Curtain Whitepaper

Overview

Curtain is a privacy-first browser built around one idea: you should be able to share a website without sharing its link. Instead of handing someone a raw URL — which reveals the destination and can be logged by any server, network, or history file along the way — Curtain wraps that destination in a sealed curtain:// token that only the Curtain browser can open.

Everything that makes a link private happens on your device. The original URL is never sent to our servers in readable form. Curtain keeps no browsing history, sets no tracking cookies, and stores nothing that could reconstruct where you've been. Sessions are ephemeral by default and vanish when you close them.

Cryptography

When you seal a link, Curtain generates a fresh random key on your device and encrypts the URL — along with any optional payload, such as an embedded login — using XChaCha20-Poly1305, an authenticated cipher with a 256-bit key and a 192-bit nonce. The output is a compact, tamper-evident ciphertext.

When a link is passphrase-protected, its key is derived with Argon2id — a memory-hard function tuned to resist brute-force and GPU cracking — using a unique per-link salt, so no two links ever share a key. HKDF then separates that secret into distinct keys for content, authentication, and metadata.

Because sealing and unsealing both happen client-side, the curtain:// token is opaque to everyone in between. It carries no readable address and cannot be reversed without the key — only a Curtain browser holding that key can turn it back into the original site.

Threat model

Curtain protects the confidentiality of a shared link and its contents against a passive or active network observer, the channel the link travels through, and Curtain's own infrastructure — we run zero-knowledge and cannot read what we never hold.

For high-risk situations, a link can be locked behind a PIN, with a separate duress PIN that opens a decoy vault instead of your real data. Repeated failed attempts lock the link and can trigger its deletion.

Curtain is not a general anonymity system. It does not mask your IP address like a VPN or Tor, and it does not hide that you're using Curtain. It secures the links you seal and the sessions you open — not your entire network footprint. Endpoint security still matters: whatever plaintext you can see, an attacker who controls your device can see too.

Common questions

Is Curtain Chromium-based? No — it's a native macOS app built on Apple WebKit (WKWebView) with a Rust core.

Is there a proxy? Does the site I open see my IP? No proxy in the default flow — Curtain resolves a sealed link on your own device and connects directly, so the destination sees your IP. Curtain is not a VPN and doesn't claim to be. An optional, paid relay that hides your IP (and can shield a private origin) is on the roadmap.

Can Curtain read my links or credentials? No. Sealing and unsealing happen entirely on your device, and no Curtain server sits in the request path — there's nothing to log. That's what makes it zero-knowledge.

Is the destination hidden from me when I open it? No — the goal is to hide the link from the sharing channel and from anyone without Curtain, not from the person opening it. Your device holds the key and decrypts locally to load the page.

Is it open source? Audited? The core sealing library is planned to be open-sourced, with an independent audit and notarized builds to follow. Until then, treat Curtain as early software — great to try, not yet a replacement for your bank's own app.

Is the developer SDK / API live? Not yet — the embed, SDK, hosted API, and Agent Ghost are in development (early access). What's live today is the macOS app, link sealing, silent login, and the PIN + duress-PIN vault.