...NOTE: By using encryption twice the implementation is (in theory) vulnerable to Meet-In-The-Middle attack reducing key size to 256bit but the attack still requires 2^256 bytes of memory making it impossible in practice.
...Simply put, SHA is a checksum that change when a single bit change. When you send a message with a password field, the resulting password checksum is cut at 128 bit which means 16 characters bytes KEY is entered into AES 128 bit encryption and decryption scheme. The resulting ciphertext is sent to the server while the server relay it to the connected peers. Those connected peers need to have the same password in order to read the message.
The server is a multiplex and stand alone detached (no controlling terminal) process on the background that does nothing but to relay messages.