← projects
Meshtastic logo

Meshtastic

Standard

An open-source, decentralized off-grid mesh networking protocol using LoRa radio technology for encrypted long-range communication without internet or cellular infrastructure. Created in 2020, Meshtastic enables text messaging, GPS sharing, and alerts across peer-to-peer networks using affordable hardware.

websitew3p explorer
README▼

Meshtastic

Description

Meshtastic is an open-source, decentralized off-grid mesh networking protocol using LoRa (Long Range) radio technology for encrypted long-range communication without internet or cellular infrastructure. Created by Kevin Hester in 2020, it enables text messaging, GPS location sharing, and alerts across peer-to-peer networks using affordable hardware starting at under $10.

In 2025, Meshtastic has become a global movement with deployments in 42+ countries, 300+ contributors, and 15,000+ Discord community members. It's being explored by municipalities as backup communication systems for natural disasters.

Links

  • Website: https://meshtastic.org
  • Documentation: https://meshtastic.org/docs/
  • GitHub: https://github.com/meshtastic
  • Discord: https://discord.gg/meshtastic
  • Reddit: https://reddit.com/r/meshtastic

Category

Privacy Infrastructure (Mesh Networking / Off-Grid Communication)

Ecosystem

Non-blockchain (Traditional Privacy Technology)

Key Features

Communication

  • Text Messaging: Short encrypted messages over LoRa
  • GPS Location Sharing: Share and track positions
  • Channel System: Multiple private/public channels
  • Store and Forward: Messages hop across nodes

Privacy & Security

  • AES-256-CTR Encryption: All messages encrypted
  • Per-Channel Keys: Different keys for different groups
  • No Central Server: Fully decentralized
  • No Internet Required: Works completely offline
  • License-Free: Uses ISM bands (no radio license needed)

Hardware

  • Entry-level devices from $9.90
  • Popular options: T-Beam, T-Echo (~$40)
  • Supported chipsets: ESP32, nRF52840
  • Optional: GPS, WiFi, screens

Project Status

Status: Production (Active Development)

Key Milestones

| Date | Event | |------|-------| | 2019 | First prototypes with TTGO T-Beam | | 2020 | Meshtastic v0.1.0 released | | 2024 | DEF CON deployment (2,000+ nodes) | | 2025 | Global community, 42+ countries |

Team

See Team Research for detailed team information.

Key Contributors

  • Kevin Hester (Geeksville) - Founder, embedded engineer
  • Jonathan Bennett - Core developer, Meshtastic Solutions
  • Tony Good - Hardware designer
  • 300+ community contributors

Technical Details

See Technical Analysis for technical documentation.

Security

See Security Analysis for security analysis.

Code Review

See Repository Analysis for repository analysis.

GitHub Metrics

| Repository | Stars | Language | |------------|-------|----------| | firmware | 6,591 | C++ | | meshtastic (docs) | 1,523 | MDX | | Meshtastic-Android | 1,334 | Kotlin | | web | 642 | TypeScript | | Meshtastic-Apple | 588 | Swift | | device-ui | 432 | C | | ATAK-Plugin | 400 | C |

Use Cases

  • Outdoor Recreation: Hiking, skiing, camping
  • Emergency Communication: Natural disasters, grid failures
  • Events: Festivals, conferences, trail runs
  • Community Networks: Neighborhood meshes
  • Tactical: ATAK integration for teams

Hardware Compatibility

| Device | Price | Features | |--------|-------|----------| | T1000-E | ~$35 | Popular, compact | | T-Beam | ~$40 | GPS, battery, screen | | T-Echo | ~$50 | GPS, e-ink screen | | RAK WisBlock | Varies | Modular system | | Heltec V3 | ~$20 | Budget option |

Limitations

  • Line-of-sight required for best range
  • Low bandwidth (text only, no voice/video)
  • Latency over multiple hops
  • Network depends on node density

Research completed with Constitutional Research v2.0.0 Last updated: 2026-01-19

OSINT Assessment▼

Meshtastic OPSEC & Vulnerability Assessment

Project: Meshtastic Assessment Date: 2026-01-19 Methodology: Constitutional Research Framework v3 Confidence Score: 0.94

Executive Summary

Meshtastic demonstrates a well-distributed infrastructure utilizing multiple cloud providers (Vercel, Railway, DigitalOcean, Cloudflare). The project maintains 118 public repositories, indicating strong open-source commitment. The MQTT infrastructure warrants attention due to exposed ports, but overall security posture is solid for a community-driven mesh networking project.

Infrastructure Overview

DNS & Domain Configuration

| Attribute | Value | |-----------|-------| | Primary Domain | meshtastic.org | | DNS Provider | Cloudflare | | Nameservers | gene.ns.cloudflare.com, woz.ns.cloudflare.com | | DDoS Protection | ✅ Cloudflare |

Subdomain Enumeration (22 Found)

Core Services:

  • meshtastic.org - Main website (Vercel)
  • api.meshtastic.org - API backend (Railway)
  • mqtt.meshtastic.org - MQTT broker for mesh network
  • status.meshtastic.org - Service status (BetterUptime)

Developer Tools:

  • flash.meshtastic.org / flasher.meshtastic.org - Firmware flasher
  • client.meshtastic.org - Web client
  • map.meshtastic.org - Network map
  • js.meshtastic.org - JavaScript library docs
  • python.meshtastic.org - Python library docs

Localization:

  • crowdin.meshtastic.org / translate.meshtastic.org - Translation

Events (Community Activity):

  • defcon.meshtastic.org - DEF CON presence
  • hamvention.meshtastic.org - Ham radio convention
  • opensauce.meshtastic.org - OpenSauce maker event

Cloud Infrastructure Analysis

Multi-Provider Architecture

| Provider | Services | Purpose | |----------|----------|---------| | Vercel | meshtastic.org, flash, flasher, map, client | Static hosting, CDN | | Railway | api.meshtastic.org | API backend | | DigitalOcean | mqtt.meshtastic.org | MQTT message broker | | BetterUptime | status.meshtastic.org | Status monitoring | | Cloudflare | DNS | DNS management, DDoS protection |

Assessment: Using multiple providers reduces single-point-of-failure risk.

Shodan Analysis

Main Website (76.76.21.21 - Vercel)

{
  "ports": [80, 443],
  "hostnames": ["no-sni.vercel-infra.com"],
  "vulnerabilities": [],
  "cpes": []
}

Assessment: Clean - standard Vercel edge infrastructure.

MQTT Server (159.223.197.197 - DigitalOcean)

{
  "ports": [22, 1883, 8883],
  "cpes": ["cpe:/a:openbsd:openssh:9.7p1", "cpe:/o:canonical:ubuntu_linux"],
  "vulnerabilities": [],
  "tags": ["cloud"]
}

Port Analysis:

| Port | Service | Status | Notes | |------|---------|--------|-------| | 22 | SSH | ⚠️ Exposed | OpenSSH 9.7p1 (current) | | 1883 | MQTT | ⚠️ Unencrypted | Standard MQTT port | | 8883 | MQTTS | ✅ TLS | Encrypted MQTT |

Concerns:

  • SSH (22) publicly exposed - consider VPN or non-standard port
  • MQTT (1883) allows unencrypted connections - could leak mesh data

Security Headers Analysis

meshtastic.org

| Header | Value | Status | |--------|-------|--------| | Server | Vercel | ✅ | | Strict-Transport-Security | max-age=63072000 | ✅ Excellent (2 years) | | X-Vercel-Cache | HIT | ✅ CDN enabled |

Missing Headers:

  • Content-Security-Policy
  • X-Content-Type-Options
  • X-Frame-Options

Risk Assessment

Security Findings Summary

| Category | Finding | Severity | |----------|---------|----------| | SSH Exposure | Port 22 open on MQTT server | Medium | | Unencrypted MQTT | Port 1883 allows cleartext | Medium | | No CVEs | No known vulnerabilities | ✅ Good | | HSTS | Enabled with 2-year max-age | ✅ Good | | Multi-provider | Distributed infrastructure | ✅ Good |

MQTT-Specific Concerns

The MQTT broker is critical infrastructure for mesh network coordination:

  1. Unencrypted Option (1883): Mesh devices connecting via 1883 transmit data in cleartext. While the mesh protocol itself provides encryption, the MQTT metadata (topics, connection info) could be observed.

  2. Authentication: Unable to determine authentication requirements from external scan. Should verify MQTT requires credentials.

  3. Single Point: mqtt.meshtastic.org is a single server. Consider broker clustering for resilience.

Positive Security Indicators

  • ✅ Modern SSH version (OpenSSH 9.7p1) - recently patched
  • ✅ Ubuntu Linux on MQTT server - well-maintained distro
  • ✅ MQTT TLS (8883) available for encrypted connections
  • ✅ Cloudflare DNS provides DDoS mitigation
  • ✅ No known vulnerabilities across all scanned IPs
  • ✅ 118 public repos = transparency and auditability
  • ✅ Multiple cloud providers = no single vendor lock-in

Potential Improvements

High Priority

  1. Restrict SSH Access

    • Move to non-standard port, or
    • Implement VPN/bastion host, or
    • Use Cloudflare Access/Tailscale

  2. Evaluate MQTT 1883

    • Consider disabling unencrypted port
    • Or document why plaintext is necessary (resource-constrained devices)

Medium Priority

  1. Add Security Headers

    • Content-Security-Policy
    • X-Content-Type-Options: nosniff
    • X-Frame-Options: DENY

  2. MQTT Redundancy

    • Consider broker clustering for mesh network reliability
    • Document failover procedures

Low Priority

  1. Rate Limiting
    • Implement on API and MQTT endpoints
    • Protect against abuse

GitHub Organization Analysis

| Metric | Value | |--------|-------| | Organization | meshtastic | | Public Repos | 118 | | Created | February 29, 2020 | | Twitter | @TheMeshtastic |

Notable: 118 public repositories is exceptional for a community project. This indicates:

  • Strong commitment to open-source principles
  • Active development across multiple platforms
  • Firmware, apps, libraries, documentation all public

Methodology & Sources

This assessment was conducted using:

  • crt.sh - Certificate transparency enumeration
  • Shodan InternetDB - Port/vulnerability scanning
  • DNS resolution - Infrastructure mapping
  • HTTP header analysis - Security posture
  • GitHub API - Organization metrics

Assessment conducted in accordance with Constitutional Research Framework principles.

Report generated: 2026-01-19 Next review recommended: 2026-04-19

Repository Analysis▼
⚙Analysis performed using cargo audit, semgrep, and direct code inspection on cloned repositories.→ methodology

Code Review & Repository Analysis: Meshtastic

Last Updated: 2026-01-19

Organization Overview

Organization: meshtastic

Description: Open-source, decentralized mesh networking ecosystem for long-range off-grid communication.

Followers: 5,400+

Repositories: 118

Verified Domain: meshtastic.org

Repository Metrics

| Repository | Stars | Language | Purpose | |------------|-------|----------|---------| | firmware | 6,591 | C++ | Device firmware | | meshtastic | 1,523 | MDX | Documentation | | Meshtastic-Android | 1,334 | Kotlin | Android app | | web | 642 | TypeScript | Web client | | Meshtastic-Apple | 588 | Swift | iOS/macOS app | | device-ui | 432 | C | Device UI library | | ATAK-Plugin | 400 | C | Tactical plugin | | web-flasher | 238 | Vue | Browser flasher | | protobufs | 149 | TypeScript | Protocol definitions |

Primary Repository: firmware

URL: https://github.com/meshtastic/firmware

Stars: 6,591

Language: C++ (embedded)

License: GPL-3.0

Code Composition

  • Embedded C++ for microcontrollers
  • Platform abstraction for ESP32 and nRF52840
  • LoRa radio driver integration
  • Bluetooth/WiFi connectivity
  • Protocol buffer message handling

Technology Stack

| Component | Technology | |-----------|------------| | Firmware | C++ (Arduino framework) | | Android | Kotlin | | iOS/macOS | Swift | | Web | TypeScript/Vue | | Protocol | Protocol Buffers | | Hardware | ESP32, nRF52840 |

Development Health

| Indicator | Status | |-----------|--------| | Activity | Very Active | | Contributors | 300+ | | Commit Frequency | Daily | | Issue Response | Active | | Documentation | Comprehensive | | CI/CD | Yes |

Notable Features

Multi-Platform

  • Android, iOS, macOS clients
  • Web-based interface
  • CLI tools
  • ATAK integration (tactical)

Hardware Support

  • Multiple chipset families
  • Various form factors
  • Community hardware designs

Tooling

  • Browser-based flasher
  • Configuration utilities
  • Mesh simulation tools

Code Quality Indicators

Positive:

  • Active development with daily commits
  • 300+ contributors (diverse input)
  • Comprehensive documentation
  • Multiple platform implementations
  • GPL-3.0 license (copyleft)
  • Protocol buffer definitions (typed API)

Areas for Improvement:

  • No formal security audits found
  • Embedded C++ requires careful review
  • Hardware diversity creates testing challenges

Build Requirements

Firmware

# Uses PlatformIO
pip install platformio
pio run -e tbeam  # Build for T-Beam

Android

  • Android Studio
  • Kotlin support
  • Standard Android build process

Web

npm install
npm run dev

Sources

| Source | Type | |--------|------| | GitHub - meshtastic | Official | | Meshtastic Developers | Official |

Actual Code Analysis (January 2026)

Analysis performed via direct code inspection on cloned firmware repository.

Cryptographic Implementation

Files Analyzed:

  • src/mesh/CryptoEngine.cpp
  • src/mesh/CryptoEngine.h
  • src/mesh/aes-ccm.cpp

Key Exchange: Curve25519

// src/mesh/CryptoEngine.cpp:24
void CryptoEngine::generateKeyPair(uint8_t *pubKey, uint8_t *privKey)
{
    // Mix in any randomness we can, to make key generation stronger.
    CryptRNG.begin(optstr(APP_VERSION));
    if (myNodeInfo.device_id.size == 16) {
        CryptRNG.stir(myNodeInfo.device_id.bytes, myNodeInfo.device_id.size);
    }
    auto noise = random();
    CryptRNG.stir((uint8_t *)&noise, sizeof(noise));

    LOG_DEBUG("Generate Curve25519 keypair");
    Curve25519::dh1(public_key, private_key);
}

Good Practice: RNG seeding with device ID and additional randomness.

Authenticated Encryption: AES-CCM

// src/mesh/aes-ccm.cpp - Based on Jouni Malinen's implementation
aes_ccm_ae(shared_key, 32, nonce, 8, bytes, numBytes, nullptr, 0, bytesOut, auth);

AES-CCM provides:

  • Confidentiality (AES encryption)
  • Integrity (CBC-MAC authentication tag)
  • Replay protection (via nonce)

Security Best Practices Found

Constant-Time Comparison (prevents timing attacks):

// src/mesh/aes-ccm.cpp:21
static int constant_time_compare(const void *a_, const void *b_, size_t len)
{
    const volatile uint8_t *volatile a = (const volatile uint8_t *volatile)a_;
    const volatile uint8_t *volatile b = (const volatile uint8_t *volatile)b_;
    // ...
    volatile uint8_t d = 0U;
    for (i = 0U; i < len; i++) {
        d |= (a[i] ^ b[i]);
    }
    return (1 & ((d - 1) >> 8)) - 1;
}

Weak Key Detection:

// src/mesh/CryptoEngine.cpp:48
if (Curve25519::isWeakPoint(pubKey)) {
    LOG_ERROR("PKI key generation failed. Specified private key results in a weak");
    memset(pubKey, 0, 32);
    return false;
}

Cryptographic Summary

| Component | Algorithm | Standard | |-----------|-----------|----------| | Key Exchange | Curve25519 | RFC 7748 | | Authenticated Encryption | AES-CCM | RFC 3610 | | Hash Function | SHA-256 | FIPS 180-4 | | Key Size | AES-256 (32 bytes) | NIST |

Memory Safety Considerations

Language: C++ (embedded)

| Concern | Status | |---------|--------| | Buffer handling | Manual (embedded constraints) | | Nonce management | Proper initialization | | Key material | Cleared on regeneration |

Note: Embedded C++ requires more careful review than memory-safe languages, but standard cryptographic libraries (Crypto.h, Curve25519.h) are used.

Encryption Coverage

| Feature | Encrypted | Notes | |---------|-----------|-------| | Mesh Messages | AES (PSK) | Pre-shared key per channel | | Direct Messages | AES-CCM | Curve25519 key exchange | | Node Discovery | Optional | Can broadcast in cleartext | | Position Data | Channel PSK | Same as messages |

Note: Default public channel uses a well-known PSK - encryption prevents casual eavesdropping but not determined adversaries who know the default key.

Licensing

GPL-3.0: Copyleft license requires derivative works to be open source.

Constitutional Research Note: Meshtastic demonstrates healthy open-source development patterns with extensive community contribution. The multi-platform approach and 118 repositories indicate a mature ecosystem, though the grassroots nature means less formal processes than corporate projects.

Team Research▼

Team Analysis: Meshtastic

Last Updated: 2026-01-19

Overview

Meshtastic is a grassroots, community-driven open-source project. Unlike corporate-backed projects, it operates primarily through volunteer contributions from a global community of developers, hardware designers, and enthusiasts.

Founder

Kevin Hester (Geeksville)

Role: Founder

Background:

  • Embedded engineer with expertise in low-power systems
  • Created Meshtastic in 2020 as a solution for off-grid communication during outdoor activities
  • Operates under "Geeksville Industries"

GitHub: geeksville

Verification: High - documented across multiple sources

Core Contributors

Jonathan Bennett

Role: Core Developer

Background:

  • Active contributor to Meshtastic firmware
  • Co-founder of Meshtastic Solutions (commercial entity)
  • Involved in project evolution from grassroots to commercial potential

Tony Good

Role: Hardware Designer

Background:

  • Entrepreneur focused on hardware design
  • Contributed to hardware compatibility and design

Community Structure

GitHub Contributors

  • 300+ developers contributing to firmware and applications
  • Open contribution model with welcoming developer community
  • Contributors work on features they're interested in during off-hours

Regional Communities

  • Active user groups in 42+ countries
  • Local mesh networks organized by community members
  • Educational initiatives teaching mesh networking

Communication Channels

  • Discord: 15,000+ members
  • Reddit: r/meshtastic community
  • GitHub Discussions: Technical coordination

Organization Model

Meshtastic operates as:

  • Open-source project (GPL-3.0 licensed)
  • Volunteer-driven development
  • No central company (though Meshtastic Solutions exists for commercial aspects)
  • Decentralized like its technology

Commercial Entities

Meshtastic Solutions

  • Commercial entity co-founded by Jonathan Bennett
  • Focuses on enterprise/commercial applications
  • Separate from the open-source project

Hardware Manufacturers

Multiple third-party manufacturers produce Meshtastic-compatible devices:

  • LILYGO (T-Beam, T-Echo)
  • RAK Wireless (WisBlock)
  • Heltec
  • Seeed Studio (T1000-E)

Sources

| Source | Type | |--------|------| | Meshtastic Wikipedia | Reference | | Meshtastic About Page | Official | | NH Meshtastic Evolution | Community | | GitHub Contributors | Official |

Constitutional Research Note: Meshtastic's decentralized organizational model mirrors its technology. The project's success comes from community contribution rather than corporate backing, making traditional "team" analysis less applicable.

Security Analysis▼

Security Analysis: Meshtastic

Last Updated: 2026-01-19

Security Overview

Meshtastic provides encrypted off-grid communication using AES-256 encryption. While designed for privacy, the security model has trade-offs appropriate for its use case as a resilient communication tool rather than a high-security system.

Encryption

Message Encryption

  • Algorithm: AES-256-CTR
  • Scope: Message payloads encrypted before transmission
  • Key Management: Per-channel symmetric keys

Channel Security

| Channel Type | Key | Privacy | |--------------|-----|---------| | Primary | Default or custom | Medium - known key | | Private | Shared via QR/URL | High - custom key | | Admin | Device-specific | Device management |

Key Distribution

  • Keys shared via QR codes or URLs
  • No automated key exchange
  • Manual key rotation required

Network Security

Decentralization

  • No central server to compromise
  • Each node is independent
  • Network continues if nodes fail

Traffic Analysis

| Threat | Mitigation | |--------|------------| | Message content | AES-256 encrypted | | Message metadata | Partially visible (headers) | | Network topology | Observable via radio | | Location | GPS sharing is opt-in |

Radio Considerations

  • LoRa transmissions are radio signals
  • Direction finding is possible
  • ISM bands are shared spectrum

Known Limitations

Security Trade-offs

  1. No Perfect Forward Secrecy

    • Static channel keys
    • Key compromise reveals all channel messages

  2. Metadata Exposure

    • Packet headers visible
    • Node IDs in clear
    • Radio timing observable

  3. Physical Security

    • Devices can be captured
    • Keys stored on device
    • No hardware security modules (typically)

  4. Key Distribution

    • Manual key sharing
    • QR codes can be photographed
    • No authentication protocol

Threat Model

Appropriate For

  • Outdoor recreation communication
  • Emergency/disaster backup
  • Community coordination
  • Privacy from casual observation

NOT Appropriate For

  • State-level adversaries
  • High-security communications
  • Protection against targeted surveillance
  • Situations requiring plausible deniability

Best Practices

For Users

  1. Use unique keys for sensitive channels
  2. Rotate keys periodically
  3. Disable GPS if location privacy needed
  4. Physical security of devices
  5. Don't share keys over insecure channels

For Deployments

  1. Segment channels by sensitivity
  2. Plan key distribution carefully
  3. Consider node placement security
  4. Document key holders
  5. Have key rotation procedures

Audit Status

Formal Audits

  • No formal security audits found in public records
  • Community review through open-source development
  • 300+ contributors provide code review coverage

Bug Reports

  • GitHub issues for security bugs
  • Community-reported vulnerabilities
  • No formal bug bounty program found

Comparison to Alternatives

| Feature | Meshtastic | goTenna | Briar | |---------|------------|---------|-------| | Encryption | AES-256 | AES-256 | Signal Protocol | | Open Source | Yes | No | Yes | | PFS | No | Unknown | Yes | | Hardware | DIY/Commercial | Proprietary | Phone | | Range | Long (LoRa) | Medium | Varies |

Sources

| Source | Type | |--------|------| | Meshtastic Documentation | Official | | Meshtastic Wikipedia | Reference | | Shellntel Guide | Technical |

Constitutional Research Note: Meshtastic provides "good enough" security for its intended use cases. Users should understand it's designed for resilient off-grid communication, not maximum security. The encryption is solid (AES-256), but the overall security model has trade-offs appropriate for a mesh network.

Explore Related Projects

Click nodes to explore connections. Drag to reposition.

Community research for Web3Privacy