Fastest / Secure — policy preference only. Connection not established.
IP IDENTITY / WHAT THE INTERNET SEES
Your network details
Browser public IPv4 optional checkNot checked
Browser public IPv6 optional checkNot checked
VPN exit IPNot connected
Assigned tunnel IP / maskUnavailable
VPN DNSUnverified
Active VPN protocolNone
No public-IP lookup is active. This engineering preview will not contact external IP-checking services. CPX-owned observers and native VPN leak validation are not yet deployed.
Screen masking only hides an address on this display. It does not hide your real IP from websites. A working, independently verified VPN is needed to change network egress.
IP and subnet mask calculator ⌄
Calculates locally. No address is sent anywhere.
Connection readiness
01Install native GHOSTvpnAndroid engineering client exists as source; signed distribution and other platforms are not ready.
02Enroll an authorized gatewayImport a valid full-tunnel profile from infrastructure you own or are authorized to operate.
03Verify before trustingConfirm handshake, IPv4/IPv6 and DNS egress, operating-system lockdown, and leak tests on the actual device.
◈ENGINEERING PREVIEW Interactive scenarios below are illustrative. No live VPN, post-quantum key exchange, obfuscation, or gateway routing is active.
01 / PROTECTION ARCHITECTURE
Two modes. One standard.
Protection never silently downgrades when a security requirement fails.
◈
Secure · low-latency design
Authenticated tunnels, controlled DNS and dual-stack egress must be verified before protected status is available.
NOT DEPLOYED
03 / EXPERIENCE PROFILES
Built around your world.
Profiles define security and routing intentions. They do not activate a VPN from the browser.
◇
Velocity · design profile
Minimize latency without weakening mandatory protections.
PROFILE NOT APPLIED
04 / ADAPTIVE INTELLIGENCE
Precision, without compromise.
Performance-aware policies with explicit overhead tradeoffs. No benchmark numbers are fabricated.
GHOST ROUTEIQ / POLICY LAB
Design the decision boundary.
LOCAL DEMO
LOW LATENCYSTRONGER ROUTE OPTIONS
Session-level route diversity
Only among independently verified, equally secure eligible routes; no packet-level randomization.
Adaptive traffic-analysis resistance
Future reviewed transport shaping. Padding can increase bandwidth, latency and battery consumption.
Fail-closed enforcement
Never lower required PQC or hop assurances to satisfy a speed target.
REQUIRED · LOCKED
Design preview only. No packet-routing or cryptographic behavior changes are applied.
GHOST INTELLIGENCE / TELEMETRY
Nothing invented.
Live tunnelOFFLINE
Speed measurementNOT AVAILABLE
Exit IP / DNSNOT VERIFIED
Hybrid ML-KEMNOT NEGOTIATED
Traffic maskingNOT DEPLOYED
Visual signal motif only. No measurement or traffic sampling is performed.
06 / NETWORK PROTECTION CENTER
Everything in plain sight.
One place for the capabilities people expect. The status on every card is honest: these are not active VPN protections yet.
Security and connectivityPROTOTYPE / ROADMAP · 0 SERVICES ENABLED
⬡
Kill switch & always-on
Prevent exposure when a real tunnel drops; needs native OS enforcement and disconnect testing.
NOT VERIFIED▦
Split tunneling
Choose apps or CIDR routes that bypass or require a tunnel—only after privilege and leak review.
NOT AVAILABLE◈
Ads, malware & tracker filtering
Privacy-first DNS filtering with readable policies, allowlists and false-positive controls.
NOT AVAILABLE✧
GHOSTmode / multi-hop
Independent gateways and reviewed hybrid ML-KEM with verified route integrity.
NOT IMPLEMENTED↗
Fastest server & smart protocol
Latency-aware, fail-closed choices across verified WireGuard and OpenVPN gateways.
POLICY ONLY◇
Obfuscation & restricted networks
Reviewed compatible transports, without promising evasion on every network.
NOT VERIFIED◉
Dedicated IP & private devices
Owned or assigned IPs, peer-to-peer device access and customer-controlled gateways.
NOT AVAILABLE⌁
Onion routing & specialty paths
Tor and special routing must disclose privacy, anonymity, and performance limitations.
NOT AVAILABLE▣
Auto-connect & trusted networks
Per-network preferences, explicit consent, secure startup, and verified lockdown.
NOT AVAILABLE
Security decisions stay in the operating system and approved gateway—not in a browser mockup. No advertising, malware, or traffic data is inspected by this page.
GHOST HORIZON / MULTI-HOP RESEARCH
Go deeper. Prove it first.
Explore 13–64 hypothetical relay stages without launching a connection. More hops do not automatically improve anonymity; they can amplify outages, latency and fingerprinting risk.
NO LIVE LONG-CHAIN NETWORK
Assumptions for illustration only: +20 ms per stage, 99% availability at each independent stage. Actual network data is unavailable.
These are the safeguards required for a real connection. Nothing on this preview can enforce device routing, stop DNS leaks, or defeat global traffic correlation.
LIVE PROTECTION / UNVERIFIED
01Dual-stack route lock
Exact IPv4/IPv6 default routes required in the engineering client; OS lockdown is still unverified.
CONFIG POLICY ONLY02DNS containment
Both IP families require numeric tunnel DNS resolvers; independent DNS egress still needs measurement.
NETWORK PROOF MISSING03Adaptive safe handoff
Hold a healthy route. On failure, stage only an authorized replacement under lockdown—never fall back to cleartext.
PLANNER ONLY04Traffic-correlation defense
Measured trace analysis and bounded shaping research; no claim of defeating a global observer or eliminating metadata.
RESEARCH NOT DEPLOYED
NO BACKGROUND ROUTE HOPPINGNO UNSIGNED EGRESS CLAIMSNO UNDERLAY DNS EXCEPTIONSLOCKDOWN REQUIRED BEFORE LIVE USE
06 / GHOST SENTINEL
Trust. Demonstrated.
A two-witness, cryptographic evidence architecture for future native protection. No connection or independent network proof is currently available.
ENFORCEMENT / NOT DEPLOYED
G
01NATIVE DEVICE
Signed tunnel, handshake, routing and kernel lockdown witness
NO WITNESS02EXTERNAL EGRESS
Independently pinned signature for IPv4, IPv6, DNS and exit evidence
NO WITNESS03ANTI-REPLAY
Session, policy digest, sequence and 30-second expiry verification
SOURCE VALIDATION ONLY04PQC / TRUST CHAIN
Standards-based hybrid ML-KEM and independent operators required for GHOSTmode
NOT IMPLEMENTED
05 / EVIDENCE STANDARD
Trust must be earned.
A cryptographic specification is not proof that the application is safely deployed.
CURRENT RELEASE STATUS
00/ 10
Secure · BLOCKED
No real device, tunnel, routing or leak-test attestation is connected to this browser preview.
GHOSTmode's proposed hybrid ML-KEM key establishment must be implemented with a reviewed library and independently proven on both endpoints. A static WireGuard pre-shared key does not, by itself, establish a verified PQC tunnel. Multi-hop, padding and network randomization can reduce performance; GHOST cannot guarantee zero overhead.
