⚠ Svart Security is currently in development. All features described are planned for public release.
Svart Security is built from the ground up with privacy and security as core principles, not afterthoughts. We believe you have the right to browse privately, without surveillance, tracking, or compromises.
Built on Firefox's proven engine with our security enhancements. We don't hide what we do — full source code, detailed documentation, and transparent security practices.
Svart Security doesn't send any data about you. No telemetry, no analytics, no tracking. Your browsing is yours alone.
All features are built-in. By eliminating the extension ecosystem, we eliminate an entire class of security vulnerabilities.
Our encrypted AI engine uses AES-256-GCM with PBKDF2 key derivation at 250,000 iterations. It runs cross-platform via the Web Crypto API and powers the intelligent features across the entire suite.
Svart Security is a suite of privacy and security tools designed to protect your digital life. Here's how each layer works together to keep you safe.
Sign up with your email. A unique 64-character secret key is generated for you using AES-256-GCM cryptographic randomness with uppercase, lowercase, digits, and special characters. This key is your identity — it's never your password. You log in to the website and all apps using your email and password, not your secret key. Your password is hashed with Argon2 (GPU-resistant) and never stored in plain text. One account per network is enforced to prevent abuse.
Your secret key is always visible in your account dashboard (the same page where you change your username). This means your key could be compromised if someone gains access to your account. If your key is ever stolen, you can request a key reset — provide your email, password, and current key to prove ownership, then an admin reviews and issues a new one. There will never be a single ad in any Svart app or on the website — ever.
All sensitive data in the Svart suite is encrypted using AES-256-GCM with PBKDF2 key derivation at 250,000 iterations. This is military-grade encryption — the same standard used by governments. Your data is encrypted on your device before it ever leaves. We cannot read it, even if we wanted to.
A secure Chromium-based browser with built-in ad blocking and DNS privacy, designed for people who want real protection without the complexity. No extensions needed, no tracking — just privacy that works out of the box. Over 300 built-in ad filter lists (powered by uBlock Origin lists), DNS privacy splash on first launch to set up NextDNS, alias & forwarding email guidance for anonymous accounts, and a 30-minute session timeout (customisable). Dev mode is available for advanced users who want to install extensions. Optional Tor integration routes all traffic through Tor's onion network for maximum anonymity.
AI chat, internet scraping, knowledge training, and document analysis — all AES-256-GCM encrypted. Your secret key generates a unique API key for your AI instance. This API key is random and only activates after you log in with your local password. The server cannot see or access your API key or your conversations. Svart AI requires an internet connection — it talks to cloud models behind the scenes and cannot run offline. Free tier gives you 750 premium requests/month with no credit card required — the exact same engine paid users get, with no feature locks.
A fully local password vault encrypted with AES-256-GCM. Built-in strong password generator, master password protection with Argon2 key derivation, and a duress wipe feature that destroys everything if you ever need it to. Auto-fill support for browser integration. Nothing is stored on our servers — your vault lives on your device, under your control. When you need a credential, SVART Passwords decrypts it in memory and clears it when you're done.
Secure note-taking with AES-256-GCM encryption at rest. Your notes are encrypted the moment you save them and never leave your device unencrypted. Local vault storage protected by your secret key, with markdown support, quick search across all notes, and completely offline operation — no cloud sync, no risk. Full-featured editor with syntax highlighting, export, and search — all running locally.
A rich-text document editor with AES-256-GCM encrypted storage. Format, search, and organise documents securely — everything stays on your machine. Rich text editing (bold, lists, headings), full-text search across all documents, and export to encrypted or plain formats. Protected by your secret key with no cloud, no sync, and no risk. Your documents never leave your device unencrypted.
Self-hosted encrypted chat with X25519 key exchange and AES-256-GCM message encryption. You host the server wherever you want — your basement, a friend's place, anywhere. Your messages, your hardware. A build packager gives your server a unique ID to connect. Group chats with per-group encryption, completely decentralised architecture, and zero-knowledge design — we can't read your messages because we never have access to them.
End-to-end encrypted email with temporary addresses and anonymous forwarding. Create throwaway emails for sign-ups or use persistent encrypted inboxes for real communication. No identity required to create an account. PGP-compatible encryption for interoperability with existing email providers, and self-destructing messages for conversations that shouldn't stick around.
Encrypt, decrypt, and securely manage your files with ease. AES-256 encryption with batch operations for handling multiple files at once, drag-and-drop support, and secure file shredding (overwrite + delete) so deleted files can't be recovered. Cross-platform and portable — no installation required. Protecting your files should be simple, so it is.
Scan and optimise your digital privacy settings across platforms. Multi-platform privacy scan with guided auto-fix tips for each issue found, browser privacy audit, social media exposure check, and continuous monitoring mode. Get a privacy score with improvement tracking so you can see exactly where you stand and what to fix.
Ultra-fast VPN with a strict no-log policy and servers in privacy-friendly jurisdictions. Built-in kill switch ensures your real IP is never exposed if the VPN drops. Multi-device support for up to 5 devices, split tunnelling for selective routing, and DNS leak protection. Your connection, your privacy.
Every Svart tool operates on a simple principle: we don't track you. No telemetry, no analytics, no usage stats, no crash reports. We don't know what pages you visit, what you type, or what you search. Your browsing, your notes, your passwords — they're all yours alone.
Our website and authentication run on Cloudflare's global edge network. Serverless functions handle registration, login, and account management. KV storage holds account data. All connections are forced HTTPS. No origin server to attack — everything runs at the edge, close to you, with Cloudflare's DDoS protection.
Every Svart app follows the same security model. Here’s exactly how your secret key, local passwords, and duress protection work — no secrets, no hidden processes.
When you create an account, a unique 64-character secret key is generated for you using AES-256-GCM cryptographic randomness. This key is your identity across all Svart apps.
Your secret key is not your password. You log in with your email and password — the secret key is a server-side identifier that links your account to your apps.
Your key is always visible in your account dashboard — the same page where you change your username. Because it’s stored there, your key could be compromised if someone gains access to your account. Your key can also be used to reset your account, so protecting your login is critical.
Each app uses your secret key to derive a unique API key for that specific app. The server validates your secret key but cannot see your local data, your local password, or your API key. The server only knows you’re a valid user — nothing more.
If your secret key is compromised, you can request a key reset. You must provide your email, current password, and current secret key to prove you own the account. A unique reset code is generated from your credentials. An admin or moderator reviews and approves the request — then a new key is issued and your old key is immediately invalidated.
Every Svart app stores your password locally in the app’s own data files. The password is hashed with Argon2 (GPU-resistant, 250,000+ iterations) before being written to disk. The plain-text password is never stored anywhere.
When you open the app and type your password, the app hashes what you typed and compares it to the stored hash. If it matches, the app unlocks. If it doesn’t, access is denied.
Where is the password stored?
Each app keeps its own encrypted config file in its local data directory:
The config file contains your hashed password, your encrypted data key, and your app settings — all encrypted with AES-256-GCM. The app reads this file on launch to verify your identity and decrypt your data. The server never sees this file.
Why local?
Storing your password locally means your password never touches a server. There is no central password database to breach. Even if someone compromised our server, they would have zero access to your local password or your encrypted data. Your device is the vault.
Every Svart app supports a duress password — a secondary password you set that, when entered instead of your real password, permanently deletes all your data.
How it works:
Entering the duress password permanently destroys all data stored by that app. There is no recovery, no backup, no undo. The data is overwritten and deleted from disk. This feature exists for situations where you are forced to unlock your device — entering the duress password gives the appearance of a fresh install while protecting your real data by destroying it.
The duress password is stored as a separate Argon2 hash in the same local config file. The app checks both hashes on login: one unlocks, the other destroys.
NetworkGuardian is Svart Security's autonomous protection layer. It exists to prevent abuse of our platform while respecting your privacy. Here's exactly how it works and what it can see.
The Guardian tracks exactly two things, and nothing else:
net_a3f8b2c1e9d4.... The original IP is immediately discarded. Nobody — not even the admin — can reverse this hash back to your IP.The Guardian does NOT track logins, browsing, page visits, usage patterns, or anything else. Only registration.
The Guardian performs three functions:
Only the site administrator (admin@svartsecurity.org, with the admin role) can access Guardian enforcement controls. Moderators cannot access enforcement. The admin can:
net_a3f8b2..., never a real IP)When a report is escalated to law enforcement, the only data available is:
That's it. No IP addresses, no browsing history, no message content, no usage data. Law enforcement would need to subpoena the ISP with the relevant timeframe, not us — because we don't have the data.
Reports filed through the Guardian can reference specific laws. These are the categories available for formal incident reports. General piracy (media, music, film) is not included — only distribution of commercial software is covered.
We protect people. We do not protect crimes. Your privacy is absolute for all lawful use. But if someone uses our platform to commit serious crimes — child exploitation, terrorism, fraud — we will cooperate with law enforcement using the limited data we have. We believe this is the right balance: maximum privacy, minimum complicity.
All tools except Svart AI are completely free with no limits. Svart AI gives you 750 free premium requests per month — the same full engine that paid users get, with no feature locks. If you need more, upgrade to £4.99/month for 2,000 requests or £9.99/month for unlimited. There will never be a single ad in any Svart app or on the website — no ads on any plan, ever. Not now, not later.
Your secret key is generated when you sign up and is always visible in your account dashboard (the same page where you change your username). You log in with your email and password — the secret key is not used for login. It’s used to activate your desktop apps and can also be used to reset your account. Because your key is stored in your dashboard, it could be compromised if someone gains access to your account — so protect your login. If your key is ever compromised, you can request a key reset — you must provide your email, password, and current key to prove ownership, then an admin reviews and issues a new key.
SVART is built specifically for privacy and security with military-grade encryption, zero extensions, built-in ad blocking, and Tor integration — all out of the box.
In production mode (default), only our built-in ad blocker runs for maximum security. Dev mode allows extensions for developers and testers.
Most features work offline. Ad blocking, encryption, and local features are always available. Svart AI and some cloud features require internet.
Your master password is hashed with Argon2, a GPU-resistant algorithm. It's never stored in plain text and never sent anywhere.
Windows 10/11, macOS 10.15+, and Linux (Arch, Ubuntu, Debian, Fedora). Native installers for all platforms.
Install Tor, then enable it in SVART settings. All traffic will route through Tor's network automatically.
All bookmarks, history, and credentials are encrypted locally. You control where they're stored.