Move files and large blobs directly between devices with content-addressed, resumable transfers that verify every byte.
+ +Built-in VPN
+Reach your devices directly, with no VPN to configure and no ports to open.
+Use Case: Networking
++ Teams are replacing Tailscale, WireGuard, and reverse SSH tunnels with iroh—dial + a device's public key and get a direct, encrypted connection. No coordination + server to run, no ports to open. +
+Direct
+Peer-to-peer connections, no relay in the hot path
+Encrypted
+Every connection encrypted end-to-end by default
+Embedded
+A library in your app, not a client to install
+Anywhere
+Automatic NAT & firewall traversal, with relay fallback
++ Reaching a device that isn't sitting on the public internet usually means standing up + a VPN: a coordination server to run and secure, client software to distribute, and firewall + rules to get right. Or it means reverse SSH tunnels and all the operational shenanigans + that come with them. +
++ “Thinking about implementing a SOCKS proxy on top of iroh to get into my self-hosted + service at home without WireGuard infra and all the related network shenanigans.” +
++ But what if your app could just dial the other device directly—no separate network + to join, no client to install, no infrastructure to babysit? +
++ Every iroh node has a public key as its address. To reach a device, you dial that key + directly from inside your own application—there's no separate VPN client for + your users to install, and no central network your traffic has to join. +
++ One developer building an agentic coding app described swapping out planned reverse SSH + tunnel infrastructure for iroh in about a day: +
++ Every node has a cryptographic identity. Connect to a device by its public key, wherever it is. +
++ Iroh punches through NATs and firewalls automatically to connect devices directly. +
++ Every connection is end-to-end encrypted, so your platform can't see or modify traffic between devices. +
++ Iroh ships inside your app, so the connection is just part of your product—not a separate piece of software your users manage. +
++ “I read iroh's headline ‘dial keys, not IPs’…I think that was + last Tuesday. By Wednesday it was in our app as one of the most load-bearing pieces.” +
++ Iroh automatically establishes direct connections when possible, for the lowest latency + and highest throughput. When a direct connection isn't possible—due to symmetric + NATs, restrictive firewalls, or carrier-grade NAT—traffic falls back to an encrypted + relay, so the connection stays up either way. +
++ Use n0's hosted relays, + or run your own for full control over that part of the stack. +
+Why iroh
+| + | iroh | +Tailscale / WireGuard | +
|---|---|---|
| {row.feature} | ++ | + |
+ Iroh connects your app's own devices directly—it's not a general-purpose + replacement for joining a whole network of unrelated machines. +
++ Get started with iroh in minutes. No complex configuration required. +
+