HashLink

encrypted peer tunnel

Two peers establish a shared secret, derive a key through a hash chain, and talk across an open wire. Everything crossing the wire is ciphertext — the chain is what turns a one-time handshake into the key that locks each message. Real Web Crypto: ECDH · HKDF · AES-GCM.

Peer A

role: initiator

offline — no key

—

Peer B

role: responder

offline — no key

—

Hash chain not built

build a tunnel to see the chain

Wire activity

Tunnel down. Establish a tunnel to begin.

A browser page can't open a real OS-level network tunnel, so the two peers live in one page and the "wire" is simulated — but the cryptography is genuine. The shared secret comes from a real ECDH key exchange; the hash chain (HKDF over SHA-256) stretches it into message keys; each message is sealed with AES-GCM. "Advance chain" ratchets forward so a leaked key can't decrypt past traffic — the same forward-secrecy idea WireGuard uses.