Seal a subscription
Paste a subscription URL, a share link, or a whole subscription body. This page encrypts it to a public key that ships in the tunelly app and never sends the plaintext anywhere — there is no request, no account, no server of ours in the middle.
This hides addresses from a subscriber using the app. It is not a secret from someone who inspects the app binary, and it is not a secret from someone who watches the phone's own traffic — the device has to send packets to the server. Treat it as a deterrent against casual copying, not as a substitute for access control on your panel.
What this is
The construction is HPKE (RFC 9180) in Base mode: X25519, HKDF-SHA256, AES-128-GCM. You hold no secret of ours. A leak of your panel does not leak a tunelly key, and someone who picks up this page cannot decrypt anyone else’s seals.
The key below is kid a, the first shipping seal key.
A later release that drops it will say so here; already-issued
links then need to be sealed again.
Key a
Public
A panel that seals every refresh
This page is for a one-off. If your panel generates the subscription
on each request, pipe the URL or the body through
tunelly-seal on that machine instead — same layout, no
service of ours:
printf '%s' "$SUB_URL" | tunelly-seal url --kid a --public-key 5814e4be95b9c9c3cea68a3ea9804b17e68f771168ab92d2366158462b2a1b37
The source is in the tunelly repository:
Shared/core/crates/tunelly-seal and
scripts/tunelly-seal.py. Read it before you trust it
with a server list.