/
├── noeyes.py              Entry point and CLI argument parser
├── requirements.txt       pip dependencies (just: cryptography)
│
├── core/
│   ├── encryption.py      All crypto: Fernet, HKDF, X25519, Ed25519, AES-256-GCM
│   ├── identity.py        Ed25519 keypair generation and TOFU pubkey store
│   ├── utils.py           Terminal output, ANSI colours, decrypt animation
│   └── config.py          Configuration loading and CLI parsing
│
├── network/
│   ├── server.py          Async blind-forwarder server (zero decryption)
│   └── client.py          Terminal chat client (E2E, DH, TOFU, file transfer)
│
├── ui/
│   ├── launch.py          ★ Guided launcher — arrow-key menu UI
│   └── setup.py           ★ Dependency wizard — auto-installs everything needed
│
├── install/
│   ├── install.sh         Bootstrap for Linux / macOS / Termux / iSH
│   ├── install.bat        ★ Bootstrap for Windows (CMD and PowerShell)
│   ├── install.ps1        Called automatically by install.bat
│   └── install.py         Cross-platform Python installer
│
├── tests/
│   └── selftest.py        Automated test suite
│
├── docs/
│   ├── README.md
│   └── CHANGELOG.md
│
├── update.py              Self-updater — pulls latest from GitHub
└── sfx/                   Notification sounds

setup.py automatically detects your platform and installs what's missing:

When you start a NoEyes server at home, your machine gets a local IP (e.g. 192.168.1.5). For someone outside your network to connect, you would normally need to open a port on your router and expose your public IP. In practice this almost always fails because:

• Many ISPs (especially mobile data providers) put customers behind CGNAT — you don't even have a real public IP to forward
• Even with a home router you control, the firewall rules are fiddly and the IP changes
• Mobile networks routinely block inbound connections at the carrier level, regardless of what your router does

bore pub solves this by creating a secure tunnel from your machine to a public relay, giving your server an instant public address without touching your router.

bore is an open-source TCP tunnel tool written in Rust by Eric Zhang (@ekzhang).

When you run the NoEyes server, it automatically tries to start:

bore local 5000 --to bore.pub

This punches a tunnel from your local port 5000 to bore.pub, a free public relay. The relay assigns you a random port and prints an address like:

bore.pub:12345

You share that address with your friends — they connect with:

python noeyes.py --connect bore.pub --port 12345 --key-file ./chat.key

Everything is still end-to-end encrypted. bore only forwards raw bytes — it cannot read your messages.

Credit: bore is created and maintained by Eric Zhang. Source: https://github.com/ekzhang/bore

Cheap VPS options: Hetzner (€4/mo), DigitalOcean ($4/mo), Vultr ($2.50/mo), Oracle Cloud (free tier)

# On the VPS — no bore needed, it has a real public IP
python noeyes.py --server --port 5000 --no-bore

python noeyes.py --server --port 5000 --no-bore

When you start a server, NoEyes can automatically add a firewall rule to open the server port so clients can connect directly. The launcher will ask whether you want this and explain when it is needed.

You do NOT need a firewall rule if you are using bore tunnel — clients connect via bore.pub and never touch your machine's firewall directly.

You need a firewall rule if clients connect to your IP directly (LAN, static IP, or manual port forwarding).

# Skip firewall rule (always safe when using bore tunnel)
python noeyes.py --server --port 5000 --no-firewall

# Skip both bore and firewall rule (VPS with its own firewall managed separately)
python noeyes.py --server --port 5000 --no-bore --no-firewall

python update.py           # update to latest version
python update.py --check   # just check — don't change anything

# Generate once, share out-of-band (USB / Signal / encrypted email)
# NEVER share over NoEyes itself or in plaintext
python noeyes.py --gen-key --key-file ./chat.key

# Backup your identity key
cp ~/.noeyes/identity.key /backup/identity.key

# View who you currently trust (TOFU store)
cat ~/.noeyes/tofu_pubkeys.json

• Language: Python 3.9+
• Encryption: cryptography library — Fernet, X25519, Ed25519, AES-256-GCM, HKDF, PBKDF2
• Networking: Raw TCP sockets with a custom length-prefixed framing protocol
• Concurrency: threading (recv + input threads per client), asyncio on the server
• Terminal: ANSI escape codes, termios for raw keypress input

⚠️Research & Educational Use Only — experimental project.