see also techfaq

Tox is by no means complete. You may encounter bugs ranging from simple visual defects to segfaults on file shares. We cannot guarantee what works today will work tomorrow; Tox is an alpha program and code changes daily. Certain commits may break existing APIs, and we strive to give proper advanced warning to all client developers, etc. when such changes will be made. Additionally, Tox has not yet received a full security audit. While we believe Tox is secure against attackers who want to decrypt your messages, you may wish to use a more established solution if you are in a life-or-death situation.

Tox is a free (as in liberty and price) peer to peer, distributed, multimedia messenger.

Using existing technologies such as dispersed networking and strong cryptography, Tox can provide a superior instant messaging experience than current market offerings. Files can be shared as fast as you and your partner's Internet connection allows, audio calls are instantaneous, and there are no arbitrary limits to how many people you can have in a group conversation.

Tox's goal is to get secure messaging in the hands of everyone because we feel it's necessary in a world where our privacy is often overlooked; which means our efforts are free of charge with absolutely no strings attached. There are no advertisements; you are not the product and absolutely no data is collected from our users. We are here for altruistic purposes, which is why we rely on the community to help us make Tox better.

Tox provides an encrypted, distributed, and extensible peer-to-peer platform that can be used for various forms of communication. We intend Tox to be used as a multimedia messenger, but many people have shown us that Tox can be used for a lot more than just instant messaging. For the sake of simplicity, the rest of this page will explain how Tox operates as its intended use.

Tox users are connected by a modified version of DHT, and bootstrap nodes are used to assist connections to the pool. The hash table consists of each Tox ID and an encrypted entry of each users' IP, which is only readable when a friend request is made with a proper Tox ID, including the nospam. When a user friends another user, their IPs are exchanged in order to facilitate a direct connection. Once a handshake occurs, a connection is established, and users converse through a crypto stream.

It consists of a core, and a number of clients.

Tox is just the core, the part of the program which handles the messages and encryption, for instance. But it can only function in the context of a complete instant messaging program. All the fancy user interfaces you see all over the place, are the clients. The client is a separate program which utilizes the core, providing a convenient way to use the program. So when you use Tox, you are in fact using one of the clients. The most clients are graphical clients, in other words, you will make use of all kinds of graphical elements which are part of the client. You usually won't get to see the core (unless you look into the source on GitHub). There are various clients available which each have a different name, are independent from each-other, in various programming languages.

For example, file sharing and A/V (audio and video) are handled by the core, but the (for example!) pop-ups, per-person volume sliding bars, friends list etc, buttons etc. are all handled by the client.

• When you are referring to the Tox protocol or in general, you are talking about Tox.
• When you are referring to the Tox program itself, you are talking about the Tox core, usually written as toxcore (see the Git)
• When you are referring to one of the clients, you should mention the name of the client instead of 'Tox' or 'toxcore', such as Toxic or qTox (see Clients)

It's not done yet, but we're open source, so you can try out our current working version at any time! Remember that it is very likely Tox will have bugs or missing features. Please read the warning ​the top of this page before you begin.

If you just want a prebuilt version to play around with, see Binaries.

If you want to contribute to Tox, or prefer to compile your own, check out Source.

Tox protects your privacy by removing the need to rely on central authorities to provide messenger services, concealing your identity(In the form of meta-data, your IP address) from people who are not your authorized friends, enforcing Off-The-Record Messaging as the default and only mode of operation for all messages, and by making your identity impossible to forge without stealing your personal private key on your own computer.

Look in the profile or settings panel of your client to get your Tox ID which should look something like: 56A1ADE4B65B86BCD51CC73E2CD4E542179F47959FE3E0E21B4B0ACDADE51855D34D34D37CB5

Give yours to your friend and get your friend to add it. That's it. Additionally, if you want a shorter more memorable ID, you can use a ToxDNS service.

If you remove someone, they will see you go offline, as if you closed client normally. They can't communicate with you any longer until you add them to your friend list again.

Currently Tox does not support plugins, though this feature may be added later on.

Tox makes no attempt to cloak your IP address when communicating with other users, as the whole point of peer-to-peer is to connect you directly to your friends. A workaround does exist in the form of tunneling your Tox connections through Tor. However, a user cannot uncover another user's IP address using only a Tox ID to find the user in the DHT, the IP address will only be discernible when the users become “friends.” 1

See Also: What is stopping people from tracking me through the public DHT.

No.

Encryption makes it impossible for anyone who is not the sender or recipient of a message to know content of message. All Tox communications (text, audio, video, file transfers, etc) are encrypted. That includes perfect forward secrecy, so all other Tox sessions (including those with the same friend) are safe in the case that someone manages to decrypt one session. This is not negotiable; it is the only mode Tox will operate in.

Thanks to public key cryptography, it is also impossible to pretend to be another Tox user, unless you were to steal that user's private key.

Tox uses the encryption algorithms present in the NaCl crypto library.

“<irungentoo> (…) curve25519 for the key exchange, xsalsa20 for the encryption and poly1305 for the MAC”

More info: https://github.com/irungentoo/toxcore/blob/master/docs/updates/Crypto.md

The encryption used in Tox not only provides same features as OTR, but is also the default, and only operation mode of Tox.

Yes! See Tox over Tor (ToT).

Check out nodes for an updated list.

Opus for audio and VPX (currently 8) for video.

SIP is not being used.

“<irungentoo> toxcore packets are encrypted with MACed crypto so data will never be corrupted in transit”

It basically means that data won't ever be corrupted when sending between Tox clients.

tl;dr: Your network connection deserved to be killed.

Explanation: Sometimes you will have a router or some other network device which does not want to work well with Tox. In fact, it may outright refuse to work at all, “dying” at your hands.

<irungentoo> the routers dieing is caused by too many connections
<irungentoo> some idiotic routers treat one UDP packet sent to an ip/port as one connection
<irungentoo> and keep track of it
.
.
<irungentoo> and the reason why hole punching doesn't work very well on newer routers

There isn't a lot that could be done about it, but there is a workaround - you can disable UDP in your Tox clients and see whether it would help.

Tox generates a temporary public/private key pair used to make connections to peers in the DHT. Onion routing is used to store and locate Tox IDs, to make it more difficult to, for example, associate Alice and Bob together by who they are looking for in the network.

Requirements for friend request (FR) to work:

1. Other side has to be online to receive FR.
2. Other side has to accept FR after receiving it.

If you are sure that other side was online when you have sent FR, and they did not receive it, please report it.

There are antiviruses that report Tox as false positive. If you did get Tox from official Tox website, and your antivirus causes problems and is not on a list please say that antivirus causes problems. Additionally, you could report to your antivirus makers that Tox is reported as false positive when it should not be.

Tox is continuously developed, and at the moment not all features are in place. Here are answers to some of questions

Yes, it's planned. More info about possible ways it could be implemented here.

Yes, you can. Note though that it should be kept synced by you across devices, and running more than 1 Tox instance at the same time using same profile will lead to bad things™ happening. Nothing critical, but you would experience severe disruptions using Tox, like friends constantly going offline / online, file transfers not working, etc.

Import / Export

Persistent groupchats are being developed as part of the groupchat overhaul which is being undertaken primarily by Jfreegman. The work is nearing completion and the github branch can be found here.

Yep. Planned: GSoC 2015 Offline messaging.

Yep. There is still missing a proper design of interface for it, so if you think that you could contribute one, please do so

The core library: https://github.com/irungentoo/toxcore

Check out the instructions found in INSTALL.md in the root of the toxcore repository.

For more information on the communicating with the Tox community, see community.

As an open source project, Tox needs developers first and foremost. Graphic designers are very welcome too. Adventurous users can test and report bugs, translators will be necessary later on to translate stuff, and this wiki could always use another pair of hands! For more information on contributing to Tox, see contributing.