Chrome-style handshakes, real-site cover and TCP plus QUIC in one self-hosted privacy tool. Run both endpoints with one binary, connect your apps through local SOCKS5, and skip buying a dedicated domain or renewing your own CA certificate for the entry point.
MIT open source. Self-hosted. Alpha software.
Built for your own deployment
Umbra brings cover mechanisms, performance engineering and self-hosting together. Explore ten reasons to choose the current alpha, with implementation details and conditions in the protocol guide and documentation.
Unauthenticated requests go to your configured real TLS destination, receiving a real-site response instead of a proxy-specific rejection. Cover is part of the connection entry point.
Bring connection handshakes closer to a real browser and reduce distinctive custom-proxy handshake features. Real Chrome captures guide verification, starting where every connection begins.
No dedicated domain or CA certificate to obtain and renew for the Umbra entry point. Configure identity keys and a reachable cover destination, and spend less effort on certificate upkeep.
Eligible inner TLS traffic can switch to raw forwarding, reducing repeated outer framing and encryption work while retaining application HTTPS. The benefit depends on the traffic and network path.
Adaptive mux adjusts windows using actual consumption and RTT, then schedules ready streams. Shared connections can support concurrent requests and long-distance transfers within explicit memory budgets.
Supported hardware accelerates cryptographic operations automatically. Reused TLS cipher contexts and buffers reduce repeated setup and allocation, while batched QUIC receives reduce per-packet work.
Choose outer transports separately for TCP and UDP application traffic. Try another path without rebuilding your deployment; QUIC offers BBR, Cubic and NewReno controller options.
X25519, ML-KEM and ML-DSA primitives sit alongside constant-time verification and secret zeroization. Hybrid key exchange and certificate binding give the security design concrete, inspectable mechanisms.
Optional numeric diagnostics reveal transport activity, window pressure and resource budgets without recording destination addresses, credentials or application content.
Run the client and server from the same program and connect compatible apps through local SOCKS5. MIT-licensed source lets you build and self-host, with identity settings and servers under your control.
From installation to your first connection
Download and install a matching release asset, or optionally build from source below. Generate keys, configure the server and CLI client, then point your apps to the local SOCKS5 listener on loopback.
git clone https://github.com/lotosli/umbra.gitcd umbracargo build --release./target/release/umbra keygenDocumentation
Install both endpoints, choose your transport settings, and compare options before committing to a deployment.
One binary, both endpoints. Self-hosted from day one.
Get started