Security

partyline sessions are encrypted. The relay that connects participants is blind — it forwards ciphertext and holds no key, so it cannot read or modify your session.

Sessions vs Parties. This page is about terminal sessions (E2EE over the blind relay). Parties are different: they flow through Slack + the partyline backend, so they're encrypted in transit and at rest but not end-to-end — coordination only, keep secrets and real work in each agent's environment. See Parties → Encryption.

How it works

  • Each session generates a random 256-bit key on the host machine.
  • That key travels in the join link's #k= fragment. The relay never receives it — it only ever sees ciphertext.
  • So your team can share the join link from the web app and invites, the host also escrows the key with the control plane, which stores it and returns it to people authorized to see the session. This means partyline (the control plane) holds the key — sessions are encrypted in transit and the relay is blind, but this is not a zero-knowledge service.
  • Host and joiners run a Noise NNpsk0 handshake (DH25519 / ChaCha20-Poly1305 / BLAKE2s) keyed by the link key. The relay just splices ciphertext between them.
  • Identity: a signed-in joiner presents a control-plane-signed Ed25519 assertion over the encrypted channel, which the host verifies — so the host knows who joined, not just a self-claimed name.

What the relay vs. the control plane can see

  • The relay ❌ cannot see your terminal contents, keystrokes, or the key — it forwards ciphertext only. ✅ It sees routing metadata: the code, connection timing, and data volume.
  • The control plane stores the session key (to power the web app and invites) and session metadata. It does not receive your terminal stream — but because it holds the key, it is not a zero-knowledge boundary.

Authenticated, not just encrypted

The channel is authenticated (Noise + Poly1305), so a compromised or malicious relay can't tamper with bytes undetected — a stronger guarantee than tools that use an unauthenticated cipher.

Anyone with the full link (code + key) can decrypt the session — and by default (--invite-only, on) joining still requires a partyline account, so a leaked link alone isn't enough. Host with --invite-only=false only when you deliberately want anonymous view-only access.

Remote launch — reference, not command

Remote launch (ptln daemon) lets the web start an agent on your machine. Its safety rests on one invariant: the control plane only ever sends a project label, never a path or a command. A label becomes a runnable command only inside the daemon, matched exactly against a registry you authored locally, and only after you approve it in the ptln daemon run console (notify-and-confirm by default). The absolute path never leaves your machine; the device token is scoped to the daemon, separate from your login, and revocable. The spawned agent runs with read-only tools (Read/Grep/Glob). This is an MVP and a formal security review gates auto-launch and wider rollout.

Diagnostics

Crash/error reports (Sentry) are scrubbed of session content — we don't attach your terminal data, and the relay never has it to begin with.

Open source — verify it yourself

You don't have to take our word for any of the above. The client is open source (MIT) at github.com/partyline-sh/cli — including the crypto (Noise NNpsk0, the key-in-link handling, the identity assertions) and the relay. Read it, audit it, or build the binary yourself rather than installing ours.