Built, not bolted together

Protection

The ad blocker is part of the program

Filter lists run in the main process and take effect before a request leaves the device. Nothing to install afterwards, no store, no third-party code with access to every page you open.

The most common way to take over a browser today runs through a bought or hijacked extension. For the blocker, that route doesn't exist here.

Passwords

The vault is a program of its own

Not a matter of taste: everything running in the main process shares memory with every bundled package — with an Electron program, that is quickly several hundred. So the vault is a separate Rust program. They talk in lines of JSON; there is no more contact surface than that.

The master password does not encrypt the data. Through Argon2id it encrypts only a random vault key. Changing the password therefore costs a re-wrapping rather than a re-encryption.

Every entry is encrypted individually, with its own identifier as additional data — so no entry can be swapped for another.

Memory

Forty tabs don't cost forty processes

A background tab that has done nothing for twenty minutes gives its renderer process back. The tab's navigation history stays, the memory is freed.

The other way round, a restored tab only gets a process on first click: a session with forty tabs starts as fast as one with a single tab. Adjustable through suspendAfterMinutes; 0 turns it off.

Overview

The Constellation

Ctrl+Tab — or ⌘K — opens a star map of every open tab. The active one sits at the centre, everything else in rings around it, and lines connect the tabs that opened one another.

Unloaded tabs sit dimmed, with their last picture — which makes what the memory budget actually does visible for the first time.

The layout is deterministic. A physics simulation would look different every time you opened it and would destroy exactly the spatial memory the view lives on.

Address bar

Nothing jumps

At rest the bar shows the page as text: host emphasised, path dimmed, and a “Not secure” note on plain HTTP. On ⌘L or a click, a text field appears in exactly the same place — same height, same border, same spacing.

You can choose DuckDuckGo (the default), Startpage, Brave Search, Ecosia, Qwant, Google and Bing — in that order, and that is not a ranking but a stance: the ones that don't take notes come first.

The suggestion names the chosen engine. Where an input goes belongs where you send it — otherwise you find out from the results.

Private windows

What is never written doesn't need deleting

A private window gets a session of its own without persistent storage. Cookies, cache and local data never reach the disk in the first place.

The ad blocker and filling in from the vault still apply. Deliberately not the offer to save a new password — a new entry would be exactly the trace that is not supposed to appear here.

The start page also says what a private window cannot do: to the sites you visit, your network and your employer, you remain visible.