Sealed
A window of its own
Each applet runs in a sealed frame with no address of its own and no way to call out, and it cannot open a frame of its own inside it. It can draw and compute; it cannot reach anything you did not hand it.
A shell for applets · alpha
Run things you don't have to trust.
kernl runs small, self-contained applets in a sealed sandbox. Your identity, contacts, messages and files are yours and travel with you. An applet borrows them only with your say-so, and only while you watch.
What an applet gets
A window, a loan, and a line it cannot cross alone.
Borrowed
Your things, on loan
Contacts, messages, files and your account are read by the shell on the applet's behalf. A grant is something you gave and can take back, and the shell shows what each one changes.
Watched
A network it reaches through you
Everything an applet sends or fetches goes through the shell. The guard shows you what it holds, refuses or quarantines, including refusals made deeper inside the shell. You can block an applet, take back any grant, or make the guard stricter for the whole shell, at any time.
Five opinions
kernl is opinionated so you don't have to be.
It is built on kehto, an open toolkit that leaves every choice open. kernl makes the choices, in your favour, and writes down why.
Everything in one place, reached one way
One store, one connection, one account manager. There is no second copy of your world for an applet to get at.
The shell empowers you and contains the applet
Those are its only two jobs, in that order.
Protections are on by default
The shell starts strict on every visit. Only you can ease it, for the whole shell until you reload; easing one applet at a time is planned. A developer flag never can.
One account, many networks, no brand names
Downloads, sharing and mail plug in as bridges named by what they do for you.
No private-messaging system is "the best"
The shell describes each provider truthfully and lets you choose the one your correspondent can read.
Applets ask for a job, you pick who does it
Find applets in the store by name or topic, or paste an address. When one applet wants a profile opened or a note edited, it asks for the job, not another applet, and you choose which applet does it, once or always.
Where it stands
Alpha, and said so.
kernl is alpha software. The sandbox and the guard work today. Private, legacy and ratchet messages work when your account can encrypt; ratchet sessions are experimental. Downloads, sharing and mail work by handing off to an app on your device; in-shell backends are planned. The shell shows anything it cannot do as unavailable rather than pretending.
Applets are verified by content hash before they run and re-checked on every read from cache. If the bytes change, the applet's grants die with them.
What it costs
Free. $0, no tier, no catch.
Price
$0
No subscription and no paid features. The whole shell is the free version.
Licence
MIT
The source is private during alpha and opens under the MIT licence with the first public release. The decisions behind it are public now.
To try it
No sign-up
Open the preview and use the shell with a small store of applets, entirely in your browser.
Questions
Asked often, answered plainly.
What is an applet?
A small, self-contained program published as a single verified file. kernl checks its content hash before it runs and gives it a sealed window with no network of its own.
What can an applet see?
Only what you grant, for as long as you grant it. By default it sees your theme, its own storage and which account is signed in. Network access, messages, notifications and files are each a separate grant you can take back.
Does kernl hold my keys?
No applet ever does. You can sign in with a browser extension or a remote signer so your key never enters the shell, or create a local account whose key is encrypted with a password you choose.
What does kernl cost?
Nothing. kernl is free, with no account to buy and no paid tier. It is MIT licensed; the source is private during alpha and opens with the first public release.
Can I try it without signing in?
Yes. The preview runs the whole shell in your browser with a small store of applets and a throwaway account. Nothing leaves the tab.
Is it ready for daily use?
Not yet. kernl is alpha software. The sandbox and the guard work. Private, legacy and ratchet messages work once you sign in with an account that can encrypt, such as a browser extension, a remote signer or a local account; ratchet sessions are experimental. Downloads, sharing and mail work by handing off to an app on your device, after the shell asks you; in-shell backends are planned.