Open Protocol

Peer-to-peer data
infrastructure.

Reach your own machines by name. Discover peers through the BitTorrent DHT, connect directly with libp2p, and exchange data using any protocol. No accounts, and no intermediary in the data path — the only piece you run is a blind switchboard that introduces two machines and never sees their traffic.

Install Quickstart
BitTorrent DHT (BEP 44) libp2p Circuit Relay v2 DCUtR Hole Punching Noise Encryption
The Problem

Every connection routes through someone else's infrastructure

Email routes through Google or Microsoft. Messaging apps depend on company backends. Even "decentralized" systems rely on specific relay networks controlled by a small group. The result: single points of failure, forced trust in operators, and vendor lock-in.

How It Works

Three layers, all proven technology

NSA.tech composes battle-tested open protocols into a coherent infrastructure layer. Nothing here is new networking science — the innovation is in the composition.

Layer 01 — Discovery
Finding Peers
BitTorrent DHT · BEP 44 Mutable Items
Each peer publishes a signed entry to the BitTorrent DHT — the largest decentralized lookup system in existence, with over a million active nodes. Your public key is your address. Anyone who knows it can find your current connection metadata. Entries are ephemeral and refreshed periodically.
Layer 02 — Connectivity
Establishing Connections
libp2p Circuit Relay v2 · DCUtR · AutoNAT
You run a switchboard on a machine both ends can reach. It introduces them with a brief handshake (a few KB, under 2 minutes), then both peers simultaneously punch through their NATs to establish a direct connection. Research across 4.4M attempts shows ~70% success rate. The switchboard is blind: it never carries their data, only the introduction.
Layer 03 — Transport
Exchanging Data
Multiplexed Streams · Noise / TLS 1.3 · Protocol Agnostic
Once connected, peers communicate over end-to-end encrypted, multiplexed streams. Multiple protocols run concurrently over one connection — chat, file transfer, and streaming in parallel. Existing applications run their protocols directly over these streams. NSA.tech provides the pipe; what flows through it is up to you.
Design Principles

Decisions, not defaults

No Infrastructure You Don't Own
Nothing stores your data or sits in the data path. The DHT is distributed across millions of independent nodes, and the switchboard that introduces two machines is yours, stateless, and never sees what they exchange.
Self-Sovereign Identity
Your identity is an ed25519 key pair generated locally. No registration, no accounts, no authority that can revoke your access.
Protocol Agnostic
The infrastructure handles discovery and connectivity. Once connected, peers multiplex different protocols over the same connection. Existing apps run directly on it.
You Run the Switchboard
One machine both ends can reach introduces them to each other, and you own it. It is blind by design: it never carries their traffic, so trusting it costs you nothing but reachability.
No Store-and-Forward
The network does not persist data. If a peer is offline, they're unreachable. Like a phone call, not an answering machine. Users who want persistence run their own always-on node.
Zero Lock-In
Keys are portable. DHT entries are self-published. Switching providers means updating one DHT entry. Your peers don't even notice.
Landscape

How it compares

Several projects explore parts of this design space. NSA.tech differentiates through the combination of zero central infrastructure, protocol agnosticism, and composability.

System Discovery Transport Data Layer
Briar Tor hidden services Tor / Bluetooth / WiFi Messaging only (Bramble)
Waku / Status libp2p DHT libp2p GossipSub + relays Messaging (Waku topics)
Nostr Relay URLs (manual) WebSockets to relays Social events (JSON)
NSA.tech BitTorrent DHT (BEP 44) libp2p direct + Circuit v2 Protocol agnostic
Build On It

What can run on NSA.tech

Because the infrastructure is protocol-agnostic, it serves as a foundation layer for any application that needs direct peer-to-peer connectivity.

// messaging
Encrypted Messaging
Text, voice, video between peers with no server in the middle.
// transfer
File Transfer
Direct peer-to-peer file sharing. No size limits, no storage costs.
// iot
IoT Communication
Sensors and devices reachable by public key without exposing ports.
// collab
Collaborative Tools
Real-time document editing, whiteboarding, code collaboration.
// api
Decentralized APIs
Services discoverable and callable by public key rather than DNS.
// network
Private Networks
Ad-hoc encrypted networks between known peers. No VPN infra required.
Technology Foundation

Standing on giants

NSA.tech is not building new networking primitives. It composes proven, production-grade components into a coherent infrastructure layer.

Component Technology Track Record
Discovery BitTorrent DHT (BEP 44) 1M+ active nodes, 20+ years
Connectivity libp2p Circuit Relay v2 + DCUtR Powers IPFS, Ethereum, Filecoin
Transport libp2p multiplexed streams Battle-tested across major networks
Encryption Noise / TLS 1.3 Industry-standard authenticated encryption
NAT Traversal AutoNAT + DCUtR hole-punching ~70% success across 85K+ networks
Changelog

What's new

Every published release is listed here. nsa version --check tells you when you're behind.

Release notes are unavailable right now.
Get Started

Install NSA

One static binary — no runtime, no dependencies, no accounts. Fetch it from the terminal, drop it on your PATH, and you're ready to reach your machines by name.

latest release —
# macOS, Apple Silicon
curl -fsSL https://releases.nsa.tech/nsa-darwin-arm64-latest -o nsa && chmod +x nsa && sudo mv nsa /usr/local/bin/

# macOS, Intel
curl -fsSL https://releases.nsa.tech/nsa-darwin-amd64-latest -o nsa && chmod +x nsa && sudo mv nsa /usr/local/bin/

# Linux, x86-64
curl -fsSL https://releases.nsa.tech/nsa-linux-amd64-latest -o nsa && chmod +x nsa && sudo mv nsa /usr/local/bin/

# Linux, ARM64
curl -fsSL https://releases.nsa.tech/nsa-linux-arm64-latest -o nsa && chmod +x nsa && sudo mv nsa /usr/local/bin/

# Windows, x86-64 (PowerShell)
curl.exe -fsSL https://releases.nsa.tech/nsa-windows-amd64-latest.exe -o nsa.exe
Quickstart

From zero to a direct connection

You run a switchboard on a machine both ends can reach. It introduces them to each other and never carries their data. Then every machine comes online, and they talk directly. 

# 1. On a machine both ends can reach — run the switchboard.
#    It prints its address; you pass that to the first `nsa up` below.
nsa switchboard

# 2. On your laptop — create a network (prints a 12-word secret)
#    and come online, giving it the switchboard address.
nsa new laptop
nsa up /ip4/203.0.113.10/tcp/4001/p2p/12D3KooW...

# 3. On your desktop — join with that secret, then come online
#    the same way. Later `nsa up` calls reuse what it remembers.
nsa join desktop
nsa up /ip4/203.0.113.10/tcp/4001/p2p/12D3KooW...

# 4. From the laptop — reach the desktop by name.
nsa ssh you@desktop
nsa vnc desktop

# Not sure this network allows peer-to-peer? Check first.
nsa doctor

Both machines run nsa up — the one that dials as much as the one being reached. Commands like ssh and vnc talk to that running node, so without it they stop with the node isn't running: start nsa up first.