I2P 2.14.0 (API 0.9.71) was released on 2026-10-20. This release hardens security across the router and bundled apps, brings a large round of i2psnark improvements, and fixes streaming and tunnel reliability issues.

As usual, we recommend that you update to this release. The best way to maintain security and help the network is to run the latest release.

https://i2p.net/en/downloads/

Notes: Windows Easy Installer, Ubuntu repo, and Android will be released in the coming days. Security

Router

• AES operations and EdDSA signature comparison are now constant time (73819404c, 6440d5f16)
• Fixed an out-of-bounds read in garlic clove parsing and an undersized NTCP2 message 3 buffer (67b2f7327, db3cd60f1)
• Tunnels drop duplicate fragments and cap the fragment reassembly map (8af94b9e4, 4c3d10c12)
• Smaller robustness fixes in NetDB, NTCP, and datagram handling

i2ptunnel

• HTTP proxy blocks requests to private, loopback, and link-local IPv4 addresses (3aef97a9d)
• Fixed SOCKS 4/4a downgrade bypass of proxy authentication (ff63e0cdf)
• HTTP server tunnels strip CR from headers; proxy auth strings are no longer logged
• Output escaping fixes throughout the Hidden Services Manager

i2pcontrol

• CSRF token protection, JSON security headers, and a delay on failed auth (9a1c56f35, e79e4949d, 8fbfb70fb)
• Removed fallback to the default itoopie password

i2psnark and Addressbook

• Hardened bencode parsing (recursion limit, duplicate key rejection) and path traversal checks
• Addressbook checks for destination mismatch on update (a884b9093)

i2psnark

• Magnet links: all trackers are now used and saved, plus dn name and xl size parameter support
• Trackers and DHT: UDP backup tracker, smarter announce timing, spec-compliant dictionary sorting, compressed UDP and DHT messages
• Performance: lower memory use and faster hashing when creating or rechecking torrents; tuned request throttling, pipelining, and timeouts
• UI: free disk space shown and checked when adding torrents, audio playlist controls, live updates resume when the tab is visible again
• Fixes: file priorities no longer lost after the startup check (GH #170), metainfo attribute extraction, extension handshake NPE
• Groundwork for BitTorrent v2 (not yet user-facing)

Streaming and Transport

• Streaming synchronization fixes in the retransmit and ack paths, plus slow start and reset tuning (061d4e3f6)
• Tunnels periodically use 5-slot tunnel build messages
• New explicit force-IPv6 option, with Docker bridge support in progress
• SAM: fixed DG2/DG3 subsessions (d2392ae9b)
• I2CP: new discardMessage() session API

Other

• SusiDNS: new "conflicts" address book
• Reseed: added reseed2.i2pgit.org, reseed.kiota.ch, two skhron.eu servers, and i2p.ntp.poweredbyberlin.de; removed reseed.i2pgit.org
• Docker: Debian Trixie, OpenJDK 21, Ant 1.10.18, commit SHA stamped in builds
• Build fixes for izPack 5.2.6, gettext 1.0, and Gradle
• GeoIP, Tor blocklist, tracker list, and translation updates

Full changelog: i2p-2.13.0...i2p-2.14.0

Thanks to zzz, eyedeekay, Nicholas Lopez, and fa.

Copied from that other site. ‐-------------------------------------------

Windows installer and portable ZIP with I2P built in. No separate I2P setup or port forwarding. Linux terminal client and hub/server also available.

Windows download

Linux download

GitHub: Client - Server

Start the client, give I2P a few minutes, then select File → Connect to I2P hub: Or just press the star.

adc://mrjdpwyvlr23hoqpd3xbkgf4z7gdmwsbug7qm4fjkwd4dnsx4noq.b32.i2p No registration or password.

Audio only test hub.

Edit:

The protable version work in Sandboxie and no need to share any files.

This release of I2P, 2.13.0, has been focused on post-quantum support, performance improvements, and bug fixes that improve usability.

Since the 2.12.0 release (April 2026), development has focused on stronger encryption, better bandwidth management, network stability, and a more usable console.

Post-quantum protection is now fully available on the main transport (NTCP2), guarding against future “harvest now, decrypt later” attacks. The underlying cryptography library has been updated with constant-time operations prevent timing-based attacks. Legacy transport code (SSU1) has been fully removed.

Tunnels now have per-tunnel bandwidth limits, preventing any single tunnel from monopolizing your connection. The system is smarter about congestion.

Peer discovery and selection have been tuned for reliability. Floodfills are tracked more accurately.

The web interface now shows a world map of routers in search results for RouterInfos in the NetDB.

Containers now handle log rotation automatically, drop privileges properly, manage IP addresses correctly in containerized environments, and start up more reliably.

The BitTorrent client (i2psnark) reannounces faster after magnet links resolve, handles edge cases better, and cleans up bandwidth limiters on exit. The email client (Susimail) offers an experimental standalone build and removes old login code.

As usual, we recommend that you update to this release. The best way to maintain security and help the network is to run the latest release.

Copied from that other site, I'm not the person behind this.

Recently I was thinking about what I'm doing on internet. And I found out that all of my internet activity is basically just watching videos on youtube. So I thought "Why there isn't anonymous, private and free (as in freedom) youtube-like site on I2P?" and decided to do it myself.

First eepsite of this project: http://itubep.i2p

More you can read on project's github page: https://github.com/i2ptuber/itubep

Warning! Work heavily in progress.

Warning!!! Code is 100% AI slop, because I'm poor programmer.

Copied from that other site...

Independent researcher working on an I2P censorship measurement paper (English). Have some preliminary findings and an analysis framework in place. Looking to go deeper before submitting to arXiv.

Seeking collaborators for:

• Longitudinal tracking — baseline data collected, need ongoing observation for trend analysis

• Node reverse engineering — behavioral patterns identified, want to confirm technical details

• Protocol verification — TCP-level results done, want to add deeper handshake validation

Non-profit project, no funding. Co-authorship (2nd/3rd) based on contribution.

Interested? Reach me via PGP-encrypted email with your GitHub profile and a brief intro:

iasds.github.io

PGP: 1A60 9235 A475 39DF 6C4C C09B 822A 6DA9 E3BD 0612

Copied from reddit

I built an open-source Python tool that scans the I2P NetDB using nothing but vanilla i2pd floodfills. No patched binaries, no active probing — just parse the routerInfo files i2pd already writes to disk.

Repo: https://github.com/iasds/i2p-network-scanner

How it works

Run a few i2pd floodfill instances with different identities. Each covers a different DHT shard, so together they passively collect RouterInfo from most of the network. A single Python script parses the raw .dat files and extracts ident hashes, IPs, versions, caps flags, transports, and bandwidth tiers. Companion tools handle SQLite import, CLI queries, and GeoIP enrichment.

I ran a scan and published the results

5 floodfills, ~24 hours. The full analysis is in the repo:

• 17,541 known routers — 5,205 with public IPs, 12,336 behind NAT or firewalled

• 70% hidden is not a coverage gap — routers behind NAT simply don't include a host= field. That's I2P by design.

• 4,976 unique IPs across 111 countries

• Top countries: US (1,120), Russia (507), Germany (366), Canada (199), Netherlands (198)

• China has only 72 public nodes. Iran has 96.

• 0.9.68 dominates at 47% of routers, but only 11% of them publish an IP. Newer 0.9.69 (20% share) has 55% public rate.

• Java I2P is essentially extinct — nearly everything runs i2pd.

• 90 floodfills worldwide, concentrated in US, Russia, and Germany.

• Only 76 routers declare X-tier bandwidth (>2 MB/s).

Full report: I2P_NETWORK_ANALYSIS.md

If anyone has historical NetDB snapshots I'd love to compare trends over time. PRs welcome.

I've been wondering, is there a good way to find things on i2p like there is on tor? Like a search engine?

TEXT COPIED FROM REDDIT!

Hi everyone,

I want to share the idea I had for a hackaton.

Starting from the problem:

For ~30 years, discovery (of information or of people) has been mediated by a central index: search engines, recommenders....

Ranking is computed server-side, under rules the user can't inspect (think of Instagram or TikTok feed)

The idea to create a feed for a P2P network: convert messages into meaningful concepts through embeddings:

If each device can (a) run a competent embedding model locally and (b) reach other devices peer-to-peer, then relevance (semantic match) no longer needs a central index. It can be computed at the edge, by semantic distance, with no privileged ranking party.

In order to test, I developed a working prototype to pressure-test the idea rather than simulate it.

Each post is encoded into a embedding by a model running on the device (EmbeddingGemma-300M). A lightweight signed announcement (author + embedding) gossips peer-to-peer across a shared room; full bodies are pulled only for the bounded set a node actually admits. Each device ranks incoming posts against its own posts by cosine similarity and keeps a bounded local inbox.

There is no server, no account, no global ranking, the address space is meaning

Why could be potentially the basis for the agentic era?

The same substrate I presented lets AI agents discover each other: an agent publishes a need or an offer as an embedding, and agents whose profiles are semantically close respond.

The experiment it's fully open source (Apache-2.0) code, the complete threat model, and the architecture docs are all public.

Ordinal reddit post. https://www.reddit.com/r/ipfs/comments/1ucvu5e/semantic_routing_through_rag_to_create_a_p2p/

XNS is the eXile Name System. It makes Monero the only source of truth. Each XNS name is a result of a 0.01 XMR burn transaction with the desired name and owner public Ed25519 key.

Now it can be used as the name system of I2P.

Why would you use it all of a sudden? Because currently, there is no safe names in I2P. Unless you use direct b32.i2p addresses, which are not human memorable.

What's wrong with .i2p addresses? They are just entries on your own machine and on jump services. You have to trust those jump services if you share your .i2p address with others and expect reliability. Think of it as .local/.lan names your network router resolves.

While with XNS, once you claim a XNS name, as long as Monero stands, your name will be yours and no one can take it from you.

Read more about it on https://xns.rocks/docs For I2P specific articles, read https://xns.rocks/docs/xns-and-i2p/xns-on-i2p Source code: https://xns.rocks/exilens/xns Matrix channel: #xns:xns.rocks | https://matrix.to/#/#xns:xns.rocks

XNS is made for the Internet of free people. I believe I2P is the only reliable way.

IslandChat, a free chat site with roulette now supports I2P!

You can access it with this link: http://ji34zyv5j526gflnyw5jym45zt6uvk7x6x2vq3ccjyaq7ntjt4ka.b32.i2p

Be aware, HTTPS is required for video chat to work in browsers, so this link will redirect you to the actual address with HTTPS enabled. Once there, your address book will have 2 addresses; one is the HTTP with redirect, and the other is the real address. If you try accessing the real address without HTTPS, it won't work.

Javascript is also required for the site to function.

Happy chatting!

I installed I2P on a Linux laptop. For the moment I'd prefer not to have I2P to start automatically as system service. The installation guide says that after installation I can simply run i2prouter start, which starts the service and opens the router console on my browser; I've configured the router.

Question 1: what's the best way to shut down router and service, when I need to? The guide above says I can use the command i2prouter stop; but I also see buttons on the browser console and on the tray on the taskbar.

Question 2: I've also noticed that sometimes after i2prouter start I get asked again to configure the router. How do I make sure the configuration is saved once and for all?

Unfortunately I didn't find anything about these specific points in guides or FAQs.

Thanks for helping!

This update focuses on critical stability improvements, memory management, and the initial infrastructure for I2P integration. We've also addressed several UI bugs and search logic inconsistencies to provide a smoother user experience.

New Features

• I2P Integration: Added the foundational configuration infrastructure for I2P, including a dedicated UI settings panel and registration within the options dialog
• JDK 26: Updated to JDK 26 bundled runtime
• Telluride Build 44: Latest Telluride Video Downloader improvements

🛠️ Bug Fixes & Stability

• Memory Leak Prevention: Implemented bounds on previously unbounded image and icon caches to stop excessive memory consumption
• Crash Fix: Resolved a specific crash that occurred when users pasted non-video URLs into the search bar
• Linux Improvements: Fixed persistent tray icon issues specifically for users on KDE Plasma (#845)
• Search Logic: Fixed the "Search Tools" filter and overhauled the logic to ensure all search filters now work independently and accurately
• I2P Configuration: Fixed I2PPaneItem return value for applyOptions to ensure settings are saved correctly

📈 UI/UX Refinements

• Speed Accuracy: Fixed a calculation error in the Peers Tab; download/upload speeds are now correctly converted from bytes/s to KB/s for easier reading

I've finally installed the I2P (java) software, and even though I'm not actively using I2P yet, I'm very happy to contribute bandwidth to the network.

I'd like to understand more the difference between I2P and I2Pd. Is it just different software for the same purpose? So it seems from the FAQ here: "I2Pd is a C++ implementation of the I2P protocol. When using I2Pd you will need to edit configuration files, with Java I2P you can do it all within a user interface."

I'd be happy to hear about user experiences on both. Was I2Pd much more difficult to set up? Is it more than just a software difference? Has anyone noticed better stability or other differences with either one?

Thanks for everone's help! 🙏

Warning: AI slop, but might be somewhat interesting to anyone wanting an overview.

People's websites get pummeled by LLM companies scraping the web. I bet they don't use nor scrape I2P though. Would using eepsites be a remedy?

/etc/i2pd/i2pd.conf contains number of listening ports configuration (actually 10 or more when you look for "port"). Which ones should I open in firewall so other people can connect my node? Excluding ones that are meant for management of my node. I manage the node only locally.

So far I have only open/forwarded one port, one that is set a few lines below the line "## Port to listen for connections" that certainly allows relaying traffic for other I2P peers per the http://127.0.0.1:7070/ traffic stats.

Services HTTP Proxy	Enabled
SOCKS Proxy	Enabled
BOB	Disabled
SAM	Enabled
I2CP	Enabled
I2PControl	Disabled

From that other site...

‐-----------

Hi everyone,

I’ve been working on a project called OTRv4+ – an OTRv4 client that adds post‑quantum cryptography to every layer of the protocol. It’s a single‑file Python app (with three small C extensions) that runs on IRC, supports I2P/Tor, and even runs on a phone via Termux.

Why post‑quantum?

If a quantum computer breaks X448 tomorrow, your past and future messages are still protected. The key exchange uses Triple X448 + ML‑KEM‑1024, authentication uses Ed448 ring signatures + ML‑DSA‑87, and the ratchet brace key rotates via fresh ML‑KEM‑1024 at every DH epoch. All symmetric crypto uses SHA‑3 / AES‑256‑GCM, which are quantum‑resistant at the symmetric level.

What makes it different?

· No liboqs – I used OpenSSL 3.5+ native FIPS 203/204 providers for ML‑KEM and ML‑DSA.

· Single‑file Python (~12k lines) – the whole protocol is in one file to make auditing easier.

· 224 tests – covering ratchet torture, state forks, wire format fuzzing, and everything in between.

· Runs on Termux – I tested it on my phone with I2P on Libera.Chat.

Comparison with Signal PQXDH

Signal’s PQXDH adds ML‑KEM to the handshake but explicitly says “Authentication in PQXDH is not quantum‑secure”. OTRv4+ uses ML‑DSA‑87 to make authentication post‑quantum as well – at the cost of losing PQ deniability (a known open problem). I think it’s a worthwhile trade‑off for IRC where deniability is less critical.

If you want to try it:

· Git clone: https://github.com/muc111/OTRv4Plus

· Requires Python 3.9+, OpenSSL 3.5+, and a C compiler.

· Works on Termux, Linux, probably other Unix‑likes.

· Supports I2P, Tor, and clearnet with auto‑detection from the hostname.

Feedback / Contributions

I’d love to get your thoughts – issues, pull requests, or just a “hey, this works on my setup”. If you’re interested in a commercial license for proprietary use, please open an issue with the label commercial-license.

Cheers!

From that other site.

‐-------------------------------

Hey guys, I've been building open-source launcher for i2pd that makes getting started with I2P as simple as possible.

What it does:

• Bundles a forked i2pd build with a preconfigured browser

• One-click start — no manual configuration needed

• Native .gn TLD support (custom domain resolution built into the i2pd fork. .gn and .i2p sites working in i2p network)

• Auto-downloads browser

Current state:

First public beta (v0.1.0 "Ronin"), Windows only for now. It works but expect rough edges — bug reports are very welcome.

GitHub: https://github.com/vialolis/GrayNet

Linux and Android ports are planned. Feedback appreciated.

In this video I show you how to use Linux in an "ungovernable" way by fetching packages and distro iso's over the I2P darknet.

It's been going on for awhile now. Most of the times sites won't load. Reseting i2p doesn't solve the issue.

Domain Transition

After several years, the I2P project has re-acquired the i2p.net domain and has begun transitioning from geti2p.net to i2p.net.

A custom redirector script ensures that geti2p.net links automatically resolve to their equivalent pages on i2p.net.

Built for Reliability and Speed

The new site runs on Hugo as a fully static build. Every page is pre-rendered HTML no databases, no runtime rendering, and no unnecessary overhead.

Pages load instantly and can be mirrored anywhere with ease.

That matters for a project like I2P. Static architecture makes redundancy simple. Mirrors can be deployed quickly, and the site remains resilient across clearnet, I2P, and Tor.

JavaScript-Free by Default

With the exception of the donate page (which requires a third-party payment widget), the site runs without JavaScript.

• Dark/light mode is handled server-side
• Navigation is pure CSS
• Documentation feedback and banner controls function without client-side scripts

If something could be implemented without JavaScript, we chose that route.

Documentation and Search Improvements

We’ve expanded and reorganized the documentation with full search across specs, guides, and overview content.

Documentation pages now include a lightweight feedback system so users can vote on whether a page was helpful.

Community-Driven Features

We’ve added a feature request system where users can submit ideas and vote on priorities. Development direction should reflect the needs of the people using the network.

There is also a lightweight polling system for gathering community input. It works across clearnet, I2P, and Tor with appropriate endpoints for each.

Expanded Guides and Localization

A new guides section launches with platform-specific installation instructions for Windows, macOS, and Linux.

We are actively looking for community-contributed guides to expand it further.

The entire site is available in 13 languages:

English, Spanish, Korean, Chinese, Russian, Czech, German, French, Turkish, Vietnamese, Hindi, Arabic, and Portuguese.

Supporting the Project

I2P is free and open for everyone to use, but operating the project involves real-world expenses infrastructure, hosting, development, and ongoing maintenance.

We are now accepting donations. Support is available through cryptocurrency as well as credit, debit, and bank transactions.

All donations are tax-deductible in the United States.

If you rely on I2P and want to help ensure its continued development and availability, financial support makes a direct impact.

Downloads Overhaul

The downloads page has been rebuilt to reduce confusion and improve verification:

• Automatic OS detection highlights the recommended installer
• Direct, mirror, I2P-native, and Tor download options
• GPG signatures and SHA256 checksums provided inline
• Clear “Coming Soon” indicators when releases lag

What’s Next

This rebuild is only the foundation. The next step is expanding practical, real-world documentation especially step-by-step guides for different environments, use cases, and troubleshooting scenarios.

We’ve launched a dedicated guides section with installation coverage for Windows, macOS, and Linux. But we know the community has knowledge that goes far beyond basic setup.

If you’ve written a guide, solved a niche issue, deployed I2P in an interesting environment, or documented a workflow others could benefit from, we’d like to include it.

Community-driven guides will make this site significantly more useful than anything we can produce alone.

If you’re interested in contributing a guide, let us know.

Feedback, bug reports, and contributions are welcome.

Support your anonymous network.

[2.59.0] - 2026-02-09

Added

• Post-quantum NTCP2 crypto(ML-KEM-512, ML-KEM-768, ML-KEM-1024) support if openssl >= 3.5.0
• UDP associate for SOCKS5 proxy
• Trusted routers list for first hop per tunnel
• "i2p.streaming.maxConnsPerMinute" and "i2p.streaming.maxResends" params
• Limited connectivity mode
• *.b32.i2p addresses for SAM datagrams
• Limiting the number of datagrams sent to maintain the consistency of session encryption through UDP tunnels
• Desktop app mode for Haiku
• Ability to suppress X-I2P-* headers for HTTP server tunnel
• Multi cloves garlic message for datagrams
• Network error and testing metrics for I2PControl
• Handle reseed address redirection
• Throttle excessive number of tunnel build message from the same peer
• Localization to Esperanto, Filipino and Finnish

Changed

• Return base64 of ident instead full address for Datagram3 in SAM
• Send ratchet session response for unidirectional traffic for I2CP
• Set default number of generated tags to 800 for a datagram destination
• Check ML-KEM encaps_key section length before decryption
• Create new stream only if bandwidth is available. Close non-responding streams
• Use Datagram3 by default in UDP tunnels
• Floodfills are not introducers
• Disable ipv6 if global ipv6 interface not found
• Network congestion detection algorithm in streaming
• Reply with relay tag only if accept tunnels
• Case-insensitive Content-Length header in I2PControl
• Increase PID string length
• Don't communicate with routers of version < 0.9.58
• Webconsole layout improvements
• Localization to Hebrew
• Reseeds list

Fixed

• Incorrect params length calculation for SAM streams
• Unexpected index in SymmetricKeyTagSet
• Incorrect preferred crypto type if i2cp.leaseSetEncType is not specified
• Decoding %00 in url
• Thread-unsafe localtime()
• NetDb crash on stop
• Peer test result OK in case of another recent peer test
• Published port if full-cone NAT
• Missing trailing newline in I2PControl JSON response
• Language selection in webconsole