Channels and encryption: private groups done right

IntermediateMeshtasticAbout 15 minutes

You'll need

• Two or more radios on the same mesh
• The Meshtastic app

How channels work

Each radio has 8 channel slots, numbered 0 to 7.

• Channel 0 (primary) must match your local mesh. Its name and settings decide your frequency slot.
• Channels 1–7 (secondary) can each have their own name and key. That’s where private groups go.

Active channels must be consecutive (no empty slots in between). Names must be shorter than 12 bytes, and admin is reserved.

Make a private channel

1. In the app, open Channels and add a new secondary channel.
2. Give it a short name, like family.
3. Set the key (PSK) to a new random key. The command-line equivalent is random, which creates a secure 256-bit key. Don’t use default (publicly known) or the one-byte “simple” keys for anything private.
4. Save.
5. Share it by showing the app’s channel QR code to each family member in person. Anyone with the code can read and send on the channel.

Never put private keys on unattended nodes

Keys can be pulled from a radio someone can physically access. Keep private channels off rooftop and hilltop nodes.

Position privacy

Each channel has a position precision setting from 0 (never send location) to 32 (exact). For example, 13 bits is roughly 2.9 km (1.8 miles). Lower it on public channels if you don’t want your exact location broadcast.

Optional: AEAD

Firmware 2.8.1 adds an experimental Use AEAD option that detects tampered messages. Every radio on the channel must turn it on, or they can’t read each other.

What’s still visible

Packet headers (who sent a packet and where it’s going) are never encrypted. Direct messages use separate public-key encryption. For a fuller picture, see Encryption and privacy.

Sources

Checked on October 18, 2026.

1. meshtastic.org/docs/configuration/radio/channels
2. meshtastic.org/docs/overview/encryption
3. meshtastic.org/docs/getting-started/joining-your-local-mesh