Dwel - your digital home on the internet

Secure your data, communicate privately, be the master of your own domain - literally!

You hold the key, no one else does.

A vault only you can open

Everything is encrypted on disk. The key is made from your password and lives only in memory, and only while Dwel is unlocked. There’s no back door, no password reset, and no other way in.

An identity, not an account

Dwel requires no email, no phone number, no sign-up: its identity is a key pair that belongs to you - move Dwel to another machine and your contacts will still recognise you.

One program, not a stack

One thing to install, one thing to update, signature-verified each time. No Docker, no database to run, nothing to wire together.

Where your Dwel runs

Dwel should run on a machine you control. Two sensible options:

Your own machine at home

A spare laptop, a desktop, or a small always-on mini PC. Nothing leaves your home except the traffic you choose to exchange with other Dwels. The hardware is yours outright.

A private VPS you rent

A small virtual server from a hosting provider. Always on, always reachable, and independent of your home internet - you rent the machine, but the keys stay yours.

How your Dwel connects to the internet

Three ways, depending on where the machine is:

Directly host it on a VPS with a public IP address

The easiest, but least secure option. You rent a small virtual server, point a domain at it, install the Dwel - and you are done. Dwel does the rest.

The reason it is less secure: your key stays in the memory of that rented machine while Dwel is unlocked. In theory, someone with access to the host could dump that memory and take the key. It is a remote possibility rather than a likely one - but it is real, and it is the trade you are making for the convenience.

Address
your own domain name
Needs
a VPS with a public IP address, a domain pointed at it, and ports 80 and 443 free
Who can see
nobody in the middle - there is no middle. But the machine is not yours, and your key is on it.

Instructions →

Via a tunnel host it on a home machine accessible through a tunnel

Keep the machine - your data and your key - at home. Get a free tunnel from Cloudflare or another provider and set it up on your local machine; your Dwel will do the rest, and you will not even need to touch your router.

This is the second-most secure option. Your messages stay sealed end-to-end, but the tunnel provider terminates the encryption for your own browser session - so they can see you using your Dwel, and you depend on them for the connection. Unlikely to matter, but it is the reason a relay ranks above this.

Address
your own domain, managed at the tunnel provider
Needs
a home machine that stays on, and a (free) tunnel account
How
the installer does not set this one up: choose the relay or local-only when it asks, then point your tunnel at Dwel afterwards.
Who can see
the tunnel provider can. Your home network stays closed, but the traffic is visible to them in between.

Instructions →

Via a relay a home machine + a Dwel relay on a VPS

The most secure and sovereign option. Rent a small internet-facing VPS, install a Dwel relay on it, and keep your actual Dwel - your data and your key - on a machine at home. The relay holds no key, cannot read the content of your traffic, and does almost nothing else: it reads the name on the outside of the envelope and forwards it, so there is very little there to attack.

If you are not sure yet and want to try Dwel before committing to a VPS, we provide a temporary free relay service. It is still secure, but it is shared with others, so voice and video are not carried on it - for those you will need your own relay.

Address
your own domain on your own relay, or a name ending in dwel.me on the free one
Needs
a small VPS for your own relay - nothing at all for the free one
Who can see
not the relay. It sees the name on the outside and nothing else - it cannot open your traffic, by construction rather than by promise.

Instructions →

You are not locked in. Run the installer again to change how you connect, or move to your own domain when you are ready - your identity travels with you, so your contacts keep recognising you either way.

Install Dwel

Copy the block for your system and paste it into a terminal.

Linux

The installer asks how you want to be reachable before downloading anything, installs itself as a background service, and never sees your password. 

curl -fsSLO https://releases.dwel.me/install.sh && sudo bash install.sh

macOS

The same script as Linux - one covers both. 

curl -fsSLO https://releases.dwel.me/install.sh && sudo bash install.sh

Windows

Needs Administrator: right-click Windows PowerShell, choose Run as administrator, then paste all three lines. 

try { if ([Net.ServicePointManager]::SecurityProtocol -ne 0) { [Net.ServicePointManager]::SecurityProtocol = [Net.ServicePointManager]::SecurityProtocol -bor 3072 } } catch {}
irm https://releases.dwel.me/install-windows.ps1 -OutFile $env:TEMP\dwel-install.ps1
powershell -NoProfile -ExecutionPolicy Bypass -File $env:TEMP\dwel-install.ps1

The installer checks your machine before it does anything, and stops with a plain explanation rather than installing something broken.