Kangentic Relay

Kangentic Relay is a small, stateless WebSocket rendezvous server. It pairs two connections that present the same slot identifier and forwards bytes between them. That is the entire product.

It is open source under AGPL-3.0, and you can run your own instead of Kangentic’s.

Why a relay exists at all

Your desktop usually sits behind a router that will not accept inbound connections, and a phone moves between networks constantly. So neither device listens for the other. Both dial outward to a relay, which pairs the two connections and forwards bytes between them.

The relay is a rendezvous point, not a participant. The encryption is negotiated directly between your phone and your desktop, inside the tunnel the relay forwards. It holds no keys and terminates no encryption, so there is nothing for it to decrypt even if it wanted to.

The blind-relay guarantee

The blindness is structural rather than a promise:

• The relay routes purely on an opaque slot value in the connection URL. It pairs exactly two connections presenting the same slot and forwards every binary message byte for byte, without parsing, wrapping, or inspecting frame content.
• The relay’s source has no runtime dependency on @kangentic/protocol, the end-to-end crypto layer whose frames it carries. That package appears only as a development dependency, imported by a single integration test that proves a real handshake completes through the relay. test/blindness.test.ts fails the build if that ever changes.
• There is no authentication, no account, and no signup. The slot identifier is the only credential the relay has, and it is generated by the clients.

Blind is not invisible

Carrying encrypted traffic still means observing that traffic exists. See what a relay operator can still see for the honest version, which applies to whoever runs the instance you use, Kangentic included.

Kangentic’s or your own

Both run the same published image. The difference is entirely about who gets to observe your connection metadata.

	Kangentic Relay	Your own relay
Who operates it	Kangentic	You
Who observes your connection metadata	Kangentic, and Cloudflare in front of it	You, and whatever you put in front of it
What it can read	Nothing	Nothing
Setup	None. It is the default	A container, a hostname, and TLS
Cost	Free, and no account	Whatever your server costs

The desktop calls the first one Kangentic Relay and marks it Official; the second is Custom Relay. Both live in Settings > Mobile Devices.

Source and license

The relay is github.com/Kangentic/relay, licensed AGPL-3.0-only and self-hostable indefinitely. Kangentic’s hosted instance is free and needs no account. @kangentic/protocol, the end-to-end pairing and crypto layer whose frames the relay carries opaquely, is also AGPL-3.0-only, in the main repository. An auditable crypto core is a feature for a security product, not a concession.

Next steps

Next: The Hosted Relay - what the instance Kangentic runs can see, where it runs, and what it keeps.

See also:

• Self-Hosting the Relay - run your own with Docker
• Relay Reference - every environment variable, endpoint, and close code
• Relay Security Model - the guarantees, and the risks the design accepts
• Security & Encryption - the encryption the relay carries but cannot read