Concord

Private communities. Open protocol.

Every message is sealed on your device before it leaves. Ordinary Nostr relays carry it, but a relay cannot read a message, produce a member list, or decide who is in charge. Three independent apps already speak the protocol — and nothing is stopping a fourth.

Get a client Read the specification How it works

What a relay sees

{
  "kinds":   [1059],
  "authors": ["a3f1…9c4e"]
}

A community is a key. Holding it lets you derive the address; not holding it means you cannot even find the room.

What comes back

AjMSpVv5aPQ0nUyBu2Zt4Rk9dGx7WqLoE1cHfNiXsY6mTgKrbA8vJlDwOePzZ3hC5uIq RtNfXbW1yMoKdSaE7pLgQvHjUcZ0T2nB9rDkAeYxs4iVmJ3wCfOgP6lZtNuHqRbXyKdM eSvA1oJpG8cLnWzTiY5rXkQ2fBdHhUuEmNxCsOaZ0tVgIRjPwlbFyD7q4KMcTnAveSXo

Relays, network observers, and non-members see sealed blobs addressed to rotating, meaningless labels — never a member list, a channel name, or a message.

The idea

Every group chat you have ever used has a computer in the middle.

It holds every message, knows every member, and is the final authority on who can do what. You trust it to stay online, keep your data private, and never turn on you. It can be subpoenaed, hacked, sold, or switched off — and when it is, your community dies with it.

Concord splits that computer's three jobs into pieces that need to trust nobody.

01CORD-01

Storage & delivery

Relays only ever see encrypted blobs addressed to rotating, meaningless labels. They cannot read a message, enumerate a membership, or tell two communities apart. One misbehaves? Use the others.

02CORD-02

Who is a member?

If you can decrypt the room, you are in it. There is no list for a server to enforce, leak, or be subpoenaed for — and no request anyone can deny.

03CORD-04

Who is in charge?

Every grant and ban traces back to the owner’s own key. Authority is math each member re-checks for themselves, not a power a server grants. A forged ban is simply dropped.

The result is full Discord-style moderation — owners, admins, roles, kicks, and bans — where authority is a signed list everyone can verify, and messages are sealed so that relays, network observers, and non-members see only noise.

Capabilities

Everything a community needs, and nothing that needs a host.

Concord is defined by a series of CORD documents. Like Nostr's NIPs, each is a small, self-contained piece that composes into the whole.

Communities and channels

One membership and authority model over any number of channels. Public channels derive their key from the community root; private channels carry an independent key, so a leak exposes exactly one room.

CORD-02 · CORD-03

Roles that verify themselves

Ranked permissions — admin, mod, or anything you define — rooted in the owner’s key. Every client folds the same chain and reaches the same verdict. An action that does not trace to the owner is dropped, not obeyed.

CORD-04

Invites that revoke

A link carries only a locator and an off-network unlock token; the keys live in an encrypted bundle on relays. Retire a link and the coordinate becomes a tombstone — no re-keying the whole community.

CORD-05

Removal that actually removes

Ban silences instantly and for free. Then the community rolls to a new key handed only to who is left, so everything after the rotation is unreadable to the removed member. No cooperation required.

CORD-06

Voice, video, and screenshare

Any channel is callable. A blind broker mints tokens without learning which community it serves, and the SFU only ever forwards ciphertext under per-sender media keys.

CORD-07

Disappearing messages

One staff-set timer per community. Messages expire via NIP-40 — hidden by clients, purged from local stores, and deleted from relays, so a future key compromise recovers nothing.

CORD-08

Pins that carry proof

A pin does not quote a message, it proves one: a signed seal plus a narrow key disclosure that opens exactly that message and nothing else. It survives every rotation and reaches members who never held the old keys.

CORD-04 §7

Your memberships, everywhere

A self-encrypted community list syncs your memberships across devices and across clients. Two different apps can serve one identity, and a fresh device reconstructs everything without an epoch-by-epoch walk.

CORD-02 §8

Supported clients

Three independent apps, one protocol.

A community created in one client opens in the others. Your identity is a key, not an account, so it travels with you — and if a client ever disappoints you, the community does not go with it.

Compare clients

Armada

Soapbox

The full Discord-shaped client

Communities, channels, threads, roles, voice and video, custom emoji and themes, plus a Discord bridge and server import. Armada speaks Concord alongside NIP-29 and Buzz communities, so one key carries you across the ecosystem.

Web
Android
Linux
Windows

Open Armada →Source

Vector

Vector Privacy

Privacy-first messenger, natively encrypted

A standalone Rust and Tauri messenger built on a Privacy by Principle philosophy: no KYC, no metadata collection, encrypted storage, optional Tor transport, and in-chat mini-apps. Vector co-authored Concord and ships the reference relay dictionary.

Windows
macOS
Linux
Android

Open Vector →Source

Accordion

hzrd149

A lightweight web client

A Concord community app built on the applesauce Nostr toolkit — a compact, independent implementation that demonstrates how little you need to speak the protocol. Runs entirely in the browser with no backend.

Open Accordion →Source

Where it fits

Concord is not the only way to do private messaging on Nostr.

It is built for one specific shape — large, Discord-style communities — that the others do not target. Each of these is good at something Concord deliberately trades away.

Protocol	Built for	Why not for a public community
NIP-17Private DMs	One-to-one messages	Cannot do communities. Multi-member rooms are an afterthought, and it is vulnerable to denial-of-service issues.
NIP-29Relay-based groups	Hosted group chat	You self-host an entire server just to start a community, and messages are not end-to-end encrypted. The relay is the authority.
MarmotMLS on Nostr	Small, high-stakes groups	MLS advances in lockstep — ordered commits, per-device key packages, logarithmic cost per change — which is heavy for large, casual, high-churn rooms.
Iris ChatDouble Ratchet chats	Pairwise ratcheted chat	Aims to replace Signal more than Discord: pairwise ratcheted conversations rather than owner-rooted communities.
ConcordEncrypted communities	Large, high-churn communities	Trades ratcheting guarantees for asynchronous, fold-anytime state that scales to a public community — no server, no lockstep commits, and authority every member re-verifies.

In short: NIP-17 is for DMs, NIP-29 trusts the relay, and Marmot and Iris Chat secure the small ratcheted group. Concord is built for the scale and shape of a public community.Read the long version →

Build on it

Bots are members, not integrations.

There is no platform to get API access from and no webhook to register. A bot holds a key like anyone else, and it moderates with exactly the rank its Grant gives it. Nothing about Concord privileges a human over a program.

Cargo.toml

[dependencies]
vector_sdk = "0.8"

Start building Implementer checklist

The specification

Eight documents. Read them all in an evening.

Read the specification

Authority is a signature, not a switch.
A forged ban is simply dropped, because it does not trace to the owner. And removing someone for real means changing the locks: the community rolls to a new key handed only to who is left.

Get a client Read the specification Contribute on GitHub

MIT licensed · contributions, questions, and review are welcome