Community data that survives
its infrastructure.
A platform with zero application servers. A static bundle boots browser peers into a self-repairing storage-and-compute swarm. The archive outlives the maintainer losing interest, the bucket bill lapsing, or a platform pulling the plug — because the community's own machines carry it, verify it, and rebuild it from any surviving quorum.
Persistence is a process, not a place.
There is no server to trust, bribe, subpoena, or switch off. Data lives as a signed, append-only log spread across the browsers of the people who care about it — sliced with Reed-Solomon erasure coding so any 8 of 20 fragments rebuild the whole, and continuously repaired as peers come and go.
Erasure-coded storage
Every sealed batch splits into 20 fragments; any 8 reconstruct it. A repair loop watches for deficits and rebuilds — survives 60% hourly peer churn for 48 hours with zero data loss in the chaos tests.
Verifiable compute
Jobs are deterministic WASM with no clock, randomness, or network — the runtime denies those imports outright. Independently elected workers run each job; a hash majority is the verdict, and a lying worker is caught every time.
Keys, not accounts
Your identity is an Ed25519 keypair generated in your browser. Nothing is registered anywhere. Everything is signed and content-addressed, so any peer can serve any data and you can still verify it.
How a byte survives
No coordinator decides any of this. Every peer independently derives the same answer from gossip alone — placement, deficits, who repairs next.
You post; it's signed and content-addressed
The event's ID is the hash of its bytes. No forgery, no silent edit, no impersonation without your key.
It gossips to the mesh
Peers connect over WebRTC. Your own events take a short private "stem" path before flooding, so the first relay usually isn't the author — presence is blurred by design.
It's sealed, compressed, and erasure-coded
Batches seal into content-addressed segments, split into 20 fragments, and land on the peers a shared hash function points to. No directory, no DHT.
The repair loop keeps it alive
As peers vanish, the lowest-hashed online holder rebuilds missing fragments from any 8 and re-spreads them. Bandwidth-budgeted, worst deficits first.
Anything can rebuild it from a quorum
Cold archive on any static host, a single returning peer, or one exported file re-seeds a dormant swarm. Loss requires zero copies anywhere.
Don't trust us. Know exactly what's guaranteed.
Every predecessor died partly from overclaiming. So here is the whole security story, enumerated — what holds even if every operator is malicious, what's a matter of odds, and what simply isn't protected. The honesty is the point.
Tier 1 Cryptographically guaranteed
Holds even if every operator is malicious.
- Authenticity — Ed25519 signatures + content addressing. No forgery, no history rewrite.
- Integrity — Merkle proofs; a malicious peer cannot serve altered data undetected.
- Private messages — sealed-box ciphertext; carriers provably cannot read what they store and repair.
- Compute correctness — hash majority across independently elected workers.
Tier 2 Probabilistically guaranteed
Stated odds, stated model.
- Durability — vanishingly small loss probability per repair window — conditional on the community staying above minimum viable size. Abandoned communities lose data; the archive lives exactly as long as anyone cares.
- Availability — a function of how many always-on peers volunteer. Three carries the night.
- Spam / Sybil resistance — capped weights + storage audits raise attack cost; they don't make attacks impossible.
Tier 3 Explicitly not guaranteed
Named, not hidden.
- IP privacy — connected peers see your IP unless you run relay-only mode. WebRTC exposes it by nature.
- Message metadata — content and participants are hidden; that a message exists, and when, is public.
- Global traffic analysis — a nation-state watching every vantage point defeats the anonymity measures. That needs a mixnet, which this isn't.
- The bundle — whoever writes the bucket ships the code you run. Signed releases + mirrors + reproducible builds shrink this; a compromised release key defeats it until rotated.
An app is a folder you upload
An app is nothing but event schemas, fold rules, and a UI. It shares the swarm with every other app — peers store and repair data for apps they don't even run. No registration, no gatekeeper, no platform code to touch.
Forum ● live
Threads, votes, first-claim names, moderation that hides rather than deletes an append-only log. The reference app.
Search ● live
Full-text search with no index server: sealed segments trigger index-build jobs, queries scatter to shard holders, ranking runs in your browser.
Private messages ● live
End-to-end encrypted DMs the swarm repairs without reading. No recipient field ever — routing is a derived tag, so observers can't map who talks to whom.
Wiki, and whatever's next ○ template
The latest-accepted-revision app is ~120 lines. Package registries, group chat, community archives — same substrate, no new plumbing.
A graveyard taught us this
Freenet, GNUnet, ZeroNet, Secure Scuttlebutt, Beaker, browser IPFS — the right idea, over and over, and every one died or grew servers. Scuttlebutt is the instructive one: correct architecture, real community, killed by storage bloat, no partial replication, and brutal onboarding.
nohost is Scuttlebutt plus erasure coding plus the browser APIs that didn't exist in 2014 — persistent storage, Web Locks, WebRTC, WebAuthn, WebGPU. The repair loop fixes what killed it: partial replication and per-peer storage cost. What it doesn't fix, it writes down.
The niche is survival, not performance.
A $5 VPS beats this on every axis except one: it can be shut off, billed, deplatformed, or abandoned. nohost is for community data that needs to outlive its infrastructure. That's a real need — and none of the graveyard delivered it.