FIPS was the missing piece for TollGate to become a success. I see FIPS as the machinery, and TollGate as the oil that makes it run smooth.
I recently walked into a room full of freedom tech contributors from all over the world where you could just feel the electricity in the air. It's always stimulating to be in an environment like that, but in that moment there was just a different type of vibe. In hindsight, a lot of it probably had to do with Arjen and his work on TollGate & FIPS.
My first hint for figuring all that out came in the form of some really cool hats that a few people were wearing, which read 'FIPS' at first glance and 'F*CK IPS' on second read. It got me even more curious.
I felt that I had to write about it. When I discussed it with Arjen, he said that spreading his excitement for how nostr is revolutionizing the internet would be the best outcome:
A digital message, whatever it is, can now organically move across devices, like a perfect game of telephone. Where anyone interested in reading, storing or forwarding that message can do so. This ability to make information move through space (and time!) completely shatters the assumption on which the internet is built today, that you have to be ‘online’ and continuously able to reach a server far away to have a functional internetwork.
To me, it was evident that Arjen had already somewhat succeeded in spreading his excitement, as it was precisely the vibe that I had picked up on, that day, in that room. He wanted that energy to grow even more. And now, so do I. Such an enthusiastically contagious fellow, this Arjen.
You see, he fell down the purple rabbit-hole and then got nerd-sniped into working on TollGate. But then, he in turn nerd-sniped Johnathan Corgan into working on FIPS to help fix TollGate. Johnathan actually came out of retirement from open source because of how obsessed he had become with seeing their shared vision for FIPS come to life. Well played, Arjen. Well played.
So what exactly are FIPS and TollGate? And who is Arjen?
Before we get deeper into all of that, let's first review a few technical concepts. If you are already familiar with how the internet works, feel free to skip this next section.
Back to basics: the internet
For the sake of simplicity, let's just think of the internet as a real-world town.
If you're looking for someone's house, then you'll need their address. On the internet, that address is a string of numbers called an IP address, and the most common kind looks something like 192.0.2.53. It's made up of four numbers from 0 to 255 with dots in between, and it’s called IPv4. There's also a newer, much longer kind, called IPv6, with room for way more addresses. But since nobody wants to have to remember such a long string of digits, websites also get an alphabetical name, like OpenSats.org, and that's what we call a domain name.
You don't get to pick your IP address. It gets handed down to you, a bit like a family tree: your internet provider gets its numbers from someone above them, and right at the top, there's one single organization, IANA, that hands out the addresses in big blocks to a handful of regional registries, who split them up again: one whole range of numbers to this provider, another range to that one, and so on, down the tree, until an address ends up with you.
To find the IP address that goes with a domain name, you look it up in a giant internet phonebook called the Domain Name System (DNS).
On today's internet, both your IP address and your domain name belong to somebody else. Your internet provider hands you your address, and your domain name is only yours for as long as you've registered it. Either way, whoever is above you can switch you off. And this isn't just theory.
In February 2011, the US government seized several domain names, and one of them was mooo.com. It was a free service that let anyone get a website name under it, like yournamehere.mooo.com. By taking that one domain name, 84,000 innocent websites went down with it, all suddenly showing a banner accusing them of some of the worst offenses imaginable.
Or take Dajaz1, a hip-hop blog that used to share new songs, a lot of them sent in by the artists and labels themselves. In 2010 the US government seized its domain name, accusing it of piracy, and then kept it for over a year while their deadline to take the case to court got extended in secret, three times. They eventually handed it back.
And it's not just domain names; your IP address can be hijacked too.
In 2008, Pakistan's telecoms regulator ordered the country's internet providers to block YouTube over a video clip it called blasphemous. One of those providers, Pakistan Telecom, told PCCW Global, one of its upstream providers—meaning a company it buys its own connection from—that a block of YouTube's IP addresses could now be reached through Pakistan Telecom's network. That wasn't true, obviously. But PCCW just accepted that bogus announcement and passed it on to the rest of the internet. Which could've been prevented if the networks passing it on had been set up to check for announcements like that. And so the false route spread far beyond Pakistan, and for about two hours, YouTube was unreachable for much of the world.
That is not the free internet we are all dreaming of. And there are people doing something about it. Now, let's get back to the topic of Arjen and the gang.
Epoxy and NoDNS
Arjen worked his last day at his fiat job to go full-time on nostr on September 26 of 2024. Less than a month later, he had a few ideas about how to fix some of the very practical issues that nostr users were experiencing.
And some nostr relays only live on a separate network called Tor:
Why not build a proxy relay that, instead of answering your requests itself like any other relay would, passes them on to whichever relay you ask for? As long as the proxy can reach that relay, it should theoretically work. Your phone only has to reach the proxy the normal way, and the proxy, which can reach Tor, does the rest for you. And it helps with the IP address problem too:
Using these proxies helps hide the requester's IP from the destination server…
On top of that, whoever runs the proxy gets paid for it, by the minute, in cashu ecash. And that was basically nostr epoxy.
And so Arjen built it, together with hzrd149. But to use it, you'd have to tell it which relay you want to go to, and normally you'd do that with a web address, which on clearnet is basically a rented domain name.
That's a problem for two reasons. The first one we just went through: a rented domain name can be changed or taken away by whoever is above you.
The second one is that the proxy has to open the connection to that relay for you, so it can read everything you send.
So right from the start, Arjen and his co-conspirators figured that if you could address the relay by its public key (or pubkey) instead of a web address, then your app could encrypt its requests straight to that key, and so the proxy just passes along what it can't read.
It allows us to address the relay through whatever means they themselves have shared, which can be Tor, I2P or the open internet. Their address can change but you can still follow the changes and use their new endpoints.
He turned that idea into a proposal for a new nostr implementation called "Transport method announcement". The proposal never got merged, and once Arjen got pulled into TollGate it mostly stalled, apart from a crafty little browser extension that he built to warn you when a website's domain has been rugpulled. But only if you had visited it before, back when it shared its own pubkey.
Then in September 2025, someone pointed Arjen to a draft by Amperstrand (a fellow TollGate contributor) for putting DNS and certificates on nostr, and it immediately clicked what had been wrong with his own proposal:
He had been mixing a bit too much all at once: how you talk to a service (like http or wss), which network it sits on, and simply which address its name points to. So he dropped the protocol and network bits and rewrote his spec to hold just DNS records.
Put DNS on nostr instead, signed with your own key, and that became NoDNS.
Now, your npub, the public half of your nostr keypair, is your domain name: just put .nostr after it. It's not pretty to read, but because you generated it yourself, nobody above you can change it or take it away from you. Ta-dah!
But that was only half of the battle.
Your IP address is still handed down to you, and so it can still be taken away. And when Arjen and the TollGate team pictured TollGate networks growing, they just kept running into that issue.
To see just why, let's dig deeper into what TollGate really is.
TollGate and FIPS
TollGate is basically a protocol to add a toll booth to a router, just like the ones on the highway. When you connect to it, it tells you its price, and you pay with ecash. The router accepts your payment, and then it opens the gate for the minutes or megabytes you paid for.
The router itself has its own nostr key, and other routers can buy internet access from it, and sell it on to the next person. That's how the network grows, from one router to the next one nearby.
But every TollGate currently needs an IP address, which gets handed down from the top, like the roots of a tree. TollGate needs the network to work more like a nervous system, where anyone can trade with anyone around them.
One question just kept coming up over and over again:
Until Arjen turned it into a much crazier one:
What if your nostr key wasn't just your name, but your address too? That was the beginning of FIPS.
Arjen first began building a little proof of concept that routed using nostr keys instead of IP addresses. It didn't work right away.
Ping, the tiny tool that checks if another computer is there, would throw an error when he gave it a key, because a key isn't a valid IP address. So he had to write his own ping. But that only fixed ping, and every other app would break the same way:
Nobody was going to rewrite all of the world's software just for that.
In November 2025, he sketched a little theoretical workaround, a way to swap out IP addresses without having to change the apps themselves.
Whenever your browser asks a website for something, that request gets cut up into little pieces, and only then do those pieces get wrapped up in IP packets. So if you could just catch those pieces right before that step, you could send them off in your own kind of packets instead. But you can't just do that with all of your traffic, or your regular internet would break. You only want to catch the pieces that are meant for a nostr key. Which brings him to the big question:
His idea was to put a tiny internet phonebook (DNS) of your own inside your device. Then, when an app asks for a nostr key as if it were a domain name, the phonebook hands it a made-up IPv6 address, and everything the app then sends to that IP address gets caught and sent off to the nostr key behind it instead.
Sneaky, right?
But the FIPS that finally shipped in 2026, built mostly by Johnathan Corgan, works a little differently. It still uses that DNS trick, but the IPv6 address it hands back isn't random anymore, it's derived from the key itself. And instead of catching the little pieces before they get wrapped up in IP packets, it just lets them become normal IPv6 packets first, and then catches those whole packets and sends them off over FIPS.
So instead of typing an address like 192.0.2.53, you just use a device's own nostr key with .fips added at the end. Like this: npub1spxdug4m3y24hpx5crm0el4zhkk0wafs8kp6m0xu0wecygqej2xqq8gyhx.fips, the address of the first nostr relay on FIPS from March 13th, 2026.
If you had a FIPS node, you could reach it at that address, and everyone else could get to it at a normal clearnet address:
Then in April, Arjen invited everyone to join a deathmatch in Quake III Arena, a first-person shooter game from 1999. The deathmatch had 8 slots and no clearnet address at all, so the only way in was over FIPS.
And a few days after that, he hosted a website over Bluetooth at Sovereign Engineering, using FIPS.
By the summer of 2026, Arjen had started redesigning TollGate, and his vision was for it to run fully on top of FIPS, which will make TollGate itself a whole lot simpler, because it won't have to worry about who to connect to anymore.
Then during a hike at SEC-08, someone put one more brand new idea in his head: make each TollGate its own cashu mint, with tokens that stand for bytes instead of sats. That way the router would work like the machines at an arcade. You'd feed it a token, and it'd give you bytes. Until then, a big headache was that a customer might not be able to reach the mint, somewhere out on the internet. But once the router itself is the mint:
...it is always reachable, and it will be bloody fast as well.
In that design, the TollGate protocol only cares about one thing:
...it received a byte proof, so therefore it will deliver a byte. Period.
Where you got those byte tokens is none of its business anymore:
I can give away bytes, I can sell bytes, I can exchange bytes.
And in his new design, TollGate isn't just about selling internet access anymore: it can meter and charge for anything that streams, not just bytes.
How would that even work? Well, it's pretty simple: the core of TollGate doesn't care what it's selling. It becomes:
The actual switching on and off is done by a separate little piece he calls an enforcer, and swapping that piece, and the unit the tokens count in, is what it takes to sell something new.
His design docs even walk through two examples. For an electric car charger, the enforcer is the charger's on/off switch and its energy meter, counting in watt-hours.
For a beer tap, it's a valve and a flow meter, counting in milliliters.
Each one gets paid in tokens that stand for that exact thing, and the moment those tokens run out, the outlet switches off, or the valve closes.
The new design now has a Rust implementation, with network access as its first application.
So FIPS gives every device that runs it an address that comes from its own key, so nobody can hand it out or take it back. And it can run on top of the regular internet, or straight over a local network or Bluetooth, with no internet provider and no DNS at all. Once TollGate runs on top of it, it'll let those devices pay their peers for the data that flows between them. But FIPS still had to prove itself on the one device pretty much everyone actually carries around: the phone. Which is why Arjen built Myco.
Myco
Myco is an Android app. Arjen built it to bring FIPS to phones, and to show a whole new way of using nostr.
Usually, your nostr app just talks to relays somewhere out on the internet. But since every nostr note is signed with its author's key, you don't really need the internet, or any server, to check that it really came from them and wasn't changed along the way.
So what that implies is that it doesn't really matter if a note comes from one of those relays out on the internet, or from the phone of the person physically sitting right next to you. And that's exactly what Myco does.
When you post a note over the FIPS mesh, it first gets saved on your own phone. Then, when your phone is close to the phone of someone you've bumped phones with to pair (over NFC, the same tap your phone uses to pay at a shop), it hands them a copy straight over the mesh, for example by Bluetooth, no internet needed, and their phone saves it too. So now your note is on 2 phones, and both of them can pass it on again.
Every copy of Myco comes with its own little nostr relay and its own Blossom server, which is basically where nostr apps keep your pictures and other files. So basically, your phone is its own relay, and every note and file you look at gets saved right there on it, at least for a while.
Whatever you post over the FIPS mesh gets passed along right away from phone to phone, up to 3 phones away, but only to paired phones that are in range at that moment, and each of them saves a copy. And when someone is looking for something, their phone asks up to 2 phones away, so it can find one of those saved copies, even later. So in the end, your note can reach someone 5 phones away, as long as they're interested in it.
And because phones only find each other when they're close by, your note doesn't fly across the world, it gets carried slowly, from one paired phone to the next as people happen to run into each other. It's not a bug, it's a feature. Myco also works in the background, including when the phone is locked.
Arjen has also added an option to mesh over the internet, but it's off by default and not yet tested between phones on different networks.
Inside Myco you run little apps called napplets, and they're based on nostr too: their makers publish them to nostr, and you add one from Myco's own app store, or by pasting its nostr address. After that, you can just hand it to the person next to you, who pulls it straight from your phone and can then pass it on again.
Anyone can make a napplet, and other people already have. Arjen has thanked hzrd149 and snicktoshi for napplets he showed in Myco, and in October, he said the number of napplet games seemed to be exploding.
He's also made apps for Myco himself, like a Bitchat-style chat, an app for disaster response, and Doodle Duo, a little two-player game he made to test napplets that use the mesh.
And back in July 2026, when someone asked when they could buy a little device to take to festivals with TollGate, a cashu mint and Myco on it, he was very upfront that Myco was a proof of concept (POC):
I'm very much treating Myco as a POC though. But yes this kind of system is the goal.
So for now, you still have to download Myco itself from GitHub or Zapstore before any of this works. And Arjen has already built a way to hand Myco to a phone that doesn't have it, but it isn't in a release yet.
About Arjen
Obviously, Arjen isn't scared of hard work. And that shows up not only in how knowledgeable and technically capable he is, but also in how he chooses to live his life.
For years, he traveled to some of the most remote places in Europe, all while working from his laptop and living in his van, whose inside he had completely remodeled with his own two hands.
I loved the ability to wake up in the middle of nature for weeks on end, far away from civilization, up into the far north of Europe. As far as the arctic circle. I've slept in places that felt like no human had ever been there before, with howling winds across a glacier lake, and only wavy smooth rocks from ages of erosion. I always kept my backpack packed, ready to go up a mountain whenever I found a cool trail.
The first time that I spoke with Arjen, I was telling him about how this girl that we both know had walked from Mexico to Canada, and how crazy that was to me.
To my incredible surprise, Arjen just replied without missing a beat, in his usual calm tone:
Me too. I hiked that same trail.
Why would anyone put themselves through that? I was baffled, but Arjen didn’t seem fazed. He tried to explain it to me, but I just couldn't relate.
Because I felt this inner urge to do it. There is no other justification. I was just captivated by the idea of doing nothing other than walking, eating and camping in nature for 6 months straight.
I had so many questions: how did you find food? Where did you do your business? What if something went wrong? I was fascinated, but I still didn’t get it, so I asked him if he could recommend a documentary that I could watch about it and he gave me a few recommendations. Usually documentaries help me broaden my perspective, but this time strangely it did not. And then recently, as we were doing the interview for this piece, it finally clicked:
I think in the end that this experience is what turned me into an adult. I’ve become a very different person in the few years since I set foot there. And it’s a big reason I’ve gotten to the point where I’m at now. I can recommend everyone to fuck off in the woods for a season.
Now I get it. He went in as a boy and came out as a man. It kinda makes me want to take his advice about f-ing off in the woods more seriously now.
About a month before going back for the second stretch of the hike, he read NIP-01, the core nostr protocol spec. He calls it his “oh shit” moment, and a few weeks later he posted:
Nostr to me feels like we just detonated a NUKE of collective knowledge, let's gooo! 🚀
And that was just the tip of the iceberg.
In October 2025, he'd put what the trail taught him into words:
Back on the trail, forest fires cut his hike short in August 2024.
But where to?
Only to one of the most epic nostr conferences of all time: Nostriga 2024!
I arrived the day before at midnight, jetlagged, in my stinky hiking clothes with nothing else on me. In the days there, I learned so much about Nostr and I realized that it addresses Every. Single. Issue that centralized platforms create. I literally could not sleep because I'd wake up every 15 minutes thinking of another cool thing we can do now because of Nostr. Not just social media, f*ck social media, every online service could be replaced.
There, at one of the standing tables, c03rad0r was showing small routers with his first TollGate prototype on them, and Arjen actually bought the very last one. Things went very fast from there. Just a year later, Arjen was back again in Riga, but this time he was promoting TollGate:
But back in 2024, attending Nostriga had such an immense impact on him that he literally quit his job right after the conference with nothing else lined up:
His career mining fiat, which started before he had even finished his schooling, had helped him learn so much about how corporations run their IT, and now it was time to go beyond it:
I started out as a Cloud Platform engineer, mainly working on keeping up high-traffic servers, setting up CI systems and automating developer workflows. In short I worked a lot with AWS and Azure and set up stuff like Kubernetes clusters and (deployment pipelines for) microservices. I loved the technology, but the goals / practices of some of the companies I worked for did absolutely not align with my values, so I'm glad that I can work on more useful technology now.
It would be easy to judge him as crazy for quitting his job that way. But in retrospect, it was a risk that paid off.
His very first OpenSats grant was for nostr epoxy. But by the time it came through, he was already busy with TollGate, and he was totally honest about it. He even publishes his progress reports on nostr for anyone to read, which I think is just beautiful.
OpenSats has allowed me to take the time to explore ideas that might appear meaningless or way too out there at first glance. I think that without this kind of support and no-strings-attached nature, that I wouldn't have been able to go so deep into topics like the fundamentals of the internet and take the time to question them. I'm very grateful for this trust.
But OpenSats let him explore anyway. And that's exactly the kind of room an idea as wild as FIPS needed to grow in. But even with all that freedom, he didn't work it all out on his own. As he puts it himself:
I had the puzzle pieces, I knew what we needed and how the pieces would interact, but I had no clue how to build an actual routing algorithm.
That's where Johnathan Corgan came in. They met at a nostr conference in Costa Rica and basically spent the whole two days talking in one room. It turned out that Johnathan had way more experience with networking than Arjen had even realized.
His current OpenSats grant, which started in June 2026, is for TollGate and resilient networks.
Even if the tech doesn't pan out the way I hope, I made many friends that care about other things than just the superficial. Likes, attention, superficial appearances, things that lack any meaning. I like to focus on people and creating healthy relationships to each other and our environment.
Conclusion
Here's one of the things that I find the most exciting about this whole story. Once FIPS was out there, other people started to see exactly what Arjen and Johnathan had seen: if your key is your address, you don't need anyone's permission anymore to connect two devices. And they just started building on it.
Martti Malmi built Nostr VPN, a mesh VPN that primarily uses his own fork of FIPS.
Logen's Nostr Vault sends every new note and photo from your Android phone to your Mac over the mesh.
fr34aky built a whole bunch of things on FIPS, like fips2go, a FIPS app for Android; a paid internet exit for the mesh; and a desktop version of Myco.
nostr.watch added support for relays that live on FIPS.
There are now interactive lessons for learning how FIPS works, and Totem put napplets on modular hardware devices that connect over FIPS.
TollGate has company too. net4sats sells a TollGate router package, the OG Edition. And there is MeshLink, another project that lets you sell your spare internet to people nearby. c03rad0r had his AI agent get MeshLink and TollGate to talk to each other: on his test rig, a MeshLink node paid a TollGate router one test sat for internet access, and as the data flowed, it topped up twice more by itself.
So what's next for Arjen? First of all, TollGate. With the new design now implemented, his plans include testing it thoroughly. And he wants actual FIPS exit nodes up and running, preferably run by other people than himself, to receive good feedback on the design. Exit nodes are basically gateways from the mesh out to the wider internet, and the idea is that whoever runs one can use TollGate to charge for the bandwidth.
Then FIPS itself. His focus stays on getting it to run well on Android and OpenWrt routers, and that second one matters more than it sounds. OpenWrt is the router software TollGate runs on, and it's what lets you put your own software on an ordinary home router. And Arjen already got routers running FIPS meshing with each other:
He also added an open “!FIPS” wireless network that phones can jump on as they move around, to reach the greater FIPS mesh.
Meanwhile, Johnathan is writing the v2 spec, which, according to Arjen, will raise the most nodes one mesh can hold to about 4 million.
And because he sees TollGate and FIPS as the most important things he could be working on, he's no longer actively working on three other projects, NoDNS among them. But if you'd like to pick one of them up:
I will happily consult with anyone that's interested in picking up those projects.
So what will YOU build with all of this now? When I asked Arjen what's missing in the bitcoin space, this was his answer:
People are thinking at the wrong scale. People should be thinking at a scale we've never seen before. A scale so small that it makes sense to use what you create if there's just 5-10 people around. The focus should be to create a system of a billion nostr apps with a thousand users rather than a thousand apps with a hundred million users.
A billion apps won't build themselves. That's where YOU come in!
Start with these interactive FIPS lessons and pick a small problem around you. Want to build a napplet for it?
OpenSats funds the people who build and maintain open-source infrastructure. To support Arjen and our other grantees, please consider making a one-time or recurring donation to the Nostr Fund.
For comments, corrections, or suggestions about our Spotlight series, please reach out to spotlight@opensats.org.