Your VPN hides your IP. Your ISP still sees your DNS queries. Websites still fingerprint your browser. And everything you encrypt today can be stored and cracked when quantum computers land. Hasenpfote closes all four gaps from a single system tray icon.
For: everyday browsing, coffee shop WiFi, ad-tech tracking. No tunnel, no slowdown. Your DNS stays private and your browser stops leaking who you are.
For: banking, sensitive email, corporate networks, restrictive ISPs. Full encrypted tunnel with traffic that looks like normal HTTPS to deep packet inspection.
For: journalists, activists, whistleblowers, anyone whose traffic pattern is itself a risk. Sender anonymity through 5-hop mixnet routing. Your ISP can't see where you're going. The destination can't see where you came from.
Tauri GUI (Svelte 5, 1.6KB bundle, user process) | | gRPC over Unix Domain Socket | hp-daemon (root, privileged orchestrator) | -----+------+--------+--------+-----------+ | | | | | hp-mixnet hp-tunnel hp-dns hp-fingerprint hp-pqc (Nym 5-hop) (AWG 2.0) (ODoH) (AI profiles) (X-Wing) | | -----+---------+------ | | hp-routing hp-firewall (TUN device) (kill-switch)
Strict privilege separation. The Tauri GUI runs as a normal user — it never touches the network stack. All privileged operations (TUN device creation, firewall rules, DNS interception, route table changes) are isolated in the root daemon. The two communicate over gRPC through a Unix domain socket with peer-credential authentication. Why gRPC over D-Bus or REST? Typed contracts via protobuf, server-streaming for real-time status events, and forward-compatible versioning. If the daemon panics, a registered cleanup hook tears down firewall rules and restores system DNS before the process exits.
Most anti-fingerprinting either randomizes values (defeated by majority voting across sessions) or makes all browsers look identical (breaks websites). Hasenpfote takes a third path: it injects deterministic, internally consistent fake profiles. Canvas hash, WebGL renderer, AudioContext output, Navigator properties, font list — all match a plausible real browser. Currently 6 hardcoded profiles; a CTGAN/VAE generator for unlimited synthetic profiles is in research.
AmneziaWG 2.0 wraps WireGuard in four obfuscation layers: random-length padding on the 148-byte handshake, randomized magic header ranges replacing the fixed 0x01–0x04 identifiers, custom protocol signatures that mimic QUIC or DNS before the handshake, and interspersed junk packets. The result: DPI systems that flag standard WireGuard in milliseconds can't distinguish this from normal HTTPS traffic.
Every tunnel uses X-Wing — a hybrid KEM that derives keys from both X25519 (classical, proven) and ML-KEM-768 (NIST-standardized, lattice-based). The derived secrets are combined via HKDF-SHA256. Pre-shared keys rotate every 90–120 seconds through the relay. If either algorithm is broken, the other still holds. This protects against harvest-now-decrypt-later attacks that are already happening.
Oblivious DNS-over-HTTPS (ODoH) separates who's asking from what's being asked — your ISP can't see the query, and Cloudflare can't see the source. DNS-over-QUIC (Quad9) as fallback. A local stub resolver binds to 127.0.0.1:53 and system DNS is redirected via launchd/systemd. No query ever leaves the machine unencrypted.
When a tunnel is active, pf (macOS) or nftables (Linux) rules default-deny all outbound traffic except the tunnel interface and essential system services. If the tunnel drops, traffic stops — it doesn't fall back to cleartext. During mode transitions, rules are updated atomically before the new tunnel is established. On daemon crash, a panic hook removes rules and restores DNS.
Maximum mode routes traffic through Nym's 5-hop mixnet via a local SOCKS5 proxy. Unlike a VPN, where the provider sees both sides, each mix node only knows its predecessor and successor. Continuous cover traffic defeats timing analysis even when the user is idle. Current integration is PoC-level (SOCKS5 to nym-socks5-client binary); production path is direct integration with nym-vpnd.
"Every privacy tool asks you to make a permanent choice: maximum protection with broken websites, or fast browsing with no protection. That's a false trade-off. A lawyer reviewing contracts and a journalist meeting a source have different threat models — but they shouldn't need different software."
— The design principle behind three modes
12 Rust crates. Privilege-separated daemon. Post-quantum by default. Open-core, Swiss-built, research-backed.
Let's Talk →