No central server
Peers connect directly over a mesh — there is no gateway or exit server to route through. No chokepoint, no single point of failure, and no operator sitting in your traffic path.
Beta test open
Privacy-First. Open-Source. Future-Proof.
QuantumLink is the first PQC-native mesh VPN with on-chain identity. Each node registers its ML-DSA/ML-KEM identity on the Dytallix blockchain for persistent reputation, Sybil resistance, and decentralized discovery while all encrypted traffic stays pure peer-to-peer off-chain.
Why QuantumLink
A new VPN for a new era.
QuantumLink starts from the premise that YOU own YOUR data. With identity verified via blockchain, no data tracked means no data hacked. We open source our PQC primitives so all our claims can be independently verified. With PQC crypto-agility baked in from the start, you don’t have to worry about future cryptographic failures.
No accounts, no logs
Nothing to sign up for and nothing to record. Your identity is a keypair you generate locally, so there is no user database to leak and no connection history to subpoena.
Decentralized on-chain identity
Each node anchors its public ML-DSA identity on the Dytallix blockchain for Sybil-resistant, tamper-evident peer discovery — with no central directory to trust or take down.
Post-quantum, end-to-end
ML-KEM key exchange and ML-DSA authentication protect the whole stack, not just the tunnel handshake. Traffic captured today stays confidential against tomorrow's quantum computers.
Open and verifiable
The protocol is public and every release is reproducible from source with matching SLSA provenance. You can verify the binary byte-for-byte instead of taking our word for it.
Crypto-agility built in
Cryptographic primitives are modular and versioned, so QuantumLink can roll to new standards the moment they land. Your protection is never pinned to a single algorithm that might break later.
How it works
Identity on-chain, traffic off-chain.
Here is exactly what happens when you connect — and what does and does not touch the blockchain. The chain only ever holds your public identity; every byte of your traffic stays peer-to-peer.
Your identity is a key, not an account
On first launch the client generates a post-quantum keypair (ML-KEM + ML-DSA) in a hardware-protected keystore. That keypair is your identity — no email, no password, no signup. The private key never leaves your device.
Only the public identity is anchored
The public half of your key is published to the Dytallix blockchain so any peer can find and verify you. This replaces the central directory a normal VPN runs and makes identities tamper-evident and Sybil-resistant. Your traffic never touches the chain.
A post-quantum tunnel is negotiated
To connect, both sides run an ML-KEM handshake to agree on a fresh session key and authenticate each other against their on-chain ML-DSA identities. The encrypted tunnel comes up in under two seconds.
Traffic flows directly between peers
Your DNS, IPv4, and IPv6 traffic moves directly between you and the peer over the mesh — no gateway, no operator, no blockchain in the data path. A kill-switch blocks leaks if the link drops.
Tech stack
What’s under the hood.
QuantumLink is built on primitives that have been through public standardization, not vendor-proprietary stacks. Every layer is designed so you do not have to trust this website — you can verify it.
Post-Quantum Key Exchange
Every session secret is negotiated with NIST-standardized ML-KEM instead of classical Diffie-Hellman or ECDH, closing the harvest-now-decrypt-later window.
Signatures & Identity
ML-DSA authenticates peers and signs the public identity that gets anchored on-chain — quantum-resistant proof of who you are connecting to.
Symmetric Data Path
The tunnel payload is encrypted and authenticated with a fast AEAD cipher that runs well even on devices without AES hardware acceleration.
On-Chain Identity Anchoring
Public identities are registered on the Dytallix blockchain for decentralized, Sybil-resistant, tamper-evident discovery. No traffic, metadata, or private keys ever touch the chain.
Mesh Transport
Direct authenticated tunnels with NAT traversal and a leak-blocking kill-switch. No central gateway routes or sees your packets.
Reproducible Builds
Every release ships with matching SLSA provenance and signed artifacts. Rebuild from source and verify the hash byte-for-byte — keys stay in a local hardware-protected keystore.
Who it’s for
Built for people who can’t take chances.
Journalists & sources
Keep sensitive conversations confidential against harvest-now-decrypt-later, and connect without an account that ties your identity to a provider.
Developers & security teams
Build a direct, authenticated mesh between your machines and environments. Reproducible, open builds let you audit exactly what you are running.
Remote & distributed teams
Link teammates peer-to-peer with no central gateway to route through, no per-seat licensing, and no operator who can see your traffic.
Privacy-conscious individuals
Own your data by default. No accounts, no logs, no email — your identity is a key that never leaves your device.
Researchers & auditors
Inspect post-quantum primitives in a real, shipping client. Verify build provenance and on-chain identity anchoring end to end.
High-surveillance environments
Decentralized, Sybil-resistant discovery means there is no central directory to block, seize, or subpoena.
Platforms
Pick your build.
Each build is signed and reproducible from source. Hashes are published alongside the artifact and validated against the build pipeline.
macOSComing Soon
macOS 12 Monterey or newer. Apple silicon and Intel.
Releases August 1, 2026
Notify me →WindowsComing Soon
Windows 10 build 1903+ or Windows 11.
Releases October 1, 2026
Notify me →SteamOSComing Soon
SteamOS 3.5+ for Steam Deck and compatible handhelds.
Releases December 1, 2026
Notify me →Download
Join the Beta Today
Grab the beta for your platform. No account, no email, no payment. If you are willing, leave us a bug report on your way out.
FAQ
Questions we get a lot.
Is my traffic stored on the blockchain?
No. Only your public identity is anchored on-chain. Your traffic, the peers you connect to, and your private keys never touch it — everything moves peer-to-peer and off-chain.
Do I need an account or email?
No. Your identity is a keypair generated on your device. There is no signup, no email, no password, and no central user database that could ever leak.
What does “post-quantum” actually protect me from?
Harvest-now, decrypt-later. Encrypted traffic recorded today cannot be unlocked by a future quantum computer, because key exchange uses NIST-standardized ML-KEM instead of the classical algorithms a quantum attacker could break.
What happens when today's encryption is eventually broken?
QuantumLink is built with crypto-agility — its primitives are modular and versioned, so it can adopt new standards without re-architecting. Your protection is never pinned to a single algorithm.
Can I verify these claims myself?
Yes. The PQC primitives and client are open source, and every release is reproducible with signed provenance. Rebuild from source and check the hash byte-for-byte — you don't have to take our word for it.
What does the blockchain actually do?
It replaces the central directory a normal VPN runs: a tamper-evident, Sybil-resistant place for peers to find and verify each other. No wallet, no token, no payment — just your public identity anchor.
Which platforms can I run it on?
macOS lands first in August 2026, followed by Windows in October and SteamOS in December. Each build is signed and reproducible from source.
Report a bug
Found something? Let us know.
You may hit a rough edge or two. Telling us what went wrong is the fastest way to help us fix it.