A real site behind every connection
Unauthenticated and probing traffic is forwarded to the configured destination. A real-site cover model is part of the protocol itself.
AuthenticatedPrivate transportUnauthenticated → real site
1.0.0-alpha is herePrivacy,
Privacy,
in plain sight.
A connection designed to blend into the open internet. An open-source privacy transport built in Rust, with real TLS 1.3 and QUIC at its core.
Open source. Built in Rust. Yours to inspect.
TLS 1.3 / QUIC01 — 03
umbra
Your device
Open internet
Private transportUnauthenticated → real site
RustMemory-safe foundation
TLS 1.3 + QUICTwo outer transports
≥ 90%Line coverage gate
MITOpen-source license
Designed for the open internet
Less to distinguish. More to understand.
Privacy comes from careful protocol decisions. Every layer has a purpose, and every claim has a boundary.
A considered TLS surface
Profile-driven ClientHello construction, extension ordering and GREASE handling make browser fingerprint behavior inspectable.
Modern cryptographic building blocks
X25519, HKDF, AEAD and post-quantum-aware ML-KEM / ML-DSA primitives, with constant-time checks and zeroized secrets.
The right path for each connection
TCP, QUIC, stream multiplexing and Vision splice paths live in dedicated layers. One client can serve TCP and UDP through SOCKS5.
From source to your first connection
Small commands. A clear starting point.
Build the client and server from the same repository. Generate your keys, then follow the guide to configure both endpoints.
git clone https://github.com/lotosli/umbra.gitcd umbracargo build --release./target/release/umbra keygen Rust · Cargobash
Documentation
Know what you run.
From the first installation to the protocol beneath it. Find a guide, inspect a setting, or follow the architecture.
The open internet is worth building for.
Read the source. Understand the design. Start with Umbra.
Get started