diff --git a/connect.go b/connect.go
index 486f41c..048785b 100644
--- a/connect.go
+++ b/connect.go
@@ -42,7 +42,8 @@ func runClient(connectionType string, codePhrase string) {
 			message := receiveMessage(connection)
 			logger.Debugf("relay says: %s", message)
 			logger.Debugf("telling relay: %s", connectionType+"."+codePhrase)
-			sendMessage(connectionType+"."+codePhrase, connection)
+
+			sendMessage(connectionType+"."+Hash(codePhrase), connection)
 			if connectionType == "s" { // this is a sender
 				if id == 0 {
 					fmt.Println("waiting for other to connect")
diff --git a/crypto.go b/crypto.go
new file mode 100644
index 0000000..7f27105
--- /dev/null
+++ b/crypto.go
@@ -0,0 +1,91 @@
+package main
+
+import (
+	"crypto/aes"
+	"crypto/cipher"
+	"crypto/rand"
+	"encoding/binary"
+	"io"
+	mathrand "math/rand"
+	"strings"
+	"time"
+
+	"github.com/pkg/errors"
+	"github.com/schollz/mnemonicode"
+	"golang.org/x/crypto/bcrypt"
+)
+
+func init() {
+	mathrand.Seed(time.Now().UTC().UnixNano())
+}
+
+func GetRandomName() string {
+	result := []string{}
+	bs := make([]byte, 4)
+	binary.LittleEndian.PutUint32(bs, mathrand.Uint32())
+	result = mnemonicode.EncodeWordList(result, bs)
+	return strings.Join(result, "-")
+}
+
+func Encrypt(plaintext []byte, key string) (ciphertext []byte, err error) {
+	newKey := ""
+	for i := 0; i < 32; i++ {
+		if i < len(key) {
+			newKey += string(key[i])
+		} else {
+			newKey += ":"
+		}
+	}
+	block, err := aes.NewCipher([]byte(newKey))
+	if err != nil {
+		return nil, err
+	}
+
+	gcm, err := cipher.NewGCM(block)
+	if err != nil {
+		return nil, err
+	}
+
+	nonce := make([]byte, gcm.NonceSize())
+	_, err = io.ReadFull(rand.Reader, nonce)
+	if err != nil {
+		return nil, err
+	}
+
+	return gcm.Seal(nonce, nonce, plaintext, nil), nil
+}
+
+func Decrypt(ciphertext []byte, key string) (plaintext []byte, err error) {
+	newKey := ""
+	for i := 0; i < 32; i++ {
+		if i < len(key) {
+			newKey += string(key[i])
+		} else {
+			newKey += ":"
+		}
+	}
+	block, err := aes.NewCipher([]byte(newKey))
+	if err != nil {
+		return nil, err
+	}
+
+	gcm, err := cipher.NewGCM(block)
+	if err != nil {
+		return nil, err
+	}
+
+	if len(ciphertext) < gcm.NonceSize() {
+		return nil, errors.New("malformed ciphertext")
+	}
+
+	return gcm.Open(nil,
+		ciphertext[:gcm.NonceSize()],
+		ciphertext[gcm.NonceSize():],
+		nil,
+	)
+}
+
+func Hash(data string) string {
+	hashed, _ := bcrypt.GenerateFromPassword([]byte(data), 14)
+	return string(hashed)
+}
diff --git a/crypto_test.go b/crypto_test.go
new file mode 100644
index 0000000..5e2dfca
--- /dev/null
+++ b/crypto_test.go
@@ -0,0 +1,27 @@
+package main
+
+import (
+	"fmt"
+	"testing"
+)
+
+func TestEncrypt(t *testing.T) {
+	key := GetRandomName()
+	fmt.Println(key)
+	encrypted, err := Encrypt([]byte("hello, world"), key)
+	if err != nil {
+		t.Error(err)
+	}
+	fmt.Println(len(encrypted))
+	decrypted, err := Decrypt(encrypted, key)
+	if err != nil {
+		t.Error(err)
+	}
+	if string(decrypted) != "hello, world" {
+		t.Error("problem decrypting")
+	}
+	_, err = Decrypt(encrypted, "wrong passphrase")
+	if err == nil {
+		t.Error("should not work!")
+	}
+}
diff --git a/random_names.go b/random_names.go
deleted file mode 100644
index 5756121..0000000
--- a/random_names.go
+++ /dev/null
@@ -1,22 +0,0 @@
-package main
-
-import (
-	"encoding/binary"
-	"math/rand"
-	"strings"
-	"time"
-
-	"github.com/schollz/mnemonicode"
-)
-
-func init() {
-	rand.Seed(time.Now().UTC().UnixNano())
-}
-
-func GetRandomName() string {
-	result := []string{}
-	bs := make([]byte, 4)
-	binary.LittleEndian.PutUint32(bs, rand.Uint32())
-	result = mnemonicode.EncodeWordList(result, bs)
-	return strings.Join(result, "-")
-}