v1.0.2 · Production Hardened

Browser Attestation
Reimagined

ChronoSeal is a Unix-native browser attestation daemon combining cryptographic signatures, deterministic state machines, and a synthetic gene mutation engine for unparalleled session integrity.

Get Started View on GitHub

100

Tests Passing

Storage Backends

VM Opcodes

30s

Max Drift

Core Features

Everything you need for robust, enterprise-grade browser attestation

Synthetic Gene Engine

Deterministic mutation sequence that both server and browser WASM must execute in sync—creating an unprecedented second state channel.

Mutation Rounds Gene Size 512-4096

Cryptographic Chain

Ed25519 signatures and a Blake3 hash chain progression with rotating salts ensures replay resistance and continuity verification.

Ed25519 Blake3

Deterministic VM

A lightweight 10-opcode virtual machine executing server-issued programs with exact stack state verification between client and server.

Stack Verification Custom Instruction Set

Silent Rejection

Failed heartbeats return identical HTTP 200 responses—providing zero oracle feedback and making automated probing impossible.

No Oracle Security First

Pluggable Storage

Use SQLite in-memory for testing, SQLite disk for standalone, or Valkey/Redis for massive distributed cluster deployments.

SQLite Valkey/Redis

Production Ready

Built-in Prometheus metrics, liveness/readiness probes, structured logging, systemd integration, and graceful shutdown.

Prometheus Observability

System Architecture

A look inside how ChronoSeal protects your sessions in real-time

Read Architecture Docs

Protocol Flow

Secure handshake and continuous background verification

Sequence Flow Diagram

┌─────────────┐                                    ┌─────────────┐
│   Browser   │                                    │   Server    │
│   (WASM)    │                                    │ (ChronoSeal)│
└──────┬──────┘                                    └──────┬──────┘
       │                                                  │
       │ POST /init { public_key }                        │
       │─────────────────────────────────────────────────>│
       │                                                  │
       │ 200 { session_id, salt, opcodes,                 │
       │       initial_hash, mutation_order }             │
       │<─────────────────────────────────────────────────│
       │                                                  │
       │ [Execute VM, Preview Mutation]                   │
       │                                                  │
       │ POST /hb { prev_hash, timestamp, entropy,        │
       │          stack_state, gene_commitment,           │
       │          signature }                             │
       │─────────────────────────────────────────────────>│
       │                                                  │
       │ [Verify: Signature → Hash → Mutation → Drift]    │
       │                                                  │
       │ 200 { status: "ok", next_salt,                   │
       │      next_mutation_step, next_order }            │
       │<─────────────────────────────────────────────────│
       │                                                  │
       │ [Commit Preview, Rotate State]                   │
       │                                                  │
       ▼                                                  ▼

Read Protocol Docs

vs Popular Solutions

Why modern privacy-conscious teams choose ChronoSeal

Feature	ChronoSeal	Cloudflare Turnstile	reCAPTCHA v3	Enterprise WAFs
Self-hosted & Air-gapped	Yes	No	No	No
Privacy Focused	Excellent	Medium	Poor	Low
Cryptographic Continuity	Very High	Medium	Low	Medium
Cost Structure	Free (FOSS)	Freemium	Free → Paid	Extremely High
WASM Mutation Engine	Unique	No	No	No
Silent Rejection Architecture	Yes	No	No	No

Detailed Comparison

Quick Deployment

Spin up the daemon in under a minute

Docker

docker run -d -p 3000:3000 \
  chronoseal/chronoseal:latest

Docker Compose

bash scripts/build.sh
docker compose up -d --build

Native (systemd)

curl -sL https://chronoseal.io/install.sh | sudo bash
sudo systemctl enable --now chronoseal

From Source

git clone https://github.com/thakares/chronoseal-rs
cd chronoseal && cargo run --release

Nginx Proxy

location / {
  proxy_pass http://127.0.0.1:3000;
  proxy_http_version 1.1;
}

Verification

# Check daemon health status
curl http://localhost:3000/health

# Query daemon CLI metrics
chronoseal status --format json

Browser AttestationReimagined