A full browser — and a P2P network node.
PearBrowser is a real browser for the hyper:// web, an app catalogue, and a site publisher — wired to a social trust graph that powers search, names, and a Nostr feed. Below is every capability, with the same honesty the app uses in its own Settings: shipping features and experimental ones are labeled, never blurred.
Search that runs on trust, not a crawler.
A local-first full-text index over your social graph. Pages you browse are tokenized, signed by a per-app search sub-key, and stored in a local Hyperbee — so Library search returns in under 5ms with zero network.
Federated, opt-in
Toggle “include trusted peers” and local results paint instantly, then a verified-peer set arrives over Hyperswarm and merges in — each hit carrying a provenance badge (you / trusted · hop N). No global crawler, no ranking black box.
Verify-and-drop
Every peer row is re-verified against the contact's signing key and dropped if it doesn't check out. A peer is an index, never an authority — it can serve results, never forge them.
Completeness anchors
Root-signed commitments to an index's length + tree hash let a trusted peer detect a truncated or forked index, so “federated” never quietly means “partial”.
Memorable names, no registrar.
Type a bare word or pearname://alice in the URL bar and a tiered resolver turns it into a destination, each with a provenance chip so you always know how it resolved.
A four-tier resolver
Your private petname wins, then your own claims, then names your trusted contacts claimed, then a curated floor. The highest tier you trust answers — and the chip says which.
Owner-signed registry
Claim a name in a multi-writer Autobase log: first-claim-wins, owner-only rotate/release/revoke, and durable across your devices even after every writer goes offline.
Homograph-guarded
A different owner can't claim a confusable look-alike of a held name — a Cyrillic раypal folds to the same skeleton as paypal and is rejected. Off by default.
A portable identity and a feed — over your trust graph.
Settings shows your npub and a one-click “Link (attested)” / Revoke control that cross-curve-binds your Nostr (secp256k1/BIP-340) key to your Pear Ed25519 root with a monotonic epoch.
Post & read, signed
Compose NIP-01 notes signed with your Nostr key, stored in your own event log. Toggle “include trusted contacts” to read notes a verified contact authored with their attested key — replicated peer-to-peer.
Author-verified feed
Every contact note is checked against that contact's Contacts-held root; an un-attested author never reaches your feed, and future-dated spam can't pin itself to the top.
No relay servers
The feed federates over your own contacts, not a relay fleet. Public wss:// relay transport is a later, opt-in phase — clearly labeled when it lands.
Keys you own, sites that stay up, fetches peers serve.
BIP-39 identity + sub-keys
A 12-word backup phrase, restore-on-a-new-device, and a distinct appPubkey handed to every site. Settings → Connected Apps lists and revokes grants. Contacts are added from signed invites, rejected if forged — and one verified contact powers all the federation: search, names, and notes.
Publish sites, pinned 24/7
Build a site in-app and publish it as a Hyperdrive addressed by key. HiveRelay pins it so it stays reachable even when your machine is closed — this very website is served that way. Live
P2P-first privacy
The proxy tries direct peer-to-peer first and only falls back to a HiveRelay HTTP gateway after a short grace window — so relays stop seeing fetches that peers could have served themselves.
Encrypted device sync Experimental
Pair your own machines with a sync://<key>:<encKey> invite to converge bookmarks over an encrypted Autobase. Scope today is bookmarks — not full tabs / history / profile. Off by default.
Three apps in one
Browse hyper:// sites, install and launch P2P apps from a HiveRelay-backed catalogue, and publish your own — each fully peer-to-peer, no accounts, no DNS, no servers.
See it for yourself.
One install, three platforms. Pear fetches the matching native runtime on first launch.