I build Ciphera, a privacy-software company in Belgium, self-hosted on European infrastructure. The public work, grouped by what it does:
- tessera — OPAQUE (RFC 9807) in Rust. Argon2id pinned at m=64MiB, t=3, p=1; the server keeps a registration record that cannot be reversed into the password.
- tessera-ts — the browser half, in WASM.
export_keywraps a non-extractable vault key and is then zeroed, so the raw key bytes are never exportable from the page. - tessera-go — the server half. One shared core and one conformance kit hold all three byte-for-byte interoperable.
- pulse — web analytics with no cookies and no cross-site identifier: the visitor hash is derived per site, so the same person is a different number on every site. Live at pulse.ciphera.net.
- pulse-cli —
brew install ciphera-net/tap/pulse. Never writes an API key to a file — not as a fallback, not on a keychain error. - pulse-api-go — the wire types the server and the CLI share. Stdlib only; the
go.modcarries norequireblock.
- sigil — favicon resolver. The address check runs in
net.Dialer.Control, after DNS resolves, so a rebind has nothing left to swap. - cerberus-schema — bot-detection wire format. Publishes detector shapes and never thresholds, and no
group_bycan produce a(fingerprint, site)tuple.
The rest under @ciphera-net is glue. No independent security audit yet — that gap and the others are listed at ciphera.net/trust.