For developers

Put your app on the mesh.

Hop is a pure-Rust core you embed in your iOS and Android app. It carries end-to-end encrypted, store-and-forward messages device to device, across BLE, Wi-Fi, and the public internet when it's there, so your app keeps working when the network doesn't. One library, two addressing modes: reach the internet, or reach a device.

Quickstart Read the protocol

Rust core · deterministic, fully testable without a radioUniFFI · native iOS & Android bindingsPluggable bearer · BLE, Wi-Fi/LAN, internet relay

One core, two modes

Reach the internet, or reach a device.

Both are the same machinery with a different destination. You don't pick a transport or plan a route, you address a bundle and Hop carries it.

Internet egress

A device with no connection emits a sealed HTTP request. Any gateway node fulfills it and relays the sealed response back to your device's key, eventual, but guaranteed.

Device to device

Send a sealed message to another device's public key. The bundle hops until the destination receives it, confidential the whole way, even across relays you don't trust.

The protocol stack

Three named layers, lowest to highest.

Everything rides on one sealed datagram. The higher layers rebuild the guarantees you expect, reliability, ordering, HTTP, pub/sub, at the endpoints, where they need no live circuit in the middle.

hdp://

Hop Datagram Protocol, the substrate →

Hop's UDP: a connectionless, end-to-end encrypted, addressed datagram that's store-and-forwarded across the mesh. Held when there's no onward path, never dropped. All Hop traffic rides on hdp.

hops://

HTTP over the mesh, origin-run, no man-in-the-middle →

The same request/response semantics as HTTP, carried as sealed datagrams. An operator runs a hop-endpoint for their own domain, it is the origin, never an open proxy, so there's no third party in the middle.

hps://

Hop Pub/Sub, services & channels →

Topic-based broadcast and discovery over the same fabric, region-aware so a topic never ships to a region with no subscribers.

HNS

Hop Name System, self-certifying →

Resolve hops://example.com to an address with one HTTPS fetch of the domain's /.well-known/hop. TLS proves the domain, the signed reach record proves the address, so a name can't be forged into the wrong key. No central resolver.

Messages of any size

A sentence or a 5 MB image, the same call.

Hop isn't limited to tiny messages. A payload that fits travels as one sealed bundle; anything larger is transparently split into ordered, individually-sealedchunks and reassembled into the original on the far side, id, order, acks, and dedup all preserved. The size cap is a sliding window, not a ceiling, so even video streams through.

One bundle

A small message is a single sealed datagram, stored, forwarded, delivered as one unit.

Carrier chunks

A large payload (a file, an image, an HTTP response) auto-splits into ordered sealed chunks and reassembles into the original bundle.

Live streams

Open-ended data (SSE, media) rides progressive stream chunks, in order, deduped, and resumable after a gap.

Below all of this, each bundle is fragmented into link frames sized to whatever bearer it crosses (BLE MTU, L2CAP CoC) and reassembled at the next hop, so the wire never limits how big a message can be.

What's in the box

Batteries, minus the identity storage.

The library never owns your keys, you hand it a 32-byte secret and it does the rest. Everything below the radio is pure Rust and unit-testable.

Encrypted by default

X25519 + ChaCha20-Poly1305 sealed payloads; Ed25519-signed headers; Noise XX links between peers.

Key = address

One Ed25519 keypair is identity, address, and seal. Import a seed, export a seed, storage is yours.

Spray-and-wait routing

A small copy budget fans across independent paths in parallel; first arrival wins. No flooding.

Durable store

Persistent forward queue with dedup and custody transfer, bounded by bundle lifetime.

BLE bearer

GATT for control, L2CAP CoC for bulk, with fragmentation and reassembly handled for you.

Gossiped discovery

Find peers, services, and names the moment you meet anyone who has seen them.

The mental model

Address a bundle. Let it find a way.

You construct a node from a secret, address a sealed payload to a device key or to the internet, and Hop handles the rest, fragmentation, relaying, retransmit, dedup, and delivery acknowledgement.

Illustrative shape, the real API spans hop-core and the native FFI bindings.

// open a node with your 32-byte secret
let node = HopNode::open(secret)?;

// reach a device by its address (its public key)
node.send(
    Destination::Device(peer_address),
    Payload::message("on my way"),
)?;

// call a hops:// service another app hosts (an endpoint SDK), addressed by its key
node.send_service_request(
    endpoint,
    "acme/orders", "create",
    br#"{"item":"widget"}"#,
)?;

// drain inbox: sealed bundles addressed to you
for msg in node.receive()? {
    handle(msg.open()?);
}