click + drag the grid to orbit — scroll wheel to zoom
nmap -sV global-threat-surface

This isn't a page. It's a live surface.

Drag the grid behind this text — it's a real 3D scene you're controlling, not a scroll animation. Every node is a simulated endpoint. Every arc is a simulated packet in flight. Built for the 3D Websites Hackathon.

0Nodes tracked
0Active routes
—Breaches attempted (all visitors)
whoami --target=visitor

Here's what this page already knows about you.

No account, no login, no tracking script from a third party — every line below comes from standard data your browser hands to any site you visit. This is what "basic recon" looks like before a single exploit is involved.

visitor_profile.shscanning…
Estimated uniqueness among visitors
calculating…
Nothing here leaves your browser. It's an illustrative estimate for the demo, not a production-grade fingerprinting engine.
tail -f /var/log/breach.log

The feed below isn't decoration — it's generated live.

Every line streams in on its own, on-theme, and never repeats the same way twice. It's a small proof that this whole page is doing real work in your browser, not replaying a canned video.

live_feed.sh00:00:00
./estimate-crack-time.sh

A real tool: how long would your password take to crack?

Type anything below — it never leaves your browser, nothing is transmitted or stored. This runs pure entropy math client-side to estimate brute-force time against an offline attacker.

Entropy
0.0 bits
Character space
—
Offline attack (1e10/s)
instant
Online attack (10/s)
instant
Rule of thumb: length beats complexity. A 20-character passphrase almost always outlasts an 8-character jumble of symbols.
./encrypt-message.sh

A tool anyone can actually use: encrypt a real secret.

Write a message and a passphrase, hit encrypt, and send the scrambled text to a friend however you like — text, email, DM. They paste it back in here with the same passphrase to read it. This is real AES-256 encryption running in your browser via the Web Crypto API, not a toy cipher.

Nothing is sent anywhere. Encryption and decryption both happen entirely on your device using AES-GCM with a PBKDF2-derived key. Lose the passphrase and the message is unrecoverable — same as real encryption.
./breach-mainframe.sh --simulate

Try to breach the mainframe yourself.

A small, self-contained hacking simulation — type commands into the terminal below. It's a real code-breaking puzzle (Mastermind-style feedback), not a movie prop. Nothing here touches a real system; it's a sandbox running entirely in your browser.

mainframe_access.shSANDBOXED
>
Try: help · scan · hack mainframe · guess 1234 · clear
leaderboard.dbloading…
no breaches recorded yet — be the first.
This leaderboard is real, shared storage — it persists across everyone who opens this page and updates live when someone wins.
sudo request-access --team

Want in?

Leave a signal below and it opens straight in your email client — no backend, no database, nothing logged anywhere but your own outbox.