Use Private.Ki over Tor, and the .onion address
Open our .onion address in Tor Browser and the connection stays inside the Tor network the whole way. Where to find it, and what it changes.
Tor hides your IP address and location from the sites you visit — including from our server. The way to use Private.Ki over Tor is our onion address, opened in Tor Browser: the connection stays inside the Tor network the whole way. The ordinary web address works in Tor Browser too, and both lead to the same account and the same mailbox.
Install Tor Browser, then open the onion address below — on a computer or on Android. Tor support is a browser matter: the installed Android app talks to our server directly, and Orbot's VPN mode routes the whole device through Tor if you want the app's traffic to go that way too.
privatekiypfvwvruouekg7byihvpzemh5eqdl2gt7nx5ddcjgouykid.onion
It opens over http://, not https://, and that is correct — see Why Tor Browser shows an onion, not a padlock below. The address only works in a Tor-enabled browser; it will not resolve anywhere else.
Open the onion address
- Install Tor Browser from the Tor Project's own site — not from an app store or a third-party mirror. It exists for Windows, macOS, Linux and Android. On iPhone the Tor Project points to Onion Browser, which works with Private.Ki as long as JavaScript is on.
- Connect and wait for the browser to report it is connected to the Tor network.
- Check the security level (the shield icon next to the address bar):
- Standard — everything works.
- Safer — works. An onion address is treated by the browser as a secure context, so the encryption code the app needs keeps running.
- Safest — does not work. Safest turns JavaScript off for every site, and Private.Ki does all its encryption in JavaScript. You will see a blank page. See System requirements and JavaScript.
- Type the onion address above and sign in normally. Your username, password, two-factor code and passphrase work exactly as they do elsewhere. (
https://app.privateki.netopens in Tor Browser as well, and your mail is just as encrypted there; the onion address is the one that keeps the whole route inside Tor.)
Check the address character by character the first time, then bookmark it. There is no certificate authority to catch a wrong address for you, and onion addresses are long on purpose: anyone can mint one beginning with privateki, only we hold the key to this one. The address is published on this site and nowhere else that we control.
Tor Browser will not offer you the onion address by itself; we do not advertise it from the ordinary site. Type it or use the bookmark.
If you use NoScript's per-site controls at a higher level, allow scripts for the onion host — and, at the ordinary address, for app.privateki.net and api.privateki.net, which the app talks to.
The Tor circuit itself is the encrypted transport, end to end, between your browser and our server, so no certificate authority is involved — there is no name for one to validate, and none is wanted. Tor Browser shows an onion icon in the address bar instead of a padlock. Everything the app does on top of that — your mail and chats — is encrypted exactly as it is everywhere else.
The app finds its own API on the same onion address automatically; there is nothing to configure, and no second address to remember.
What behaves differently over Tor
It is slower. Tor adds several hops. The initial load, the sign-in handshake and the burst of requests that follows unlocking all take longer. Large attachments take noticeably longer. This is the cost of the anonymity, not a fault.
You may hit a rate limit, and it works differently on each door. At the ordinary address our server limits requests per IP address, and a Tor exit node's address is shared by everyone using it at that moment — so on a busy exit node, sign-up, the live username check, password recovery, device pairing and the sign-in handshake can hit the limit even though you have made only one request. On the onion address there is no visitor address at all, so the limits are counted per Tor circuit instead, which is roughly per browser session; the allowances there are smaller than at the ordinary address, because a circuit is cheap to replace. Either way the app shows Too many requests. Wait a minute or two, or request a new circuit for the site (the circuit icon in the address bar → New Tor circuit for this site). See Rate limits.
Signing up over the onion is by invitation. Creating a new account at the onion address needs an invitation link. Signing in to an account you already have is unaffected, and the ordinary address is unchanged. Sign-up also asks your browser to solve a small proof-of-work puzzle — not Tor-specific, every browser does it, but it takes a little longer on a slow machine. There are no image CAPTCHAs. See Proof of work instead of CAPTCHA.
Real-time updates can pause. The app keeps a WebSocket open for new mail and chat. When a Tor circuit changes, that connection drops and reconnects a few seconds later. If it stays down for 15 seconds you see the Connection lost banner; if it stays down for 30 minutes the app locks itself. See Offline, reconnecting and the 30-minute auto-lock.
"New Identity" signs you out. Tor Browser's New Identity clears all site data. You will need to sign in again — and with Password only unlock, unlock again by signing in; with a passphrase, type it again.
What Tor adds — and what it does not
Your messages are end-to-end encrypted whether or not you use Tor. Tor changes what an observer can learn about the connection:
- Without Tor, our server sees your IP address for the duration of the connection — it does not log it — and your ISP or network can see that you connected to
app.privateki.net. - With Tor at the ordinary address, our server sees a Tor exit node's address, and your network sees only that you are using Tor.
- At the onion address, there is no exit node, no public DNS lookup and no certificate authority involved at all. Our server never sees an address of yours, only a short-lived identifier for the circuit, and the connection never leaves the Tor network.
Tor does not make a weak password strong, does not protect a passphrase you reuse, and does not hide your username from us — we need that to route your mail. If you use Private.Ki under a pseudonym, do not sign in to accounts that identify you in the same Tor Browser session.
Nor does the onion address change what we store or what we could be compelled to hand over. It changes how you arrive, and nothing else.
What our server sees
Cannot see
- Your real IP address or location — at the ordinary address only the exit node's, which is not logged either; at the onion address, nothing of the kind exists
- Your mail or chats — same as always
- A web access log for the onion front door — it is switched off there; the application's own records are unchanged
Can see
- Your username, when you sign in, and what you do in the app (send, fetch, pair a device) — the same as without Tor
- That the connection arrived over Tor, since the door tells us which one you used; we do not treat it differently
Common questions
Is the onion address safer than the ordinary one?
Safer about the connection, identical about everything else. Your traffic never leaves the Tor network, there is no DNS lookup and no certificate authority in the path, and no address of yours reaches us. What we store about your account is exactly the same either way.
How do I know the address is genuine?
By reading it. There is no authority to ask, so the address itself is the identity: compare it character by character with the one on this page the first time, then use a bookmark. A site that looks like Private.Ki at a different onion address is not Private.Ki.
Can I use Tor on my phone?
Yes, through a browser: Tor Browser for Android, or Onion Browser on iOS, opened at the onion address. The installed Android app talks to our server directly; to send its traffic through Tor as well, use Orbot in VPN mode, which routes the whole device.
Sign-in keeps failing with no error
Most often a rate-limited exit node or a circuit that changed mid-handshake. Request a new circuit for the site and try again. If you see Too many requests, wait a minute first.
Should I use Tor or a VPN?
Tor for anonymity from everyone including us; a VPN for hiding your connection from your local network at higher speed, while trusting the VPN provider. See Use Private.Ki with a VPN.