SECURE · INTELLIGENT · REVOLUTIONARY
The First App-System of Its Kind.
Beyond Browser. Beyond Security. Beyond Intelligence.
v0.1.0 Alpha · Free Forever · No TelemetryTwelve deeply integrated applications — each one engineered for privacy, power, and performance. Click any card to explore, or drag to rearrange.
Every protection layer is active by default. Nothing optional, nothing hidden, nothing phoning home.
All geolocation API calls are intercepted and randomized or blocked. Sites cannot triangulate your physical position through browser APIs.
Cookies are double-keyed per top-level origin and sub-origin, completely eliminating third-party tracking across the web.
Canvas, WebGL, audio context, font enumeration, and hardware concurrency fingerprinting vectors are all randomized per session.
Continuous entropy monitoring detects hardware-level surveillance tools and side-channel timing attacks in real time.
Cross-device synchronization via NXLBIN uses keys derived from your hardware identity — servers never possess plaintext.
Nexxus Mesh routing uses multi-hop ephemeral relays with lower latency and stronger anonymity than standard Tor circuits.
All stored credentials use AES-256-GCM with hardware-bound key derivation — unusable on any device but yours.
Process isolation, memory sandboxing, and site isolation prevent cross-tab data leakage and renderer exploits.
The on-device intelligence engine layer that makes Nexxus intelligent — without compromising your privacy. SilicoNet runs quantized language models locally on your CPU or GPU, providing real-time threat detection, content summarization, and contextual browsing assistance.
No API keys. No remote servers. No data ever leaves your machine. Your intelligence stays yours.
Every site is its own Virtual Server (VS) — a sandboxed VM hosting nexxus:// pages.
No DNS · no CA cartel · no http vs https split · one address scheme forever
Each VS is a Kissmar-attested guest. A buggy site can never reach the host or another VS.
nexxus://<handle> — every site, forever. No DNS, no IP, no port juggling.
Kademlia-style mesh keyed by BLAKE3 of the handle. No central registrar. Any peer is a bootstrap.
Federated index of every public VS. Queryable from nexxus://search. No Google.
🕸️ Spyder Net specification → 🛡️ 200-level clearance ladder →
Forge an 8-byte binary phrase first. The installer refuses to download or run without it.
Phrase encodes your handle + clearance band + a fresh salt — verified locally before bootstrap proceeds
irm https://nexxus.northpointaegis.com/boot.ps1 | iex
The bootstrap script prompts you for your binary phrase. Without it, no download, no install, no wizard.
Welcome → 31-question questionnaire (threat model · recovery · behavioural · paranoia · VPN config · subscription · clearance) → review → live install → done. Computes your 1–200 clearance level.
Your 16 answers map to live proxy state at startup: paranoia mode, DoH-only DNS, cover-traffic, panic-petal sigil. Read back any time at /api/proxy/profile.
Listed in Settings → Apps → Nexxus → Uninstall. Removes binaries, shortcuts, autostart, registry — leaves your soul-profile if you ask.
All download URLs return HTTP 200. Both installers parse cleanly. 12/12 server self-test probes pass after install. Try it: curl -x nexxus://tendril https://api.ipify.org
A real local proxy on 127.0.0.1:8585. Hybrid post-quantum keys (Ed25519 ⊕ ML-DSA-65, X25519 ⊕ ML-KEM-768). 271 trackers blocked at the network layer. Server self-test runs 12 raw-socket probes — every claim measurably verified.
17 / 17 capabilities surpass NSA HAIPE · DoD CSfC · GCHQ Cliff · BSI SINA · Russian VipNet · Chinese SM-VPN
Every audit-chain head signed with both classical Ed25519 and post-quantum Dilithium-3. Compromise either primitive; the chain still stands. Government VPNs (HAIPE, CSfC, Cliff, SINA, VipNet, SM-VPN) ship classical-only or are still on CNSA 2.0 roadmap to 2030+.
HTTP CONNECT + plain-HTTP forward. 21 identifying headers stripped, 13 secret headers stripped in High-Paranoia mode. 271 tracker / spyware / malware-C2 domains blocked at network layer. Per-host sticky persona; 5 personas rotate every 7 min.
curl -x nexxus://tendril \ https://api.ipify.org
Every connection recorded; every entry's hash includes the previous. /api/proxy/verify walks the chain end-to-end. Tampering is detectable by anyone holding any historical hash. Government baseline: WORM tape on closed networks.
Server self-test endpoint runs 12 raw-socket probes against the proxy itself: garbage-line rejection, empty-host rejection, tracker block, sub-tracker block, no Proxy-Agent leak, header bloat → 431, Slowloris → 408, audit chain integrity, tracker-list size, strip-set size, CRLF injection rejected. Every claim independently re-verifiable.
Sources: NSA CNSA 2.0 (Sept 2022) · DoD CSfC NIAP Capability Packages · UK NCSC/CESG Approved Products List · BSI TR-03116 · GOST 28147-89 + Magma + Kuznyechik + Streebog · GM/T 0001-2012 (SM2/SM3/SM4) · Japan CRYPTREC 2023 · S.Korea KS X 1213-2 (ARIA).
One download. Every platform. Free forever. · 1,132 tests passing
Personalised security questionnaire · 25 languages · Accessibility panel
Live device security scan · Auto-configured threat model · 13 integrated apps
Go deeper. Master the platform. Unlock advanced capabilities.
Complete guide to hardening your digital life with the Nexxus platform and NXL security scripting.
The full Nexxus experience — advanced security, Specter 5TB storage, priority support, and VPN routing.
The authoritative reference for building NXL extensions, security automations, and browser plugins.