diff --git a/docs/API.rst b/docs/API.rst
index c762a405..49feec70 100644
--- a/docs/API.rst
+++ b/docs/API.rst
@@ -29,6 +29,7 @@ Client
             certExpired: false,
             floodProtection: false,
             floodProtectionDelay: 1000,
+            sasl: false,
             stripColors: false,
             channelPrefixes: "&#",
             messageSplit: 512
@@ -47,14 +48,17 @@ Client
     `floodProtectionDelay` sets the amount of time that the client will wait
     between sending subsequent messages when `floodProtection` is enabled.
 
-    `messageSplit` will split up large messages sent with the `say` method
-    into multiple messages of length fewer than `messageSplit` characters.
+    Set `sasl` to true to enable SASL support. You'll also want to set `nick`, 
+    `userName`, and `password` for authentication.
 
     `stripColors` removes mirc colors (0x03 followed by one or two ascii
     numbers for foreground,background) and ircII "effect" codes (0x02
     bold, 0x1f underline, 0x16 reverse, 0x0f reset) from the entire
     message before parsing it and passing it along.
 
+    `messageSplit` will split up large messages sent with the `say` method
+    into multiple messages of length fewer than `messageSplit` characters.
+
     Setting `autoConnect` to false prevents the Client from connecting on
     instantiation.  You will need to call `connect()` on the client instance::
 
diff --git a/lib/irc.js b/lib/irc.js
index 79e96007..d8be57d8 100644
--- a/lib/irc.js
+++ b/lib/irc.js
@@ -48,6 +48,7 @@ function Client(server, nick, opt) {
         certExpired: false,
         floodProtection: false,
         floodProtectionDelay: 1000,
+        sasl: false,
         stripColors: false,
         channelPrefixes: "&#",
         messageSplit: 512
@@ -511,6 +512,26 @@ function Client(server, nick, opt) {
                 // who, reason, channels
                 self.emit('quit', message.nick, message.args[0], channels, message);
                 break;
+
+            // for sasl
+            case "CAP":
+                if ( message.args[0] === '*' &&
+                     message.args[1] === 'ACK' &&
+                     message.args[2] === 'sasl ' ) // there's a space after sasl
+                    self.send("AUTHENTICATE", "PLAIN");
+                break;
+            case "AUTHENTICATE":
+                if ( message.args[0] === '+' ) self.send("AUTHENTICATE",
+                    new Buffer(
+                        self.opt.nick + '\0' +
+                        self.opt.userName + '\0' +
+                        self.opt.password
+                    ).toString('base64'));
+                break;
+            case "903":
+                self.send("CAP", "END");
+                break;
+
             case "err_umodeunknownflag":
                 if ( self.opt.showErrors )
                     util.log("\033[01;31mERROR: " + util.inspect(message) + "\033[0m");
@@ -615,7 +636,10 @@ Client.prototype.connect = function ( retryCount, callback ) { // {{{
     self.conn.setTimeout(0);
     self.conn.setEncoding('utf8');
     self.conn.addListener("connect", function () {
-        if ( self.opt.password !==  null ) {
+        if ( self.opt.sasl ) {
+            // see http://ircv3.atheme.org/extensions/sasl-3.1
+            self.send("CAP REQ", ":sasl");
+        } else if ( self.opt.password !==  null ) {
             self.send( "PASS", self.opt.password );
         }
         self.send("NICK", self.opt.nick);