🛡️

How navigate.st keeps you safe

navigate.st is a public relay for the Bitcoin Cash Name Service — a way to view .bch, .x and other on-chain names in any browser, with nothing to install. This page explains what runs where, and why your password manager won't autofill here.

Two ways to reach a BNS site

Tier 1 · Convenience

Public relay (you're here)

navigate.st fetches the site from the chain for you and serves it over ordinary HTTPS. No install. The operator can see which names you request (never the content — that's end-to-end from the chain) and keeps no logs.

Tier 2 · Trustless

Install Theseus

Theseus is a browser with the resolver built in. Names resolve on your own machine, directly from the chain. No relay, nothing to trust, full functionality — passwords, cookies, passkeys, offline mode, the lot.

Every page runs in a sealed browser view

When a BNS site loads through the relay, every page gets its own private browser origin that is not shared with any other site here — not even another tab of the same site. Different BNS sites cannot see each other's data. By browser enforcement, not a promise.

The technical term is opaque origin, set with a Content-Security-Policy: sandbox header. The consequence is that none of the browser's credential or persistence APIs work on relayed pages:

No password storage. Your password manager won't offer to save or fill — the browser can't tie saved passwords to a sealed-view origin.
No cookies. Logging in won't persist. Reload the page and you're a new visitor again.
No local storage. Sites can't remember your preferences, cart, or draft between visits.
No passkeys / WebAuthn. Sign-in-with-passkey won't work — the sealed origin can't register one.
No offline mode. Service workers can't attach to a sealed origin.
Reading the content works fine. Browsing, scrolling, clicking links, downloading files, submitting forms — all normal.

Why this is good. The alternative — letting every relayed site share one navigate.st origin — would mean a malicious BNS site could read your saved session with another one. The sealed-view model closes that off completely.

Need to sign in? Install Theseus.

Because the sealed view blocks every credential API, there is no way to have a durable sign-in experience through the public relay. Not a feature we removed — a browser rule we chose to inherit. If a BNS site needs you to log in, keep a session, store a passkey, or run offline, that is Theseus's job.

Theseus is a Chromium browser with the BNS resolver and an on-chain TLS trust anchor built in. Names resolve locally from the Bitcoin Cash chain. No relay, no shared origin, no sealed-view limits.

Install Theseus →

Honest disclosure

What the relay sees: the BNS names you request (not their contents). The relay keeps no logs — whether to trust that is your call. If this matters, run Theseus and you cut the relay out entirely.

What the relay never sees: any password or key you type into a BNS site. The sealed view prevents the browser from storing them, but if you type a secret and submit it, the receiving server still gets it — just like any other website. For secrets, use Theseus (where the site runs under its real origin and credentials are protected by the normal browser model + your Theseus vault).

For IP privacy: use Tor. The relay sees whatever address connects to it.

If you're a BNS site builder

The technical reference for the sandbox — exact CSP tokens, which APIs fail, the sign-in patterns that still work through the relay, and how to design sites that degrade cleanly — is in the Sirius.X docs.