Straight to the provider
203.0.113.7 eth_getBalance(0x7a3f…c21e)
Your address, next to your IP. Every read, every day.
ETHGlobal Mumbai What Opaque built, live today
Post-quantum. And unseen.
A post-quantum security layer for Ethereum, more than a wallet. Pay, receive, hold a name and swap, every move signed by FORS+C: hash-based keys with no known quantum attack. Protect what you already have, too: any protocol's admin keys, any Uniswap position, any MetaMask wallet. Read the chain through the Ethereum Foundation's anon-rpc, so nobody sees who asks, and leave any pool without a single server of ours. Each one works now, on Sepolia and on Ethereum's EIP-8141 devnet.
Opaque Unseen · EF's anon-rpc · Live on Sepolia
Nobody sees who's asking.
Every wallet reads the chain, and every read hands an RPC provider your IP beside your address. Opaque Unseen sends your wallet's reads and transactions through the Ethereum Foundation's anon-rpc and the Nox mixnet. The chain answers. Nobody learns who asked. Not even us.
Your request is the orange one. By the exit, it looks like everyone else's.
One balance check, three ways
What your RPC sees.
Through Opaque's relays
opaque-exit eth_getBalance(0x7a3f…c21e)
Your IP is hidden, but every relay is ours: one operator to trust.
Through EF's anon-rpc
nox-exit eth_getBalance(0x7a3f…c21e)
A mixnet anyone can run. Nobody in the path knows it was you.
How a read leaves your browser
Four steps. None of them trust us.
The code is pinned on chain.
The wallet reads the Nox worker's bundle hash from its IWorkerSpecifier contract and runs only bytes that match it. Nobody can quietly swap the code.
It runs where it can't see you.
A Web Worker inside a sandboxed, null-origin iframe. It can't reach the page, its storage, or your keys. All it gets is the request.
Wrapped in layers, mixed on the way.
Each request becomes Sphinx packets. Each Nox node peels one layer, waits, and passes it on among everyone else's. TLS to the RPC runs inside the worker, so the exit relays bytes it can't read.
The chain answers the mixnet.
Balances, your key's state, and your account's operations to the public bundler: all answered, none tied to you. That's about a second a read.
What goes through it
Names, your account, your way out.
ENS names
Pay alice.opaque.eth: the lookup on ENSv2's UniversalResolver goes through Nox, so no provider learns who you're about to pay.
Your whole account
Turn on Unseen in Privacy. Balances, key state, nonces and every UserOperation then reach a public RPC and bundler through the mixnet, with nothing of Opaque's in the path.
0 of this wallet's reads and operations answered through anon-rpc
Your way out
If Opaque's servers ever stop or refuse you, your notes still leave their pools, signed by your own post-quantum key, with every call through Nox.
0servers of Opaque's in the path of a read
0mixnet hops, each one peeling a layer
0 sa read, once the worker is up (4.5 s the first time)
0switch, in the wallet's Privacy view
Receive · Live on Sepolia
Paid at an address nobody can trace to you.
Post-quantum stealth addresses. Your wallet publishes one ML-KEM-768 key in Ethereum's stealth-address registry (ERC-6538). Each payer uses it to make a fresh one-time address that only your key can find, and announces it on ERC-5564's Announcer. Your wallet spots its own and sweeps them into your notes.
- 1,184-byte ML-KEM-768 key, in the standard registry
- 1,088-byte ciphertext per payment, on the standard Announcer
- Today's stealth addresses (secp256k1) can be linked by a quantum computer reading old announcements. These can't.
0found by your key, swept into your notes
How a post-quantum stealth payment works
From Alice's key to Alice's notes, in five steps.
secp256k1 stealth addresses · ERC-5564 scheme 1
A quantum computer reading old announcements recomputes every shared secret, and links each payment to its recipient.
ML-KEM-768 · this scheme
It can't. ML-KEM has no known quantum attack, so the announcements stay sealed, old ones included.
Until Alice sweeps, Bob also holds the one-time account's keys: hash-based keys can't be tweaked the way elliptic-curve ones can. Her wallet sweeps as soon as the payment lands.
Names · ENSv2 · Live on Sepolia
A name no quantum computer can take.
opaque.eth is held by PQNameController, the sole holder of every role on the name, and it acts only on a FORS+C signature. Under it, yourname.opaque.eth can be claimed only by a post-quantum account. ENSv2's own UniversalResolver walks the tree and returns that account, so paying a name pays a key a quantum computer can't take.
- Every write is signed with FORS+C: the target, the exact calldata and a deadline, at the key's use count in PQKeyRegistry, so each signature works once. ECDSA writes revert, the original owner's
setResolverincluded - Subnames for PQ accounts only: OpaqueNames, opaque.eth's subregistry, checks the claimant's code hash. One name per account, and
release()frees it - Rotation built in: a key signs up to 32 times, then the registry hands the name to the key committed next
- Claiming a name publishes your stealth key in the same signature, so payments to it land at one-time addresses. Lookups go through anon-rpc
Swap · Uniswap v4 hook · EIP-8141 devnet
A pool only post-quantum accounts can trade in.
PQPoolHook is a Uniswap v4 hook that admits only accounts whose one authority is a FORS+C key. It checks every swap, every liquidity change and every donation, so a cracked ECDSA key can't touch the pool, and a position moved to an ECDSA wallet freezes instead of leaving. It's live on Ethereum's EIP-8141 devnet, where accounts validate themselves: no bundler, no paymaster.
- 0.001 ETH → 1.974316 pqUSD: a post-quantum account's swap in the pool, exactly the quote. See the swap
- The same swap from an ECDSA wallet, through the same router, reverts with the hook's
NotPostQuantum - One FORS-signed transaction, four frames: deploy the hook, admit the account, open ETH/pqUSD under the hook and add its liquidity. See the setup
- Hook 0x3B28…caa0: its last bits are v4's permission flags, so the address itself says which calls it checks
Uniswap v4 · Uniswap's own deployment · Live on Sepolia
Liquidity a cracked key can't take.
On Sepolia, at Uniswap's own v4 PoolManager, the same rule runs for Opaque's ERC-4337 accounts. PQAccountPoolHook lets only PQ accounts swap in, add to, remove from or donate to its pool. Each one is a clone of one PQAccount implementation whose only authority is a FORS+C key, so its code hash says what it is, and there's nothing to register.
- Funded by a PQ account: its first UserOperation deployed it and minted the position, signed with FORS+C. See it
- 0.001 ETH → 1.813221 tUSDC: a PQ account's swap, exactly the quote. See the swap
- The same swap from an ECDSA wallet reverts with
NotPostQuantum(wallet) - Hook 0xa68b…4aa0 at Uniswap's PoolManager 0xe03a…3543
Liquidity guard · Any wallet · Live on Sepolia
Still on ECDSA? Add a post-quantum key.
PQGuardHook protects liquidity anyone provides, ECDSA wallets included. Register a FORS+C key once, with an ordinary transaction. From then on, every removal from your position, fees too, needs that key's signature over the exact amount, a recipient and a deadline. The hook pays the recipient it names itself, so whoever cracks your ECDSA key can't take the liquidity, or redirect a removal you sign.
- The guard key, registered in PQKeyRegistry by an ordinary ECDSA wallet. See it
- Position #41441, the cracked key with a FORS+C signature from another key: refused,
BadSignature - The real signature, replayed with a front-runner's own recipient: refused,
BadSignature - The signed removal: 0.002 ETH and 3.999999 tUSDC to the recipient it signed, 0 to the caller. See it
- Hook 0xd0cf…4b01. 15 contract tests across the three hooks
Keep MetaMask
Already on MetaMask? Stay.
Two ways to go post-quantum without leaving it, both live on Sepolia.
The Q‑Day vault.
Keep MetaMask, and protect what's in it. ETH and tokens you put in the vault come out only with a FORS+C signature, so whoever cracks the ECDSA key finds nothing to move.
Open the vaultOpaque beside MetaMask.
With the Opaque extension, any dapp's wallet list shows Opaque next to MetaMask (EIP-6963). Connect, and each transaction is approved in Opaque and signed by a post-quantum account.
Try it on a dappAvailable now
Everything you can do post-quantum today.
WhatWhereSigned by
Private payments in rings of eight notes, with a way out that needs no Opaque serverSepolia · Arc · XRPL testnetFORS+C
Stealth addresses, ML-KEM-768SepoliaFORS+C · ML-KEM
ENSv2 names: claim, resolve, pay by nameSepoliaFORS+C
Uniswap v4: pools only post-quantum accounts can trade inEIP-8141 devnet · Sepolia (Uniswap's v4)FORS+C
Liquidity guard for any wallet: a FORS+C second factor on every removalSepolia (Uniswap's v4)ECDSA + FORS+C
Quantum-safe admin for any protocol: one button moves its admin keys to a FORS+C keySepoliaFORS+C
Q-Day vault for any MetaMask wallet: only a FORS+C key takes funds outSepoliaECDSA in · FORS+C out
Reads through a mixnet, with EF's anon-rpcSepolian/a: nobody sees who asked
Why now
Moving later means moving in a hurry.
Every ECDSA signature ever published reveals its public key, so the day a large quantum computer exists, those accounts can be taken. The cheapest time to move is before anyone has to.
- Hash-based, not lattice-based. FORS+C rests on the hash function alone, the most conservative assumption there is.
- Few-time keys, rotated for you. Each key signs a set number of times, and the wallet hands over to the next one before it runs out.
- Bigger signatures. About 9 KB instead of 65 bytes, which costs more calldata. The verifier is tuned to fit the public mempool's budget anyway.
- Testnets first. Sepolia and the devnet today, mainnet after an audit. The code is open (Apache-2.0).
Honest about it
What it doesn't hide.
Built on the Ethereum Foundation's anon-rpc and the Nox mixnet. Opaque's code is open source (Apache-2.0). On Sepolia today.
- One bootstrap read.Seen once The wallet reads the worker's hash from its contract once, directly, before anything is anonymized.
- Payments still use Opaque's relays.One operator, for now A private payment needs our attester, so it crosses our three-hop mesh, which hides your IP but is one operator today. Before mainnet, its relays will be run by multiple independent operators.
- Slower.About 1 s a read Mixing is the point: a read takes about a second instead of a blink.
- The chain is still public.On chain anon-rpc hides who asks. Opaque's pools and stealth addresses hide who pays and who is paid.
Go post-
quantum.
Go unseen.
Make a wallet on Sepolia: free test funds, a name under opaque.eth, private payments in and out, a swap in the post-quantum pool. Every signature it makes is post-quantum, and one switch in Privacy sends every read through the mixnet.
Try it on Sepolia.
Take free test tokens on Sepolia and send some privately. They have no value, so nothing is at stake.
Get test tokensNew to private payments?
Follow one payment from deposit to app in five short scenes, told with eight dots.
Follow a payment