Encryption and privacy
Mesh radio messages travel through other people’s radios. Encryption keeps relays from reading what they pass along, but only if you set it up right.
The short version
Section titled “The short version”- The default public channel is not private. Its key is published, so anyone can read it.
- Private channels use a key only your group knows. Share it in person or by QR code.
- Direct messages in Meshtastic are encrypted with a key that only you and the other person have.
- Some information is always visible: who sent a packet and where it’s going (the packet header), and anything you broadcast on public channels, like your position.
Meshtastic in detail
Section titled “Meshtastic in detail”| What | How it’s protected |
|---|---|
| Channel messages | AES-CTR using the channel key. Key length sets the strength: 16 bytes means AES-128, 32 bytes means AES-256. |
| Default primary channel | Uses the published key AQ==. Readable by anyone. |
| Direct messages | Public-key encryption: X25519 key exchange, then AES-256-CCM. |
| Packet headers | Never encrypted, because relays need them to forward packets. |
Go deeper: limits the Meshtastic docs list
- No forward secrecy. If a key leaks later, recorded traffic can be decrypted.
- Unsigned channel messages. Anyone with a channel key can send a message that claims to be from any node. Treat sender names on channels as a claim, not proof.
- Trust on first use. Radios trust the first public key they hear for a node. Before sending anything sensitive, confirm the other person’s key another way.
- Physical access. Don’t put private channel keys on unattended nodes like repeaters, since keys can be pulled from a device you can touch.
- Tampering. AES-CTR doesn’t detect messages changed in transit. Firmware 2.8.1 adds an optional AEAD mode (AES-CCM) for channels; every node on the channel must turn it on.
- Quantum computers. AES-256 is considered quantum-resistant; the X25519 key exchange is not.
Setting up a private group (Meshtastic)
Section titled “Setting up a private group (Meshtastic)”Leave channel 0 on your local mesh’s public settings, and add your group as a secondary channel (1–7) with a random key. You stay reachable on the public mesh while group chat stays private. Share the channel by QR code or link. See Channels and encryption.
MQTT and the internet
Section titled “MQTT and the internet”If any radio on your mesh uploads traffic to an internet MQTT server, your messages may leave the radio world. Encrypted messages stay encrypted on the server, but default-channel messages are readable. The official public server only shares approximate positions.
MeshCore
Section titled “MeshCore”MeshCore also has direct messages and private channels. We haven’t found official MeshCore documentation that describes its encryption in detail, so we don’t make claims about it here. One must-do: change the default passwords on repeaters and room servers (password for admin, hello for room-server guests).
Ham mode means no privacy
Section titled “Ham mode means no privacy”Licensed amateur operators must turn encryption off: FCC rules forbid amateur messages “encoded for the purpose of obscuring their meaning.” In Meshtastic’s licensed mode, everything is sent unencrypted. See Legal basics.
Sources
Checked on October 18, 2026.