Introducing Slynk

On 2nd November 2026, a new privacy app called Slynk went live at slynk.me, and it’s one of the most interesting things to land on the XX Network in a long time. It lets anyone send a message or files through the cMixx mixnet straight from a web page, with nothing to install, no account, no phone number and no email address. It also gives people an anonymous inbox that anyone can write to without giving a name or signing up for anything.

I’ve had a good play with it ahead of today, and what struck me most isn’t any single feature but how carefully the whole thing has been thought through. Below is what it does, why it matters for those of us who’ve been around XX for a while, and what it means for anyone who wants to build on it.

What is Slynk?

Slynk does two things:

  • Links, one to one. Write a message, add up to 200 files (2 MB in total after compression) and Slynk turns them into a link. Send that link however you like. It opens once, for one person, and then it’s gone. If nobody opens it, it stops working after an hour, a day, a week or up to about three weeks, whichever you pick, and you can cancel it yourself at any time. You can add a password too.
  • Anonymous inboxes, many to one. Anyone can create an inbox in seconds. You get 12 words (think of them as the key to your inbox) and an address to share, as a link or a QR code. Anyone with the address can write to you, from any browser, with no account, name or email address. The obvious uses are an organisation that wants to hear from people in confidence: a refuge, a newsroom, a staff body that wants concerns raised safely.

It’s deliberately not trying to be another messenger. In the project’s own words, it’s “a place to go when privacy and safety matter most”: a family member sharing a password, a source getting a document to a journalist, someone reaching out who can’t afford to be seen doing it.

A few other touches I liked:

  • Files are cleaned before they leave your browser. GPS location and camera details in photos and videos, author names and editing history in documents, and audio tags are stripped by default, and you’re shown what was removed.
  • Files are made smaller to fit. Photos, videos, audio, PDFs and Office documents are shrunk in the browser so they fit through the mixnet, and the recipient gets previews without anything in the file being able to run.
  • Recipients are warned about anything suspicious. When a file arrives, the recipient’s browser checks what kind of file it really is and what’s packed inside it, and says plainly if it’s a program (even one dressed up as a document), has macros or scripts, or would reach out to the internet when opened. Nothing is sent anywhere to do this, and nothing in a file can run on the page. It isn’t a virus scanner, and Slynk says so, but it catches the obvious tricks before anyone opens anything.
  • Quantum safety where it counts. A link’s key never crosses the network at all, so a future quantum computer has nothing to work on. Every inbox also gets a quantum-safe address (a hybrid of ML-KEM-768, the new NIST standard, and X25519), and replies between inboxes stay quantum-safe too.
  • Nothing is stored unless you ask. No cookies, no tracking, and your identity lives only in the tab’s memory. Close it and it’s gone. If you want your inbox kept on your device, that’s an option you switch on, encrypted with a key worked out from your 12 words. To double down, especially on a shared or borrowed device, open Slynk in a private window: your browser’s history keeps the Slynk links you open (an inbox’s address is one too), even after the page wipes them from the address bar, and a private window forgets them once it’s closed.

Why this matters for XX

If you’re reading this site, you probably got into the XX Network for the same reason I did. David Chaum invented the mix network back in 1981, long before the internet as we know it, because he saw that who talks to whom can be as revealing as what they say. Encryption hides the words; it doesn’t hide the conversation. cMix, published in 2016 by Chaum and colleagues, made mixing fast enough for real use, and XX has run it on mainnet since November 2021, with nodes all over the world carrying the traffic (mine among them for many years).

The frustration for many of us has been the gap between that technology and things ordinary people actually use. The mixnet has been humming away for years, but apps that put it in front of normal users have been few and far between, and most asked you to install something or set up an identity first.

Slynk is different in a few ways I don’t think we’ve seen together before:

  • There’s nothing to install and nobody to sign up as. Open the page and your browser joins the mixnet as a brand new identity that exists only for that visit. The XX client SDK (xxDK) is compiled to WebAssembly and runs right there in the tab.
  • The secret never touches a server. Everything needed to open a link sits after the # in the address, which browsers never send anywhere, and the page wipes it from the address bar once it’s read.
  • It works with the network rather than around it. The mixnet can’t delete anything (data stays on gateways for around three weeks), so instead of pretending otherwise, Slynk “burns” a link by destroying half of its key the moment it’s opened.
  • It’s honest about its limits (more on that below), which is rarer than it should be in privacy software.

Put simply, it takes what makes XX special and turns it into something your non-crypto friends could use in thirty seconds.

Echoes of Doxxier and OpenVoice

Long-time readers will remember Doxxier and OpenVoice from the Foundation’s roadmaps, which I covered in my 2025 roadmap piece. Doxxier was about secure, large file transfers over cMixx, with a developer framework so others could build on it. OpenVoice set out to give a voice to people who fear being identified, whether whistleblowing inside an organisation or speaking up more widely.

Slynk lands remarkably close to both ideas. Its links are private file transfer over cMixx; its anonymous inboxes are a safe way for people to raise concerns; and, as you’ll see below, the code that prepares files for the mixnet has been packaged up for other developers to reuse. Slynk’s own About page describes it as “bringing together two ideas long hoped for on the xx network: sending files privately over the mixnet, and a safe way for people to raise concerns.” It’s good to see those ideas finally out in the wild in a working, usable form.

How it works (without getting too geeky)

  1. Joining. When you start sending or open a link, your browser joins the mixnet as a fresh identity, held only in memory.
  2. Uploading. Your message and files are encrypted and split into pieces of about 900 bytes, which go through cMixx rounds to a random, single-use address, shuffled in with everyone else’s traffic.
  3. The link. The link carries the key and where and when to collect the pieces. On slynk.me every link is sealed a second time, with half of that extra key held by a small “key server” (in memory only, never your data or your link), which hands it over once and then forgets it.
  4. Collecting. The recipient’s browser joins as another fresh identity, collects the pieces and checks every one, and the whole, against the link before showing anything.
  5. Inboxes. A message to an inbox is sealed for its owner and left at the inbox’s own address on the network. The owner’s browser looks back through the network’s history for it and opens what’s theirs. No server holds anything.

How private is it, really?

Plenty of services say “end-to-end encrypted” these days, so it’s worth being precise about what Slynk does differently.

Everything happens in your browser. When you add a file, Slynk reads it, strips its hidden details, shrinks it and compresses it right there on your device. Then it encrypts it: once under a one-time key that’s split in two, and again by the XX Network’s own file transfer. Only then does anything leave, and what leaves is a stream of encrypted pieces of about 900 bytes going into the mixnet. Outside your device, your file, your message and your link only ever exist as those encrypted pieces inside the mixnet: they never touch slynk.me’s website or anyone else’s server. Nothing is kept in your browser either, unless you ask it to remember your settings or keep your inbox.

Compared with Wormhole. Wormhole, from the people behind WebTorrent, gets the basics right: it encrypts files in your browser too, with the key in the link’s # part where its servers never see it. That protects what you send. It doesn’t protect who sends to whom. Your encrypted file goes up to Wormhole’s servers (stored with Backblaze for 24 hours) and comes down to the recipient from the same place, so one company’s systems see both ends of every transfer: the sender’s internet address, the recipient’s, the size and the timing, all tied together by a single link. Its privacy policy doesn’t say whether any of that is logged, and like any company it shares information where the law requires.

That’s exactly where Slynk wins. It protects the who as well as the what, and takes great care not to leak anything new along the way:

  • A mixnet instead of a middleman. Your pieces go through cMixx rounds, shuffled with everyone else’s by teams of five nodes run by independent operators around the world, and the recipient collects them later as a different, brand-new identity. No company holds your file, and no single server sees a whole transfer, so there’s nothing of the kind to log or be asked for.
  • No identity to trace. No account, email or phone number, and every visit joins the network as a brand-new identity that lives only in that tab’s memory.
  • Uploads that don’t give themselves away. The standard XX client confirms an upload by downloading it back, which would tie the sender’s internet address to the very place the recipient collects from. Slynk confirms by the rounds’ results instead, so the sender never goes near it.
  • A website that learns nothing. slynk.me keeps no visit logs, and its page talks to nothing but the XX Network’s own hosts and Slynk’s key server: no CDN, analytics, fonts or trackers, which its security policy enforces. Every visit downloads exactly the same files, whatever you go on to do, so even what a visit loads can’t reveal whether you sent a file, used a password or opened an inbox.
  • A key server that learns nothing either. All it holds is a random half of a key, in memory only, filed under a code that can’t be turned back into your link. It stores no internet addresses, every answer it gives looks the same, and the real requests hide among dummy ones from every open tab.
  • Files that say less about you. Location, camera details, author names and editing history are stripped before anything leaves your device, and you can have file names made plain too.
  • Collect it when and where you like. Nothing is fetched until the recipient taps to open a link, and it keeps for as long as the sender chose, up to about three weeks, so it can be opened later, on another device or another network. That matters most for inboxes, whose owners are often public: a sender can put their files in a Slynk link inside the message, and the owner can open it somewhere else entirely, where it can’t easily be tied to the inbox. And as every link opens only once, whatever it holds reaches the owner alone.
  • One-time by design. The network can’t delete anything, so Slynk destroys a key instead: once a link has been opened, its pieces on the network are just noise.
  • Built to be checked. Open code, builds anyone can reproduce and compare with what slynk.me serves, plain-English write-ups of what the network can and can’t see, and a desktop app that takes the website out of the picture entirely (more on that below).

To be fair, Wormhole wins hands down on size (up to 5 GB stored, bigger files peer to peer) and speed, where Slynk tops out at 2 MB. And no mixnet is magic: to link a sender to a recipient, someone would have to go out of their way to record traffic on part of the network (easier while it’s quiet, as below), and even then they’d get internet addresses, or a VPN’s but never names, numbers or what was sent. But if what matters most is that nobody can tell you sent something to someone, there’s really no comparison.

And you can leave the website out too. Like any website, Wormhole’s and slynk.me’s pages come fresh from their servers on every visit, so you’re trusting whatever is served that day, and the visit itself is a request to them. Slynk goes one further: it also comes as a small desktop app for Windows, Mac and Linux, which runs the very same page from your own computer. Use that, and slynk.me’s website never sees you at all: no visit, no page load, nothing served on the day. All it talks to is the XX Network and the key server (which still gets its share of dummy requests). Each download’s fingerprint is published, the same code always builds to the same bytes, and the app never updates itself, so what you checked is what you keep running. Paste the Slynk links you receive into it rather than clicking them, and they never touch a browser’s history either. The app isn’t signed by Apple or Microsoft, so your computer asks once before opening it; the About page walks you through that.

Compared with messaging apps. Most of the big ones need your phone number, and while many now encrypt what you say, their servers still carry every message, so they see when it goes, to whom and from which internet address. Slynk asks for no number, name, email or account at all.

Built to be taken apart

This is the part I’d most like developers in the community to look at. Slynk is open source under the BSD 2-Clause licence, and it’s clearly been built so that others can take it, reuse it and run their own.

  • The file preparation module. The code that cleans hidden details from files, shrinks photos, video, audio and documents, and compresses everything to fit through the mixnet is offered as a single function, prepareFiles, with a demo and a full write-up. Anyone building on xxDK (or anything else with a size limit) can copy it into their own app, and the write-up says exactly what to take.
  • Forking is a one-file job. The site’s name, address and rules all live in one settings file. A fork can run its own key server (there’s a set-up guide for that too) and point everything at its own domain. That’s a real route to taking these ideas to a much wider audience: a newsroom, a charity or a community could run its own version under its own name.
  • Technical write-ups. The repository has a folder of plain-English findings covering how every part works, the design decisions and why they were taken, what the network’s gateways can and can’t see, and several bugs found in the XX client along the way, with fixes. There’s also a write-up of speed work that took uploads from roughly 2–3 KB/s to around 10 KB/s. Required reading for XX devs, I’d say.
  • Verifiable builds. The same code always builds to the same bytes, and there’s a script that checks what slynk.me serves against the published build, so you don’t have to take anyone’s word for what’s running.

No company, no token, no catch

Slynk isn’t made or run by the XX Foundation. The people behind it have chosen to stay anonymous, and describe it as “an independent, unfunded project, offered freely to the xx community and to anyone who needs it.” There’s no company, no legal entity, no token, no ads and no tracking.

That cuts both ways, and it’s worth being clear-eyed about. With nobody commercial behind it, slynk.me itself could disappear one day if the people running it step away. But the code doesn’t go anywhere: it’s published, it’s open, and anyone can pick it up and keep it going. If the community embraces it, there’s no reason it can’t run for as long as the mixnet does. The aim is to give people real control over their privacy using a model that has very obviously been sweated over, and then let the idea belong to everyone.

It’s also worth knowing that two of slynk.me’s biggest rules are choices, not limits of the code. Every link on slynk.me opens once, and its inboxes take short messages only. Someone running their own version can switch either off with a single setting: links that open as many times as you like, so one link can go to a whole group, and files (up to 2 MB) sent straight to an inbox. Slynk made those calls deliberately. A link that opened again and again could spread anything to crowds with Slynk’s name on it, and everyone who opens a link joins the network, so one shared widely could put real strain on the nodes. A file to an inbox travels as many pieces, and while the network is quiet, a curious gateway operator could sometimes match a large upload to the internet address it came from and the inbox it went to, whose owner is often public. A fork serving its own audience can weigh those things differently; the choice, and what comes of it, is theirs.

What about the nodes?

Node runners might reasonably ask why they should carry a free service like this, and having run a node myself for many years, I understand the question. The short answer is that nobody can pay yet. Postage, the Foundation’s plan for paying for cMixx use, which I covered back in 2023, would give everyday users a free allowance and let heavier users and apps pay for more in XX Coin, with the nodes that carry the messages earning from it. It doesn’t exist yet, so for now sending is free for every app on the network.

Slynk is upfront about this. Its About page says it “knows it asks a lot”, and it keeps its footprint small where it can: it joins the network only when you start sending or open something, reuses an identity wherever it safely can, caps every send at 2 MB, and every link opens once. In its own words, “showing what cMix can do for people comes first, until the network brings postage in; then Slynk will follow its rules.” Its write-ups even put the obvious design question to the Foundation: how postage might work for a service that deliberately has no accounts.

So think of Slynk as a showcase: a working demonstration of what the mixnet can do for ordinary people, built before the economics are in place, and fully intending to play by them once they are. Back in 2023 the Foundation said postage should be in place “by the time there is an applicable app to use postage with”. Perhaps now there is one.

The honest bits

Slynk is refreshingly upfront about what it can’t do, and so should I be:

  • It’s small and not lightning fast. The limit is 2 MB per send, which is the XX file transfer’s own cap. A text message goes in about six seconds; a full 2 MB takes around four minutes to upload. That’s the mixnet working as designed, but it’s no WeTransfer.
  • But 2 MB goes a remarkably long way. Slynk goes to extreme lengths to fit real files into it, all on your own device before anything is sent. Photos are redrawn at a sensible size, videos are re-encoded in the browser (at 240p by default), audio files become Opus, a modern codec that stays clear at tiny sizes, and PDFs and Office documents have their pictures made smaller. Text, code and documents are then squeezed with Brotli, a compression method that usually gets text and code about a sixth smaller again than zip’s own. In the published tests, a 5.8 MB phone photo went as 180 KB, a 10-second 1080p phone video with sound as 217 KB, a minute of audio as about 100 KB, an 11.6 MB PDF as 117 KB, and Word, Excel and PowerPoint files of 14 to 16 MB as 128 to 181 KB. Eleven files adding up to more than 50 MB went together in under 1 MB. It’s small and watchable rather than pristine (Settings lets you trade some size back for quality), phones take longer than the desktop these were measured on, and the write-up on preparing files has all the numbers. Better still, try it: add a few phone photos and a short video, and watch the meter.
  • Gateways can see your IP address. Your address never travels through the mix itself, but the gateway your browser talks to sees it. While the network is quiet, a curious gateway operator could match a large upload to its link (though never open it). Use a VPN if your IP address matters to you; Slynk says so itself.
  • An inbox’s address is public by design, so anyone who has it can see when messages arrive, though never who sent them or what they say.
  • The network gets better with use. Every extra person sending through cMixx makes everyone else harder to pick out. Which is, of course, a very good reason to use it.

Credit where it’s due

Slynk stands squarely on other people’s work, and its credits say so: David Chaum’s cMix; the XX Foundation’s network and SDK; Rick Carback, who has contributed more than anyone else to the XX code Slynk builds on, from the client SDK to its crypto libraries, and co-wrote the network’s design documents; and Keith Millette, whose fork of the SDK carries the reliability fixes Slynk relies on. It’s lovely to see that work acknowledged so clearly, and to see it finally carrying something like this.

Try it

Personally, I think this is exactly the kind of thing XX needs more of: a genuinely useful tool, built with real care, that you can hand to someone who has never heard of a mixnet and they’ll just get it. Send yourself a link, set up an inbox, have a poke around the write-ups, and if you’re a developer, have a look at what you could take from it.

As always, pop into the XX Network Telegram or Discord to share your thoughts.

Share This Page: