SHURIKOVPN
RFC 9474 Verified
RSAPBSSA-SHA384-PSS · Unlinkable Blind Tokens

Vanish without a trace. Zero-link WireGuard® privacy.

Shuriko VPN mathematically separates your account identity from your tunnel sessions using IETF RFC 9474 partially blind RSA signatures. Test-drive the live Android interface on the right, inspect our 3-step cryptographic proof below, and reserve your early-access pass.

Blind RSA-4096 Token Auth
Diskless RAM-Only Relays
Local Unbound DNS

Reserve Early Access

Priority batch access for Android, iOS, Linux, macOS & Windows.

BATCH 01 · OPEN
Required · Invite dispatch
Optional
Primary Device PlatformSelect your target OS
Optional · Early-tester role & DM
@
Preferred Exit Node (synced with simulator):
Switzerland (ch-zrh-01)
Verified via Cloud Firestore (`waitlist`). Duplicate emails restore your existing pass ID.Verify how blind tokens work
STEALTH PASS RESERVEDID · SHURIKO
Name—
Email—
PlatformAndroid
X Handle@handle

BLIND SIGNATURES

Unlinkable Sessions

Control API signs expiry & tier using RSAPBSSA-SHA384-PSS without ever seeing your connection token.

KERNEL WIREGUARD®

RAM-Only Edge

Exit nodes run diskless with local Unbound DNS and automatic 30-second expired peer eviction.

FAIR ACCESS

6h Free or 24h Pro

Free tier grants 6-hour blind windows via a single rewarded ad; Pro unlocks all global nodes with zero ads.

Interactive Android App Preview — Tap the shuriken dial or server card
09:41
5GVPN100%
SHURIKOVPN
DISCONNECTED
00:00:00
TAP TO VANISHtap to disconnect
DOWNSTREAM
0.0Mbps
0 B session
UPSTREAM
0.0Mbps
0 B session
-60s-30sPeak 1 Mbps · Now
PROTOCOL
WireGuard®
Blind-token auth
KILL SWITCH
Armed
Leak guard
Exit Locations
Sorted by lowest relay load
Shuriko Pro
Unlinkable 24-hour blind token entitlement
SHURIKO PRO
Full network, zero ads
✓All global WireGuard exit locations unlocked
✓Rolling 24-hour blind tokens — never watch a rewarded ad
✓Zero-knowledge billing: Google Play token is verified once and immediately discarded
✓AdMob SDK is completely disabled in memory on Pro accounts
FREE TIER INCLUDED
6-Hour Blind Token Windows

Free accounts use the exact same RSAPBSSA-SHA384-PSS blind signature cryptography and WireGuard kernel encryption, funded by one rewarded ad per 6-hour window on free-tier nodes.

Disconnect VPN?

Stealth protection is currently active. Do you want to disconnect from the VPN tunnel?

INTERACTIVE CRYPTOGRAPHIC WALKTHROUGH

How Unlinkable Blind Tokens Work in 3 Steps

Most VPNs ask you to trust their privacy policy. Shuriko enforces privacy mathematically using IETF RFC 9474 partially blind RSA signatures—so our authentication server and our WireGuard exit relays cannot correlate your identity with your tunnel traffic.

STEP 01CONTROL PLANE · ACCOUNT AUTHENTICATED

Client Blinds a Random Secret Locally

Your device generates a fresh 32-byte random token and multiplies it by a cryptographic blinding factor r^e mod n before sending it to the Control API. The server verifies your account tier (Free 6h or Pro 24h) and signs the blinded payload.

MATHEMATICAL OPERATION
blinded_msg = H(token) · r^e mod N ──► sig' = (blinded_msg)^d mod N

Even if the Control API database is subpoenaed or compromised, the blinded integer cannot be linked to the unblinded token you redeem later.

WHAT STAYS ON YOUR DEVICE (RAM)
  • Raw random token: 0x9f4a…8c21 (never leaves RAM)
  • Blinding factor r: ephemeral 4096-bit secret
  • Public metadata: tier=pro, expires=24h
WHAT SHURIKO SERVERS SEE
  • Account entitlement status (Free or Pro)
  • Opaque blinded integer: 0x71e0…3b9a (mathematically random)
  • ZERO knowledge of your future WireGuard public key or token
Phase 1 of 3 · Control Plane Blind Minting
VERIFIABLE ZERO-LOG ARCHITECTURE & FAQ

Built for Zero-Trust Verification

Inspect our hardware and cryptographic specifications, evaluate how Shuriko responds to real-world threat models, or read answers to common technical questions.