Port 6697: IRCS — Where IRC Learned to Whisper

Port 6697 carries Internet Relay Chat (IRC) traffic encrypted with TLS/SSL. Every secure IRC connection, every private conversation on Libera.Chat, every encrypted channel where developers discuss code at 3am, flows through this port.

This is where the oldest real-time chat protocol on the Internet learned to keep secrets.

What Port 6697 Does

When you connect to an IRC server on port 6697, something different happens than on the traditional port 6667. Before any IRC commands are exchanged, before you send your nickname or join a channel, your client and the server perform a TLS handshake.¹ They negotiate encryption. They verify certificates. Only then does the familiar IRC protocol begin, flowing through an encrypted tunnel that protects your messages from anyone watching the wire.

The process is straightforward: connect to port 6697, complete the TLS handshake, then proceed with normal IRC operations. Optionally, the server may mark your connection with a special user mode, letting others know you connected securely.²

The Protocol That Refused to Die

To understand port 6697, you must first understand what it protects.

In August 1988, a 21-year-old student named Jarkko Oikarinen was working at the University of Oulu in Finland, administering a Sun-3 Unix server that ran a public bulletin board system called OuluBox.³ The existing multi-user chat program, called MUT (MultiUser Talk), was limited. Oikarinen wanted something better.

He called his creation IRC, for Internet Relay Chat, and deployed it at the end of August 1988. Within months, it had spread across Finland's national network, then to Scandinavia, then to MIT, then to the world. By mid-1989, there were 40 IRC servers spanning the globe.⁴

IRC became the nervous system of early Internet communities. In January 1991, during the Gulf War, IRC users around the world logged in to share and compare news reports from their local media, creating a real-time global news aggregation system before that concept had a name.⁵

Then came August 1991, and the Soviet coup.

When Communist hardliners attempted to seize control of the Soviet Union from Mikhail Gorbachev, they imposed a media blackout. But they could not silence IRC. Through channels connected to Swedish and Finnish sources, through the Relcom network that linked 70 Soviet cities to Helsinki, IRC carried news of the coup to the world and coordinated resistance.⁶ It was, perhaps, the first instance of cyber activism, the first time the Internet routed around censorship in a moment of political crisis.

IRC did not die when the Web arrived. It did not die when ICQ and AIM rose and fell. It did not die when Slack and Discord emerged, building their "channels" and their "servers" on patterns IRC established decades before.⁷ As of late 2025, Libera.Chat alone hosts over 35,000 daily users, and the top IRC networks collectively serve around 88,000 people per day.⁸

Why Port 6697 and Not Port 994?

Here is a beautiful piece of Internet history: IRC was officially assigned port 194 by IANA for plaintext traffic and port 994 for encrypted traffic. Almost no one uses either of them.⁹

The reason is Unix.

On Unix-like systems, ports below 1024 are privileged. Only root can bind to them. Running an IRC server as root is dangerous; if the server is compromised, the attacker gains full system access. So the IRC community simply chose higher ports instead. Port 6667 became the de facto standard for plaintext IRC. And when the community decided their conversations needed encryption, they chose port 6697 to match.¹⁰

This was not a top-down decision. No standards body mandated it. The IRC community simply reached consensus, server by server, network by network, until port 6697 was so universally accepted that Richard Hartmann could document it in RFC 7194 in August 2014 and request official IANA registration.¹¹

The service name registered with IANA is "ircs-u", the description "Internet Relay Chat via TLS/SSL".¹²

How the Encryption Works

The technical mechanism is elegant in its simplicity.

A client connects to port 6697. Immediately, before any IRC protocol traffic, a standard TLS handshake occurs. The client and server agree on a cipher suite, verify certificates, and establish an encrypted channel. Once the TLS connection is established, normal IRC traffic flows through the tunnel.¹³

This protects against eavesdropping on the wire. Your messages between client and server cannot be read by anyone monitoring the network. Your password is not transmitted in plaintext. Packet sniffers see only encrypted noise.

But here is the honest truth: this is not end-to-end encryption.

The IRC server itself can read every message. A compromised server exposes everything. Messages sent to users who connected without TLS leave your encrypted tunnel and travel in plaintext to their clients. Channel conversations are only as secure as the least secure member.¹⁴

For true end-to-end encryption on IRC, users turn to additional layers: OTR (Off-the-Record) messaging for private conversations, or FiSH encryption for channels. These encrypt messages before they ever reach the server, making even a compromised server unable to read the content.¹⁵

Port 6697 is not a complete solution. It is the foundation on which other protections can be built.

Security Considerations

IRC's age shows in its security model.

The original IRC protocol, defined in RFC 1459 in 1993, had no concept of encryption.¹⁶ Messages traveled in plaintext. Passwords traveled in plaintext. Anyone on the same network segment could read everything.

TLS on port 6697 addresses the most obvious vulnerability, the eavesdropper on the wire, but leaves others intact:

• No built-in authentication: Users can impersonate others by claiming their nicknames¹⁷
• Server trust required: Messages are decrypted at each server hop
• Channel vulnerability: Unencrypted users in a channel can read everything
• Metadata exposure: Who is talking to whom, when, and on what channels remains visible to the server

Additionally, IRC networks have historically been targets for DDoS attacks and have been used as command-and-control infrastructure for botnets, their always-on nature and simple text protocol making them attractive for malicious purposes.¹⁸

Related Ports

Port 6697 exists in a family of IRC ports: