v0.1 · vertical slice · 171 tests green

Browse a web that
can't watch you.

KICKL is a desktop browser for its own namespace. Names resolve through an encrypted phonebook, pages arrive as sealed documents, and not one byte of page script is allowed on the surface — because the format has no instruction for it.

Download for Windows 49.7 MB · self-contained .exe Grab the source 0.6 MB · C# · .NET 10
  • No install
  • No telemetry
  • No script engine
  • SHA-256 listed
jttp://pinwheelexplained.com/
The KICKL browser home screen: an arcade strip on the left, PFS tag search on the right, and the publication feed in a side panel.
SEALED DOCUMENT
PFS LOOKUP · P-256
AES-256-GCM

What it does

Six ideas, one sealed spine.

Every surface in the app is built on the same primitives: a name, a sealed package, and a key that never leaves memory. That is why the parts fit together.

Sealed documents

Pages are KML packages, not HTML bundles. Structure is public; notes, files and keys are blobs under AES-256-GCM.

no scripts · no trackers

Names, not addresses

A lookup is a fresh P-256 ECDH session; the query and the reply travel inside AES-256-GCM, then the session keys are wiped.

PFS phonebook

KicklMail

Letters travel to a short id, sealed end to end. The vault unlocks with a separate mail key and re-locks on a timer.

sealed letters

FreeChat

A group secret wrapped in ML-KEM-1024, per-epoch keys, messages sent as PNGs. The relay carries ciphertext it cannot read.

post-quantum room

Native ads, no beacons

Nickles placements are minted for one site and one slot, resolved locally, and rotate in ten-minute buckets. No impression ping.

own the placement

Arcade & ownership

Tic-tac-toe and Memory play natively, offline. Titles are claimed with an RSA-3072 dongle challenge, not a password reset.

playable today

0page scripts allowed
0bits of AES-GCM, everywhere
0tests green in the suite
0.exe to run, no install

Under the hood

Cryptography you can read in an afternoon.

One symmetric cipher does every job, so there is one nonce discipline, one tag check, and one implementation to audit. Asymmetric keys only wrap or agree — they never hold your content.

  1. 01

    One AEAD, everywhere

    AES-256-GCM seals blobs, cache entries, keystrokes, transport frames and title tokens.

  2. 02

    Wrapping, not encrypting

    RSA-3072-OAEP wraps a fresh AES key for an origin device; P-256 ECDH + HKDF splits lookup keys.

  3. 03

    The phonebook is signed twice

    Registry snapshots carry Ed25519 and ML-DSA-65 signatures over the same message. No classical-only fallback.

  4. 04

    Fail closed, then report

    A package that misses the registry hash is never parsed. The mismatch bumps an attack counter instead.

pinwheelexplained.com/site.kml SEALED 
<?xml version="1.0" encoding="utf-8"?>
<kml v="1" site="pinwheelexplained.com">
  <head>
    <title>Pinwheel, explained</title>
    <meta name="tags" content="privacy, sealed-pages"/>
  </head>
  <body>
    <h1>Pinwheel, explained</h1>
    <p>Plain structure. No scripts, ever.</p>

    <!-- ciphertext until the session key opens it -->
    <blob id="b1" mime="text/plain"/>
  </body>
</kml>
no <script> element exists blob opened in RAM only

The pinwheel

One name, six spokes.

The registry is the hub: a signed phonebook that maps a name to a package and to the device that serves it. Everything else hangs off that one answer.

The central server

Home is secupgrade.com

One host runs the whole spine: the signed phonebook the browser resolves names against, the FreeChat room your messages pass through, and the publisher console that mints ad placements. The server stores ciphertext for mail and chat; only the phonebook and public story metadata are readable.

Visit secupgrade.com the home page and live index Open the chat room pinwheel-freechat · ML-KEM-1024
  • signed phonebook
  • ciphertext-only relay
  • ad console
secupgrade.com LIVE
/Home page · registry news feed /apicallsRegistry API · signed snapshots /pinwheel-freechatEncrypted room · server relays opaque PNGs /adnetworking/publisherNickles console · site-bound placements

The browser pins the registry key and verifies every snapshot twice — Ed25519 and ML-DSA-65 over the same bytes.

Sealed pages

A page you can trust without trusting the site.

The renderer speaks one small markup language and nothing else. That is the whole security model of the surface — there is no capability to disable, because there is no capability to call.

A KICKL page can

  • Headings, paragraphs, quotes, code and rules
  • Sealed images and files as encrypted blobs
  • Inline SVG art drawn from the document itself
  • Native ad slots minted for that one placement
  • Names resolved and hashes verified before parsing

A KICKL page cannot

  • Run JavaScript — the element does not exist
  • Read your clipboard, files or device
  • Load a third-party script or font
  • Phone home an impression or a pixel
  • Change after the registry hash was signed

Take it for a spin

Download KICKL

It is a research vertical slice, not a finished browser — but the spine is real: a name resolves, a sealed package verifies, a PIN unlocks, and a blob opens only inside an unlocked session.

Windows x64 self-contained

KicklBrowser.exe

49.7 MB · no .NET install needed · Windows 10 / 11

Download the browser
SHA-256 f242725e576b06430f7653f602b9d5f8d4d9c5517ef5304a30270cb1a88640db
Source read it all

kickl-browser-source.zip

0.6 MB · C# / .NET 10 / Avalonia · 158 files

Download the source
SHA-256 6e919c88754ca747d3b9c63b9c9a5c5a1aaa58e212b259468a552b3712b2dc0b

First run

Double-click the .exe. Create a local profile with your own 8+ character key, then sign in. There is no key reset — lose the key, lose the profile.

SmartScreen

The build is unsigned, so Windows may say "unknown publisher". Choose More info → Run anyway, or verify the SHA-256 above first.

Build from source

Unzip, then run run.bat — it builds Release and launches the browser. Or dotnet build Kickl.slnx if you want the CLI and tests too.

Registry, chat and the publisher console are hosted at secupgrade.com — that is the home page the browser resolves against.