Agent Terminal
What is iroh?
iroh is the open-source networking library behind Agent Terminal’s remote access. Here is what it does, who runs its relays, and what they can see.
- Dial by key
- Try direct
- Fall back to relay
What a relay sees
- Both devices’ IP addresses
- Encrypted packets, which it passes along
- What you type
- What your terminal shows
With n0’s relays, n0’s lookup service also keeps a record of which relay each device is on. More on what a relay sees
What iroh is
iroh is an open-source networking library that connects one device to another by its public key, called an endpoint ID, instead of its IP address. It tries a direct connection first and falls back to a relay server, and every connection is encrypted end to end with QUIC.
A library is code inside an app, not something you install. iroh is written in Rust, licensed under MIT or Apache 2.0, and built by a company called n0.
The precise version
- An endpoint ID is the public half of an Ed25519 key pair. The app creates the pair itself; there is no sign-up.
- Connections use QUIC with TLS 1.3, through n0’s own QUIC implementation,
noq, which supports multipath: a connection can move between Wi-Fi and mobile data. - To be found, an endpoint publishes a signed record (Pkarr) with its endpoint ID and its home relay’s URL to a DNS server, run by n0 by default. Publishing to the Mainline DHT is opt-in, and devices on the same network can find each other directly.
Sources: What is iroh, Endpoints, Address lookup, the iroh repository.
Why your phone can’t just reach your PC
Every device online has an IP address, like a street address. Your PC at home usually does not have its own: the router shares one public address among the whole house. That is NAT (network address translation).
The router is a one-way door: devices inside can reach out, but its firewall drops any incoming connection that is not a reply. And addresses change, for example when your phone moves from Wi-Fi to mobile data.
Instead of opening a port to the whole internet, iroh gets both devices to open the door from their own side.
How iroh connects
- Find. Your phone looks up which relay the PC’s endpoint ID is connected to.
- Go direct. Through that relay, the devices swap addresses, then send packets to each other at the same moment. Each router sees what looks like a reply and lets it in: hole punching.
- Fall back. If some network still blocks it, traffic keeps flowing through the relay instead.
What the relay can and can’t see
The relay passes your traffic along but cannot read it: it is encrypted for the other device’s key. It does see both devices’ IP addresses. And with n0’s relays, n0’s lookup service keeps a record of which relay each device is on.
More detail on the direct path
iroh runs NAT traversal inside the QUIC connection itself, through an extension
(n0_nat_traversal) modelled on a QUIC NAT traversal draft, so the connection
details stay encrypted. Both sides send UDP datagrams to each other’s public addresses at the
same time. The relay is the meeting point; it does not take part in the punch. Devices reach
relays over WebSockets.
Sources: NAT traversal, Relays, Iroh 1.0.
Who n0 is, and what the public relays are
n0 (n0, inc.) is the company that builds iroh, in the open on GitHub. It also runs a set of public relays that iroh uses unless an app sets its own. According to n0 and our in-app notice, these relays are:
- Free, and shared by every app built on iroh.
- Not guaranteed: no uptime promise, and speed limits n0 does not publish, so a relayed connection can be slow, drop, or not connect at all when they are busy or down.
- For recent versions only: n0 supports only recent iroh releases on them, so an out-of-date app may stop connecting.
n0’s docs call them suitable for development and testing, and offer paid relays for production.
For Tailscale users
The ideas are familiar: go direct, hole-punch through NAT, fall back to a relay (Tailscale’s are called DERP) that cannot decrypt what it forwards. The difference is scope. Tailscale puts a whole device on a private network every app can use; iroh connects one app to its peers.
| iroh | Tailscale | |
|---|---|---|
| What it is | A library inside one app | A client that joins the device to your tailnet (tsnet embeds it in a Go program) |
| Encryption | QUIC with TLS 1.3 | WireGuard |
| Identity | A key the app creates; no account | An account; a coordination server shares devices’ public keys |
| Relays | iroh relays: n0’s public set, paid, or your own | DERP: Tailscale’s, or your own |
Neither is better in general: Tailscale for one private network with access rules, iroh for an app that reaches its own other half with no setup.
How Agent Terminal uses it
The desktop app on your Windows PC or Mac runs an iroh endpoint; the phone dials its endpoint ID once you pair by scanning a QR code.
- Same Wi-Fi, or a direct path: no relay is used.
- Free plan, away from home: the free plan relies on n0’s public relays, with no account: a free service run by n0, not by us, with no promise of uptime or speed. Expect slow or dropped connections, or none at all. We have no control over n0’s side.
- Pro: remote access through Agent Terminal’s dedicated relays (plans). If Pro ends, it falls back to the public relays.
- Your own relay: run one and set it on the desktop.
Inside the iroh connection it is still SSH, end to end between your phone and your PC, and the desktop accepts public keys only (how to check). Reaching the PC lets nobody in without a paired key.
Questions
Is it safe?
A relay cannot read your session: it is iroh’s encryption on the outside and SSH on the inside, and the desktop checks every key itself. What a relay does learn is both devices’ IP addresses. Any relay sees them, so the choice is whose: n0’s on the free plan, ours with Pro, or your own.
Do I need an account?
No, not for the free plan. An account is only for Pro.
What if n0’s relays are down or slow?
On the same Wi-Fi, or wherever the devices connect directly, nothing changes. On the free plan a relayed connection can be slow, drop, or not connect at all until they recover, and we have no control over that; Pro uses Agent Terminal’s dedicated relays instead. Keep Agent Terminal up to date, since n0 supports only recent iroh versions.
Can I run my own relay?
Yes. n0 publishes the relay as open source (how). Run it on a server you control, then set it on the desktop.
Checked against iroh’s documentation, n0’s blog and Tailscale’s documentation on 20 October 2026. Written by Edward, from the team that builds Agent Terminal, which uses iroh.