// CLASSIFIED //   OPERATIONAL // FOR AUTHORIZED OPERATORS ONLY   // HANDLE WITH CARE //
CONFIDENTIAL · LEVEL 4

NUKE//CRYPT

Realtime HTTP request encryption for operators who cannot afford to be profiled. Every GET, POST, header and payload entering or leaving your machine is wrapped in a XChaCha20-Poly1305 + Kyber-1024 envelope, onion-routed through five offshore nodes and stripped of all identifying metadata. No accounts, no logs, no jurisdiction.

// THREAT MODEL

Built against state-level adversaries.

If your adversary controls upstream ISPs, exit nodes, or border routers, conventional VPNs are not enough. NUKE//CRYPT was designed for that environment.

CORE

Realtime envelope

Every HTTP request is encrypted on your device, broken into fixed-size cells, padded to defeat traffic analysis, then re-emitted from a foreign exit. No plaintext ever leaves your machine.

PQ

Post-quantum KEM

The session keys are agreed via Kyber-1024, a NIST PQC finalist. Even an adversary who records your traffic today cannot decrypt it after a fault-tolerant quantum computer ships.

/0

Zero retention

Nodes run from RAM-only disks. There is no syslog, no tcpdump, no flow log. Every reboot wipes the entire short-term memory of the relay.

5-HOP

Onion routing

Traffic is wrapped in five concentric layers and bounced through nodes hosted in IS, CH, PA, SG and BG. No single node can correlate origin and destination.

META

Metadata scrubbing

User-Agent, Accept-Language, X-Forwarded-For, CF-Connecting-IP, cookies and timing fingerprints are stripped at the entry node before re-encryption. You become a uniform shape.

FALLBACK

Pluggable transports

When DPI is hostile, NUKE//CRYPT switches to obfs4, meek-azure or a custom QUIC mimic that looks like a video-call. Censorship circumvention is a default, not an upsell.

// SPECIFICATION

Cryptographic stack & operational profile.

   ops@nuke-crypt:~ /etc/nuke/profile.json READ-ONLY
cipher.symmetric
XChaCha20-Poly1305 (192-bit nonce)
cipher.kem
CRYSTALS-Kyber-1024 (NIST PQC ML-KEM)
cipher.classical_kx
X25519 (hybrid handshake)
hash
BLAKE3-512
onion.depth
5 hops, geographically diverse
obfuscation
obfs4 · meek-azure · QUIC-mimic
cell.size
512 bytes, padded
storage
tmpfs only (RAM)
retention
0s · /dev/null logger
jurisdiction
Seychelles operator, Icelandic exits
bandwidth
unmetered, 1024 concurrent streams
subscription
lifetime token, one-shot crypto purchase, never expires
// USE CASES

Who deploys NUKE//CRYPT.

 profile/01 — activist.cfgOK

Activists & journalists.

When publishing material that places you on a state target list, every connection your device makes is an attribution risk — even if the payload is end-to-end encrypted. NUKE//CRYPT obscures which sites you visit, which uplinks you use, and which devices you operate from.

 profile/02 — researcher.cfgOK

Security researchers.

Probe hostile infrastructure without leaking your origin AS. Submit takedown requests, run scanners, and pull malware samples through a chain of foreign exits whose flow data is unrecoverable.

 profile/03 — defender.cfgOK

Privacy-first operators.

Whether you are negotiating a leak, a salary or a divorce, you cannot afford metadata attribution. NUKE//CRYPT replaces your network shape with that of a generic NUKE//CRYPT user — millions of you, all looking identical.

 profile/04 — emigrant.cfgOK

Diaspora & political exiles.

If you are still talking to family inside an authoritarian regime, your connections are correlated against theirs. Routing through NUKE//CRYPT severs that correlation while keeping latency under 90 ms in most regions.

// DEPLOY

Acquire access.

OPS-PKG
Realtime Crypter — Lifetime

One-shot purchase. Unmetered bandwidth, 1024 concurrent streams, all five exit clusters. Token never expires.

€650one-shot · lifetime
M Monero · recommended ฿ Bitcoin Ł Litecoin
  • Wireguard config + onion-stack profile
  • Five geographically diverse exit clusters
  • 1024 concurrent streams, no throttling
  • Self-issued API key, revocable from dashboard
  • Renewals optional, never automatic
[ Initiate purchase ]
 ops@nuke-crypt:~ /payment.notes READ-ONLY

Payment guidance

We accept three currencies. Bitcoin and Litecoin transactions are confirmed automatically by polling public block explorers — settlement happens within minutes after the first network confirmation.

Monero is strongly recommended. Because Monero is an opaque-by-design ledger, no third party (including us) can correlate your payment to a wallet, an IP, or a future transaction. Activation is performed manually by an operator after observing your funds; median activation time is under 10 minutes.

If you are operating in a high-risk jurisdiction we recommend funding your XMR wallet through a non-KYC swap and routing the order over Tor.

// FAQ

Operator questions.

Are you a VPN?
No. A VPN is a single-hop tunnel that ships you somewhere else. NUKE//CRYPT is a five-hop onion-routed encrypted-cell network, with per-request envelopes and metadata scrubbing. A VPN provider knows your origin and your destination at the same time. We never can.
How is this different from Tor?
Tor is excellent and we recommend you stack NUKE//CRYPT on top of it for the highest threat models. Compared to Tor, NUKE//CRYPT offers: (a) realtime HTTP cell encryption rather than circuit-level tunnelling, (b) post-quantum KEM as a default, (c) higher per-stream throughput thanks to dedicated relays, and (d) pluggable transports rotated automatically.
Do you keep logs?
No persistent logs. Relays run on RAM-only filesystems. The orchestrator stores only your order ID, your alias, the chosen currency, and an on-chain TXID for BTC/LTC settlement. Nothing else. Reading the warrant canary at the bottom of this page is a recommended habit.
What about lawful interception?
Our operating entity is registered in a jurisdiction that does not maintain a mutual-legal-assistance treaty for civil network-traffic disclosure. We will not voluntarily disclose data to any government, intelligence agency or commercial third party. If we are served with a binding order we cannot ignore, the warrant canary on this page disappears within 24 hours.
Does the access token ever expire?
No. Each token is issued under our lifetime profile — the relay accepts it forever, even if you let it sit on a cold drive for years. There is no auto-renewal, no dunning email, no expiry. The only way the token stops working is if you explicitly revoke it via nuke-crypt cli revoke after a compromise.
Is this legal in my country?
In most democracies, yes. Several jurisdictions restrict the use of strong encryption or anonymisation tools — you are responsible for assessing the legality in your own country. We do not aid the circumvention of sanctions, and we will not facilitate access against operators who genuinely need protection.