6.0 Wadjet Browser
A browser that shows you the threat before the page loads.
A browser built in Rust around the Lens threat HUD: post-quantum onion transport, container tabs, and Wadjet Ident sign-in. In development — the waitlist is open.
How to read this page Every capability here is written in design-target tense — what Wadjet is built to do, not what ships today. The waitlist gets build-by-build honesty, not a date.
In development. Join the waitlist; nothing here ships today.
- TLS keyshare — target X25519 + ML-KEM-1024
- Wadjet Ident — target ML-DSA-87
- transport — target QLEAP 3-hop
- trust boundary — target 0 C/C++
01 / THE LENS — CONCEPT DEMO
In development — concept demo
Open the Lens. Watch what the page tried.
The page loads. The Lens tells you what it tried.
Field notes on post-quantum migration
Authored demonstration of the Lens spec over a demo page — no live telemetry. In development. Join the waitlist; nothing here ships today.
Lens pass complete. Three findings on the demo page.
02 / THE BUILD TARGET — LETTERED
In development — design spec
Read the build target, section by section.
The trust boundary
Wadjet is built around a memory-safe Rust rendering engine under the Wadjet Core orchestrator, with zero lines of C or C++ inside the trust boundary — the language class behind roughly 70% of historical browser memory-safety CVEs1.
- Engine
- memory-safe Rust rendering engine + Wadjet Core
- Trust boundary
- 0 lines of C/C++ — design target
- CVE class removed
- memory unsafety
Transport
Every outbound connection is built to leave through QLEAP — three post-quantum-keyed hops by default, never as a mode you remember to switch on.
TLS 1.3 with an X25519 + ML-KEM-1024 hybrid keyshare is the default handshake in the design; DNS resolves over DoH, and OHTTP separates who you are from what you ask.
- Tunnel
- QLEAP 3-hop onion — default on
- TLS
- 1.3 · X25519 + ML-KEM-1024 hybrid keyshare
- DNS
- DoH
- Metadata
- OHTTP
Certificate trust
The design pins site certificates against the QERYX transparency log (KTS). A certificate that fails the pin refuses the session outright: the Lens raises the warning, and the page never loads over it. A machine-in-the-middle gets no session at all.
- Pin source
- QERYX transparency log (KTS)
- On mismatch
- session refused
- Surface
- Lens warning
Container tabs + Mask
Each container is built to carry its own keypair, its own vault slot, its own DNS resolver, and its own QLEAP circuit. Burner tabs live in memory only and are FSOR-erased on close.
Mask keeps a container's fingerprint consistent within a session — randomized per container, timing quantized, TLS fingerprint converged toward the population — and the design pins at most 2 bits of fingerprint entropy across fresh installs1.
- Per container
- keypair · vault slot · DNS resolver · QLEAP circuit
- Burner tabs
- in-memory only, FSOR-erased on close
- Fingerprint KPI
- ≤2 bits across fresh installs — design target
Sign-in — Wadjet Ident
navigator.qeryx.sign(challenge): the sign-in is an origin-locked
ML-DSA-87 signature with FIPS 204 ctx framing. The origin lives inside the signed
context, so a look-alike domain has nothing to replay — phishing-immune by
construction, as designed. Legacy sites get a WebAuthn-PQ shim.
- API
- navigator.qeryx.sign(challenge)
- Signature
- ML-DSA-87 · FIPS 204 ctx framing
- Lock
- origin bound into ctx
- Legacy
- WebAuthn-PQ shim
Zero new crypto primitives. Wadjet is composition on crypto-core — the invention is supervision and tooling.
03 / THE TARGETS — IN NUMBERS
In development — design targets
Hold the design targets to numbers.
01
lines of C or C++ in the Wadjet trust boundary — design target
≤2 bits1
fingerprint entropy across fresh installs — design KPI
| Surface | Target | Status |
|---|---|---|
| Trust boundary | Rust — 0 lines of C/C++ | design target |
| TLS keyshare | X25519 + ML-KEM-1024 hybrid, default on | design target |
| Transport | QLEAP 3-hop onion, default on | design target |
| Certificate trust | KTS log-pinned, refuse on mismatch | design target |
| Sign-in | origin-locked ML-DSA-87 (FIPS 204 ctx) | design target |
| Fingerprint | ≤2 bits across fresh installs | design KPI |
04 / THE FLOOR — WHAT IT COMPOSES ON
Trace what Wadjet is built to compose on.
The parts beneath the target, with their own status
- QLEAP · THE TRANSPORT — Three hops. Zero memory. Wadjet’s default transport target — not in this build: the packet-tunnel provider requires an Organization Team ID.
- QVAULT · THE CONTAINER SLOT — The vault behind each container’s slot; live today.
- CRYPTO-CORE · ONE RUST CORE — Wadjet adds zero new primitives; it composes on this core.
05 / THE TARGETS — AGAINST TODAY
In development — design targets
Set the design targets against today’s categories.
| QERYX Wadjet — target | Hardened-fork class | Mainstream browser | |
|---|---|---|---|
| Design targets | |||
| Trust boundary | Rust, no C/C++ | C++ engine inherited | C++ engine + vendor telemetry |
| Transport privacy | 3-hop PQ onion default | Optional overlay, classical crypto | Direct, classical |
| Certificate trust | Log-pinned, refuse on mismatch | CA list | CA list + vendor root |
| Fingerprint | ≤2-bit target across installs | Letterboxed or randomized | High entropy |
| Sign-in | Origin-locked PQ signatures | Passkeys (classical) | Passwords + passkeys |
In development. Join the waitlist; nothing here ships today.
06 / THE WAITLIST — ONE STEP
Join the waitlist.
When it earns its status badge, Wadjet lands in the Armed tier. Today there is one honest step: the waitlist — a mailbox, never a form, no tracking pixel behind it.
07 / THE HARD QUESTIONS
Ask what Wadjet cannot do yet.
Can I use Wadjet today?
No. It is in development. The waitlist is open, and this page describes the build target, not a shipping product.
Why build a browser instead of hardening one?
The rendering trust boundary. Forked engines inherit a C++ attack surface and a vendor-controlled trust root; Wadjet's boundary is Rust and its trust root is the QERYX transparency log.
What is the Lens?
A per-tab HUD showing which tracker fired, which fingerprint API was touched, what a page tried to learn — before and while it loads.
Will sites break under fingerprint masking?
Containers keep values consistent within a session, so single-page apps keep working; masks refresh when the container closes.
What will Wadjet never do?
Sell, sync, or see your browsing. Sync is sealed blobs; the relay never sees URLs, titles, or visit counts. That is the design contract.
When?
When it earns its status badge. The waitlist gets build-by-build honesty, not a date.