Skip to main content
dRouter
Vault locked
How it works

Four steps from your browser to sealed hardware and back.

Instead of trusting a cloud privacy policy, your browser checks a signed hardware report and encrypts your prompt directly to the enclave before sending a single word.

Open consoleLimits & provider directory
The four steps
Step 1 · Verify

Your browser checks the hardware's signed report before sending anything.

Step 2 · Scrub & Encrypt

It scrubs personal details and encrypts the message to that hardware's key.

Step 3 · Run in Enclave

The sealed hardware runs the model and nobody outside can read memory.

Step 4 · Destroy Key

The session key is destroyed when you leave.

Interactive Walkthrough

Test each guarantee in four quick rounds

Play through the four rounds below to see how hardware attestation, blind credits, and memory wiping work in practice.

Interactive Verification Game0 of 4 rounds solved
1. Memory bus 2. Blind credit 3. Enclave check 4. Session wipe
Round 1 of 4

Defeat a physical memory-bus wire tap

Unsolved

Switch from deterministic AES-256-ECB memory encryption to AES-256-GCM with fresh per-transfer nonces so a physical wire tap on the RAM bus cannot spot repeated 16-byte blocks.

Your 4x4 secret pattern
16-byte bus ciphertext (0 duplicates)
Wire tap reconstruction (0% leaked)
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
Encrypting the pattern in your browser...
Show details

Physical memory interposers sit passively between the CPU and DDR5 DIMMs. When identical 16-byte blocks are encrypted deterministically without a fresh nonce, duplicate ciphertext blocks reveal the silhouette. Using a fresh 96-bit AES-256-GCM nonce per transfer makes every 16-byte ciphertext block unique (0 of 16 unique blocks, 0.00 bits/byte entropy).

Pattern presets:
Round 2 of 4

Pay without linking your wallet to your prompt

Unsolved

Click any of the six possible buyer-to-session matchings below to test whether the billing server can link Dana Reyes or other buyers to their anonymous chats.

Select any buyer-to-session matching above to test if the billing server can rule it out.
Show details

Your browser hashes the token with Full-Domain Hash (hashTokenMessage) and blinds it with r^e mod n (blindToken) before the mint signs it (signBlinded), then divides out r locally (unblindSignature).

1. RSA modulus size: 1024 bits (e = 65537)
2. Blinded envelope hex: 0x51d7ca58a83c7b3148214d7d3d061ae7...
3. Unblinded signature hex: 0x7f5770b56bff44f0f6eb048a0ab959ca...
4. Spend nullifier SHA-256: 0x8e697a40c51e4f23f8c274a21b815cf5...
5. verifyTokenSignature(token, pub): Valid (s^e mod n == H(token))
Round 3 of 4

Spot the forged enclave before sending your prompt

Binary SEV-SNP verifierUnsolved

Compare the live hardware attestation report from router-0.tinfoil.sh against two tampered copies, and route your prompt to the only candidate where every check passes.

Pick one of the three attestation reports above to run the hardware and Sigstore checks.
Show details

Candidate Charlie uses the authentic 1,184-byte AMD SEV-SNP report from router-0.tinfoil.sh. Candidate Alpha has bit 19 (DEBUG) flipped at byte offset 0x08 of the binary report. Candidate Bravo has a tampered release digest that fails the Sigstore transparency log check.

Round 4 of 4

Destroy the session key when you leave

Unsolved

Pop the enclave session to overwrite the 256-bit AES-GCM session key with zeros, then attempt decryption on a server RAM dump to confirm decryption fails.

Session key is still active in memory; click Pop session to overwrite the key with zeros and test decryption.
Show details
256-bit session key
0x5a678cdba2468320...
AES-256-GCM decrypt test
Decrypts (key live)
Server RAM dump readable
0 bytes
  • [0] Session live: 4,096 bytes encrypted under 256-bit AES-GCM session key inside enclave memory.
Wire Inspection

What each party sees

Type any sample message below to compare what stays on your device, what crosses the network relay, and what enters enclave memory.

Wire inspection

What every party sees when you send a prompt

Type any sensitive sentence below to run it through preparePrompt and seal it with RFC 9180 HPKE to the live enclave public key from /api/relay/attestation. Nothing is sent to a model.

Try:
1. Your deviceFull context

Your browser runs preparePrompt locally to replace secrets and emails with placeholders, normalize style, and pad the payload to a power-of-two byte bucket.

Send $125,000 to dana.reyes@acme.example using key sk-live-9876543210abcdef on 2026-11-04
Redactions (preparePrompt)2
Privacy risk score100 → 32
Show local replacement map
[EMAIL_1]da***@acme.example
[SECRET_1]sk-***ef
2. NetworkHPKE ciphertext

Your ISP and Wi-Fi router see a padded 4,096-byte payload sealed into 0 bytes of RFC 9180 HPKE AES-256-GCM ciphertext.

...
Padded bucket size4,096 B (136 B + 3960 B pad)
HPKE ciphertext size0 B (+16 B GCM tag)
Byte entropy0.00 / 8.00 bits/byte
3. RelayNo private key

The relay forwards the X25519 encapsulated key header and 0-byte EHBP ciphertext frame to router-0.tinfoil.sh. It cannot decrypt the body.

Host: router-0.tinfoil.sh
Enclave HPKE key: 5b89805f6ad3d337d0f6...
Ehbp-Encapsulated-Key: ...
Ciphertext bytes: ...
Frame SHA-256: e3b0c44298fc1c149afb...
Note: Tinfoil's router runs an attested usage reporter and acceptable-use classifier sidecar reporting policy violations to api.tinfoil.sh.
4. Sealed hardwareScrubbed text

Inside the attested CPU and GPU enclave, the HPKE frame decrypts to the preparePrompt output below. Raw secrets and emails never entered the tunnel.

Send $125,000 to [EMAIL_1] using key [SECRET_1] on 2026-11-04
Memory stateEncrypted RAM / GPU HBM