Official release channel.

Stay private.Stay free.

GentzyCloak is a portable privacy console you carry on a USB drive: a memory-only hardened browser, host and website scanners, end-to-end encrypted chat and an encrypted vault. Nothing is installed on the machine you plug it into.

Download GentzyCloakVerify a download
Latest releasev0.1.1stable · 8 Sept 2026IntegritySHA-256 published3 of 3 files, in SHA256SUMS.txtBuildGitHub Actionscommit 481b794 · MIT licencePlatformsWindows · macOS · Linuxportable builds, no installer

Download v0.1.1

SHA256SUMS.txt
Your platform
Windows
Portable executable · x64
Windows 10 or 11 (64-bit). A single portable .exe — nothing is installed on the host.
SHA-256 published96 MBv0.1.1
d7776253a4b708c6e6c2e7c0f1d33042b1c65054a5fed4776d240656b78ed61a
Download for WindowsVerify

Double-click the .exe on the drive. SmartScreen may ask you to confirm because the build is unsigned.

Your platform
macOS
Universal app (zip) · universal
macOS 12 Monterey or later, Apple silicon and Intel (universal). Unzips to GentzyCloak.app.
SHA-256 published221 MBv0.1.1
00cb4b00243eafe3e7a2dd8a6d8c241c99d604e93a74435897c141087be3c3d9
Download for macOSVerify

Unzip, move GentzyCloak.app to the drive, then right-click → Open the first time (unsigned build).

Your platform
Linux
AppImage · x64
Any x64 distribution with FUSE 2 or 3. One AppImage, no package manager, no root.
SHA-256 published96 MBv0.1.1
378782c5f997f47ed1d720795f8432ff8019334d5ca65ab09d67a6cabfd03c2f
Download for LinuxVerify

chmod +x GentzyCloak-*.AppImage, then run it from the drive.

These builds are not code-signed.
GentzyCloak is built in public by GitHub Actions from the commit shown above, and the SHA-256 of every file is published here. Verify the hash on a machine you trust before copying a build to your drive. A signature from an operating-system vendor is not a substitute for that check; the hash is what ties the file to the source.
All releases2 versions
VersionDatePlatformFileSizeSHA-256
v0.1.18 Sept 2026Windows · x64GentzyCloak-0.1.1-portable.exe96 MBd7776253a4b7…0656b78ed61a
v0.1.18 Sept 2026macOS · universalGentzyCloak-0.1.1-mac.zip221 MB00cb4b00243e…41087be3c3d9
v0.1.18 Sept 2026Linux · x64GentzyCloak-0.1.1.AppImage96 MB378782c5f997…a6cabfd03c2f
v0.1.06 Sept 2026Windows · x64GentzyCloak-0.1.0-portable.exe96 MB23e4ddbe6096…080353b08fa0
v0.1.06 Sept 2026macOS · universalGentzyCloak-0.1.0-mac.zip221 MB00211bc98fa6…7cefde1d3de2
v0.1.06 Sept 2026Linux · x64GentzyCloak-0.1.0.AppImage96 MB2bebd3735373…83869ebc6e8d
v0.1.1Site Security Scanner with network intelligence, Tor exit check, third-party firewall recognition, opt-in WebGL, Downloads section, collapsible sidebar and header, and safer settings writes on Windows. First release published through the download site. Built by GitHub Actions (Release workflow) from 481b794.
v0.1.0First portable release: memory-only hardened browser, host anomaly scanner for macOS, Windows and Linux, site security scanner, end-to-end encrypted chat, encrypted vault and exportable reports. Built by GitHub Actions (CI workflow, package job, run 34061580700) from 0d5d014.
Verify before you trustHashed locally
Or verify in a terminal on a machine you trust

Compare the output with the hash on the card above, or check the whole set at once with SHA256SUMS.txt.

macOS
shasum -a 256 GentzyCloak-0.1.1-mac.zip
Linux
sha256sum GentzyCloak-0.1.1.AppImage
Windows PowerShell
Get-FileHash .\GentzyCloak-0.1.1-portable.exe -Algorithm SHA256
All files
shasum -a 256 -c SHA256SUMS.txt --ignore-missing
What GentzyCloak protects — and what it cannotFull threat model

Mitigated

  • Browser traces on the host. Sessions live in memory only, block trackers, force HTTPS and are destroyed on exit or Panic.
  • A tampered copy of the app. Every bundled file is hashed against a build manifest at start-up; a mismatch is shown in red.
  • Hidden persistence and remote access. The host scanner grades processes, launch items, listening ports and posture, then exports a report.
  • Unsafe websites and vendor demos. The site scanner checks TLS, headers, exposed files and hosting before you trust a link.
  • Credentials and notes at rest. The vault is AES-256-GCM under a scrypt-derived key, written atomically to the drive.
  • Chat content in transit. Rooms are end-to-end encrypted; the relay forwards opaque envelopes it cannot read.

Not mitigated

  • A compromised operating system. A keylogger or screen recorder on the host sees what you type and see. Scan first, and treat critical findings as a stop sign.
  • Who you connect to. Your network still sees the destinations you visit unless you route through Tor, which is not bundled.
  • Chat metadata. The relay cannot read messages but does see IP addresses, timing and message sizes.
  • Unsigned builds. Nothing stops a hostile site from serving a fake file; only the published SHA-256, checked on a trusted machine, does.
  • Forensic recovery from flash media. Shred-delete overwrites once; a laboratory may still recover data from worn flash cells. Use an encrypted drive.
Documentationkept in the repository
User guidePreparing the drive, the pre-meeting checklist, reading a scanThreat modelAssets, adversaries, what is and is not mitigatedBrowser hardeningWhat the memory-only browser blocks and whyChat protocolInvite codes, key derivation, the dumb relayArchitectureMain, preload and renderer boundariesSecurity policyHow to report a vulnerability and what to expect
Quick actions
Verify a fileHash a download in your browser, nothing uploadedSHA256SUMS.txtEvery published hash in one signed-off listRead the user guidePrepare the drive on a trusted machine firstSource codeMIT licence · build it yourself with npm run packageReport a vulnerabilityPrivate advisory · acknowledged within 3 working days
Get started
  1. Download on a machine you trust.Take all three builds if you may meet more than one kind of computer; they are small.
  2. Verify the SHA-256.Use the checker above or a terminal. If it does not match, do not use the file.
  3. Copy to an encrypted USB drive.BitLocker To Go, an encrypted APFS volume, LUKS or VeraCrypt protects anything you export.
  4. Run it from the drive.The dashboard must show Portable mode active and Integrity passed before you rely on it.
This siteHardened
Transport
TLS · HSTS preload
Policy
CSP, no inline code
Cookies
None
Analytics
None
Third parties
None loaded
Served from
cloak.gentzy.cloud

Static files behind nginx and Caddy, read-only container, GET and HEAD only, access logs discarded. Powered by LordMoritz.

“Security is not a product, it’s a practice.”
— LordMoritz