A decentralized, Tor-like onion-routing overlay network with its own .root top-level domain.
Gossip-based peer discovery, 3-hop circuits, hidden services — open source, self-hostable, and honest
about what it does and doesn't guarantee yet.
root-network anonymizes TCP traffic the same way Tor does: your connection is wrapped in layers of
encryption and routed through three independently-operated relays, so no single relay ever knows both
who you are and where you're going. It also supports hidden services — sites reachable
only by a self-certifying .root address (like Tor's .onion), with no DNS and
no central authority involved.
No central server. Relays discover each other and propagate state through gossip alone.
TLS 1.3 link encryption plus X25519 per-hop key agreement and AES-256-CTR cell encryption.
.root addresses are derived directly from an Ed25519 public key — 52 base32
characters, no registrar, no DNS.
Once a relay's signed descriptor is known, future TLS connections to it are pinned to that identity rather than blindly trusted.
This is a working prototype that has been tested end-to-end on real multi-node deployments — not a paper design. It is also not a hardened, audited anonymity network, and treating it like Tor today would be a mistake. Specifics:
The full, unvarnished writeup — including exact file/line references for every claim above — is in docs/security-model.md.
The network only works if more than one person runs a node. If you can spare a small VPS with a stable public IP, this is the single most useful thing you can do for the project.
git clone https://github.com/smokesession/root-network
cd root-network/.root\ network
cargo build --release
./target/release/root --data-dir ./data node \
--addr 0.0.0.0:8443 \
--external-addr YOUR_PUBLIC_IP:8443
--external-addr is what gets gossiped to other relays as your dial-back address — it must
be a real, reachable IP:port, not the bind address. See
docs/operator-guide.md
for exit policies, Docker Compose configs, and bootstrapping into an existing network.
.root sitesRun the client, which opens a local SOCKS5 proxy, then point a proxy-aware application at it:
./target/release/root client --socks-addr 127.0.0.1:9050
For actual browsing, use the Root Browser bundle in
browser/ — a
preconfigured Firefox profile with the proxy wired up and privacy-hardening prefs applied (remote DNS
resolution is required for .root addresses to resolve at all), plus a launcher that starts
the client and browser together.
.root site./target/release/root --data-dir ./my-site hs --target 127.0.0.1:80This derives a .root address from a persistent Ed25519 identity and publishes it into the network's directory via gossip. Want a specific prefix instead of a random-looking address?
./target/release/root --data-dir ./my-site vanity myprefix.root addresses.| What | Value |
|---|---|
| .root address length | 52 characters + .root (base32 of a raw 32-byte Ed25519 key) |
| Circuit length | 3 hops |
| Link encryption | TLS 1.3 |
| Per-hop key agreement | X25519 |
| Cell encryption | AES-256-CTR |
| Vanity address, 4-char prefix | seconds, single machine |
| Vanity address, 6-char prefix | tens of minutes, single machine |