// a whisper, not a question

Ask the list.
Keep the question.

Mainnet live checking… Status: Ticker (placeholder, no token exists):
Ask quietly How it works
// the reading room

Whisper a prefix. Read the drawer yourself.

Everything that touches the full address happens in this tab. The only request the lookup makes is GET /api/range/<5 hex> — plus optional cover requests for random drawers, so the server can't even tell which drawer was yours.

1Ask about an address

Public addresses only. Askquiet never needs a seed phrase or private key — never paste one anywhere.

Loading list information…

2What happened

  • Address checked locally
  • SHA-256 computed in your browser
  • Prefix whispered to the server
  • Drawer returned and compared locally
Ask about an address to see its hash, the request that was sent and the drawer that came back.

3What the server learned

Every request this page has made since it loaded, exactly as sent. Nothing else leaves the tab.

prefixes sent
0
for your last question
drawer size
—
entries returned per drawer
your share
—
of all addresses share your drawer
No requests yet.
real prefix (only this tab knows which)cover prefixreveals the full address

4Optional: read it on mainnet

See the address's live balance, owner program and last activity, read from Solana mainnet through this site's read-only proxy.

This step gives up the secret. It sends the full address to this server's RPC proxy and on to the upstream RPC provider. Anyone watching both requests from your IP can link it to your quiet question. Leave it alone if the question itself is what you want to keep private.
// how it works

Four quiet steps

  1. The list is stored as hashes. The operator loads a JSON file of SHA-256(address) values. The server files each hash in a "drawer" named by its first 5 hex characters — 165 = 1,048,576 drawers in all.
  2. Your browser hashes the address. Web Crypto computes SHA-256 of the base58 address text. The first 5 hex characters (20 of the 256 bits) name a drawer; the other 59 characters stay in the tab.
  3. Only the drawer name is asked for. GET /api/range/3fa1c returns every listed suffix in that drawer, topped up with stable decoy suffixes to a fixed size and sorted, so a drawer holding a listed entry looks just like an empty one. Optional cover requests ask for other drawers at the same time.
  4. The match happens here. The page looks for its own 59-character suffix among the returned cards. The server never finds out whether there was a match, because the answer is worked out after the response has left it.
// privacy model

What the server hears, and what it doesn't

Stays in your tab

  • The address you asked about
  • The full hash and its 59-character suffix
  • Whether it was on the list — the comparison is local
  • With cover requests: which of the prefixes was the real one

Reaches the server

  • A 5-hex prefix (20 bits) per question, plus any cover prefixes
  • Your IP address, timing and browser headers — like any web request
  • The full address, if you press "Read on mainnet" (and the upstream RPC sees it too)
  • The live slot check on page load (contains no address)

Askquiet reduces what you disclose when you check a list. It does not make you anonymous: the server still sees who is asking and roughly when.

Known limitations — please read

  • The shipped list is synthetic. It holds 4,096 hashes of randomly generated addresses so you can see hits and misses. A hit means nothing about any real person or account. This is a privacy demo, not a screening or compliance tool.
  • 20 bits is a hint, not nothing. If the server already suspects a few specific addresses, it can check which of them fall in the drawer you asked for. Cover requests make this weaker, not impossible.
  • Cover only holds within one page load. Cover prefixes are stable for the same address until you reload. If you ask about the same address again after reloading, the server could compare both sets and find the one prefix they share.
  • The list is not secret. Anyone can ask for all 1,048,576 drawers and test any address they already know against them. k-anonymity hides your question, not the list.
  • You trust the operator for the answer. The server could leave an entry out or add one. The list fingerprint shown above lets you notice if the list changes, but cannot prove it is complete or correct.
  • Decoys reset on restart unless configured. Without a DECOY_SECRET, decoys change when the server restarts, so comparing drawers before and after a restart shows which entries are real. That exposes the list, not your questions.
  • Network metadata is visible. Your IP, timing and the number of questions you ask reach the server. Use a network you trust, or a VPN/Tor, if that matters to you.
  • Experimental and unaudited. The server code keeps no query log, but you cannot verify what a hosted copy runs. Nothing is stored about your questions — only 10-second rate-limit counters per IP.
  • No token. The ticker shown is a placeholder label; no token exists.