Access · Generate your binary phrase

0Read & accept the security protocols

Nexxus is a surveillance-resistant identity console. The forge below runs a comprehensive scan of this browser session only, and binds your installer access to a series of cryptographic protocols. You must explicitly accept each protocol below. We tell you exactly what each one does so you can make an informed choice. Nexxus does NOT track legitimate users — every protocol below only activates against attempted intrusion (DevTools, automation, scrapers, debugger pauses). If you forge normally and never inspect the page, you never trip any of them.

[A] Invasive device fingerprint scan. The forge reads UA, screen, timezone, plugins, canvas/WebGL/audio fingerprints, accessible cookies, localStorage / sessionStorage keys, performance timing, permissions states, battery, network connection, and samples a few public Nexxus pages. The scan stays in this browser tab: it is folded into a 5000-line binary block, hashed (SHA-256), and the hash is your forge code. The raw scan never leaves this page. [B] Per-step AES-GCM encryption pipeline. Each handoff between scan-collect, JSON-serialize, hash, and PRNG-expand passes through a fresh AES-256-GCM round keyed by an in-memory session key. The key is generated by SubtleCrypto, never persisted, and zeroed immediately after the SHA-256 is computed. A debugger pause mid-pipeline trips Sentinel before the key is even generated. [C] Sentinel anti-intrusion lockout. The page actively detects developer tools (window-dimension delta, console enumeration probe, debugger-pause timing), automation flags (navigator.webdriver, PhantomJS, Node/Electron renderer), and the keyboard shortcuts F12 / Ctrl+Shift+I/J / Ctrl+U. Any one of these immediately locks this page for the rest of the tab's life and replaces the document with a denial screen. Legitimate users do none of these things — Sentinel only activates against intrusion attempts. [D] Persistent violation flag (intruder-only). If Sentinel trips, the violator's browser is flagged across multiple redundant storages — localStorage, sessionStorage, IndexedDB, cookies (multi-path), window.name, and a BroadcastChannel signal to sibling tabs. The flag persists across cookie clearing, cache wiping, history clearing, private-window switching from the same browser instance — only a full browser reinstall or a different browser profile resets it. This applies to intruders only; if you don't trip Sentinel you are never flagged. Nexxus does not write a single byte of your data to any storage unless you trip the gate. [E] Local substrate violation beacon. If Sentinel trips AND the Nexxus substrate is running on this machine (127.0.0.1:8484), the violation event is POSTed to nexxus://api/proxy/violation. This is loopback-only — the request never leaves your machine. No external server, no Anthropic, no Google, no Akamai, no anyone-but-your-own-substrate. The local substrate appends the violation to its own audit ledger so you have a record of intrusion attempts on your install. [F] GitHub-handle attestation. Your GitHub handle is mixed into the forge code derivation and verified live (HEAD-equivalent probe of your avatar URL — no GitHub OAuth, no token, no API call). The installer's launcher re-verifies before running. This binds your phrase to a real, public, social-graph-attested identity: a stranger cannot generate the same code without holding your GitHub handle.

Anti-surveillance promise. Nexxus exists because mass tracking is a problem. Every protocol above is defensive (against intrusion of your install) — not offensive (against you). No telemetry leaves this page during normal use. The only outbound network calls are: (a) the GitHub avatar HEAD probe to verify your handle, (b) the loopback beacon to your own substrate only if Sentinel detects an intrusion. Your scan, your phrase, your block — all stay in your browser tab.

1Forge identity

handle

virtual stamp · NX! bin · device-bound · no email

Virtual Stamp (VS) replaces the email field. A VS is a 5-10 million-character compressed NX! bin morphing code phrase, derived from your handle + this device's invasive scan + a fresh nonce. It's forever-valid (no expiration), security-bound (HMAC-keyed by your access code), and device-bound (will not validate on a different machine because the underlying scan won't match). The full VS is stored in your .nxa keycard download; only its 16-char fingerprint appears here on screen.

github account · acts as a SECURITY CODE for the installer (required)

Your GitHub handle is mixed into the phrase derivation and embedded into the binary octets. The wizard's launcher refuses to run unless the handle exists on github.com (verified via a HEAD request to https://github.com/<you>). This means the binary phrase is bound to a real, public, social-graph-attested identity — not just an arbitrary string. Lose the handle, lose access.

— enter handle to verify —

requested clearance band I accept that the binary phrase is the only path past the install gate · I will not share it.

2Your binary phrase

— click Forge —

Handle: —
Band: —
Forged at: —
Salt: —
Decoded ASCII: —

Use the [NX] Copy button. The Nexxus installer ONLY accepts passphrases in the NX-PASSPHRASE.v1.<payload>.<sig> envelope format minted here. A raw SHA-256 hex pasted manually or copied from elsewhere is rejected -- this prevents intercepted hashes, reused codes from other sessions, or AI-generated random hex from being used as access codes.

3Run the installer

Paste this single PowerShell line. The installer reads your binary phrase, decodes it back to your handle + band, applies them as the install profile, and only then proceeds.

— phrase required —

⚠ The phrase is the only credential the installer accepts. If you lose it you must re-forge here. Anyone with the phrase can run the installer at your declared band.

Forge your phrase.

0Read & accept the security protocols

1Forge identity

2Your binary phrase

3Run the installer