A full browser — and a P2P network node.
PearBrowser is a real browser for the hyper:// web, an app catalogue, and a site publisher — wired to a social trust graph that powers search, names, and a Nostr feed. Below is every capability, with the same honesty the app uses in its own Settings: shipping features and experimental ones are labeled, never blurred.
Private search on the page you open first.
PearBrowser Home opens as the active first tab with DuckDuckGo search. PearBrowser sends no search analytics, excludes submitted queries from the optional persistent visit log, and keeps Content Shield enabled for results.
No PearBrowser search profile
There is no PearBrowser search account, analytics collector, ad profile, or query telemetry endpoint.
A provider with a clear policy
DuckDuckGo receives the query and network address to return results. Its policy says it does not save or share search history.
Private, not anonymous
The provider and network can still observe what is required to serve the request. PearBrowser states that boundary on the home page before a search is sent.
Search that runs on trust, not a crawler.
A local-first full-text index over your social graph. Pages you browse are tokenized, signed by a per-app search sub-key, and stored in a local Hyperbee — so Library search returns in under 5ms with zero network.
Federated, opt-in
Toggle “include trusted peers” and local results paint instantly, then a verified-peer set arrives over Hyperswarm and merges in — each hit carrying a provenance badge (you / trusted · hop N). No global crawler, no ranking black box.
Verify-and-drop
Every peer row is re-verified against the contact's signing key and dropped if it doesn't check out. A peer is an index, never an authority — it can serve results, never forge them.
Completeness anchors
Root-signed commitments to an index's length + tree hash let a trusted peer detect a truncated or forked index, so “federated” never quietly means “partial”.
Memorable names, no registrar.
Type a bare word or pearname://alice in the URL bar and a tiered resolver turns it into a destination, each with a provenance chip so you always know how it resolved.
A four-tier resolver
Your private petname wins, then your own claims, then names your trusted contacts claimed, then a curated floor. The highest tier you trust answers — and the chip says which.
Owner-signed registry
Claim a name in a multi-writer Autobase log: first-claim-wins, owner-only rotate/release/revoke, and durable across your devices even after every writer goes offline.
Homograph-guarded
A different owner can't claim a confusable look-alike of a held name — a Cyrillic раypal folds to the same skeleton as paypal and is rejected. Off by default.
A portable identity and a feed — over your trust graph.
Settings shows your npub and a one-click “Link (attested)” / Revoke control that cross-curve-binds your Nostr (secp256k1/BIP-340) key to your Pear Ed25519 root with a monotonic epoch.
Post & read, signed
Compose NIP-01 notes signed with your Nostr key, stored in your own event log. Toggle “include trusted contacts” to read notes a verified contact authored with their attested key — replicated peer-to-peer.
Author-verified feed
Every contact note is checked against that contact's Contacts-held root; an un-attested author never reaches your feed, and future-dated spam can't pin itself to the top.
No relay servers
The feed federates over your own contacts, not a relay fleet. Public wss:// relay transport is a later, opt-in phase — clearly labeled when it lands.
Keys you own, sites that stay up, fetches peers serve.
BIP-39 identity + sub-keys
A 12-word backup phrase, restore-on-a-new-device, and a distinct appPubkey handed to every site. Settings → Connected Apps lists and revokes grants. Contacts are added from signed invites, rejected if forged — and one verified contact powers all the federation: search, names, and notes.
Publish sites, pinned 24/7
Build a site in-app and publish it as a Hyperdrive addressed by key. HiveRelay pins it so it stays reachable even when your machine is closed — this very website is served that way. Live
P2P Content Shield lists
Subscribe to checksum-verified filter-list Hyperdrives that hot-swap on publisher updates and keep blocking offline. Per-drive allowlists and strict mode stay browser-owned, while CSP-safe cosmetic rules and scriptlets never bypass the page boundary.
Pear Plugins from drives
Install scoped styles, scripts, and network filters from ordinary Hyperdrives. Every install previews explicit capabilities; updates that ask for more power are disabled until you re-consent to the exact new snapshot. A P2P catalogue provides one-click Install/Open actions with no central extension store.
Reload-safe browser transport
The authenticated renderer reconnects across reload and live-update handoffs while the backend briefly preserves state and buffers events. Pending calls fail immediately on a real disconnect, so Settings no longer turns one closed socket into a cluster of misleading 30-second RPC timeouts.
Encrypted device sync Experimental
Pair your own machines with a sync://<key>:<encKey> invite to converge bookmarks over an encrypted Autobase. Scope today is bookmarks — not full tabs / history / profile. Off by default.
Three apps in one
Browse hyper:// sites, install and launch P2P apps from decentralized catalogues, and publish your own. Builders can seed an app to HiveRelay, pin it, and submit it to a catalogue—without relying on a central platform account or DNS name.
See it for yourself.
Download unsigned preview builds for macOS, Windows, and Linux — or launch the current release over P2P with no download at all. Signed, notarized installers are on the way.