cjdns

cjdns is a networking protocol and implementation that builds an encrypted IPv6 network using public-key cryptography for address allocation and a distributed hash table (DHT) for routing. The result is near-zero-configuration networking that sidesteps many of the security and scalability problems baked into the conventional internet: addresses cannot be spoofed, traffic is encrypted end-to-end by default, and no registry or provider decides who may participate. For sovereign builders, the appeal is structural — there is no hierarchy, no privileged core, and no authority handing out addresses; every node is a peer.

Key-derived addresses

A cjdns node's IPv6 address lives inside the fc00::/8 unique-local range and is computed from the double SHA-512 hash of the node's public key (the implementation grinds keys until the derived address falls in that range). Because the address is a fingerprint of the key, identity and location collapse into one: you cannot impersonate another node without its private key, and nobody can allocate, revoke, or reassign your address, ever. Contrast this with the ordinary internet, where your address is leased from an ISP and your identity is asserted by certificate authorities — two dependencies cjdns simply deletes. All traffic between nodes is carried in encrypted tunnels keyed to those keypairs, so encryption is not an optional layer bolted on top; it is the transport.

DHT routing without a core

cjdns organizes its routing with a Kademlia-inspired distributed hash table rather than global routing tables. Each node knows its direct peers and learns compact source-routing labels — essentially turn-by-turn directions through the mesh — toward nodes that are numerically close in address space and physically nearby. A packet is forwarded from router to router, each one moving it toward a peer better positioned to reach the destination. This avoids the centrally coordinated routing infrastructure that makes traditional networks fragile and censorable, and it lets a cjdns mesh self-organize as nodes join and leave. Peering is deliberately social: links are established with peers you actually know — over a physical radio or ethernet link, or tunneled across the existing internet — so the network's trust graph mirrors real relationships instead of a provider's customer list.

Hyperboria and where cjdns fits

The largest deployment is Hyperboria, a volunteer-run global mesh that grew from the project's community, alongside various city-scale community networks that have used cjdns as their encrypted backbone. In the sovereign toolkit, cjdns occupies the encrypted-overlay-network slot: it will happily run over whatever links exist — commodity internet today, community WiFi or point-to-point radio tomorrow — while keeping addressing and encryption independent of any of them. That makes it a natural transport for services you refuse to make dependent on permissioned infrastructure, from a full node peering privately with friends to a Nostr relay reachable inside a community mesh.

The project has history behind it: created by Caleb James DeLisle around 2011 and written largely in C, it predates most of today's overlay networks and has served as a reference point — and cautionary tale-collector — for a decade of mesh experiments. Its age shows in both directions: the concepts (compact source routing, cryptographic addressing) influenced successors, while the operational experience of Hyperboria taught the community hard lessons about keeping volunteer meshes alive, chief among them that the social layer — who peers with whom, and why — determines a mesh's health far more than its routing algorithm does. That lesson generalizes to every decentralized system worth running, Bitcoin included: protocols enable resilience, but people sustain it.

cjdns shares its keys-as-addresses philosophy with the Yggdrasil Network, a younger project with a different routing design, and like Reticulum it belongs to the family of tools for building networks that do not ask permission.