About this place
Lavabit is a small, self-hosted corner of the internet.
A handful of free tools anyone can use, a few private services behind a sign-in, and a startpage. It runs on its own hardware, serves everything itself, and answers to no ad network.
- Public tools
- Private services
- Your connection right now
How it's built
The GPU box is live: it shows whether the model is awake right now.
Everything arrives at nginx, the front door. It handles encryption, sets strict security headers on every response, and slows down anyone hammering the sign-in.
The gate is the hub you started on: the public tools, the startpage, and the one sign-in for every service. Before opening Files, Status or Chat, nginx quietly asks the gate whether you're signed in. Prospekt asks too, but lets anyone read a report that has been shared.
Chat and Prospekt don't run the model themselves. They hand the work to a separate box with a GPU on the same network, where qwen3.8-27b runs. Conversations and documents stay on these machines. When Chat searches the web, only the search itself goes out. The VPN lets devices in with keys of their own rather than the sign-in.
Pages load nothing from anywhere else: fonts, scripts and icons are all served from here, and the browser is told to refuse anything that isn't. The error pages are served by nginx itself, so they still work when something behind it doesn't.
Not that Lavabit
lavabit.no has no connection to Lavabit LLC or lavabit.com, the encrypted email service that shut down in 2013 rather than hand over its users' keys, and later came back. Same name, different stone.
Privacy, plainly
Written from what the code actually does.
- No ads, trackers or analytics scripts. Nothing on these pages loads from another site.
- The web server keeps logs of requests (address, time, page, browser) to keep things running and stop abuse. They're rotated daily and deleted after two weeks.
- Sign-in attempts are logged with their address, and repeated failures get that address blocked for a while. A signed-in session remembers the address and browser it started from, so it can be listed and ended.
- Two small cookies, at most. The session, only if you sign in. And your theme, only if you pick light or dark: it holds just that word, so every lavabit.no page can show the same colours.
- Things fetched on your behalf, like weather from MET Norway, headlines from NRK and site icons, are fetched by the server, so your browser never contacts those sites just by opening a page here.
- The public tools show you your own address and headers. They aren't stored.
- The contact form keeps what you send (message, email address, and name if you give it) for up to 90 days, then deletes it. Your network address is only used to limit how often messages can be sent.
Contact
Use the contact form. It has a small puzzle on purpose. If that doesn't work for you, send an email:
Colophon
Headings in Fraunces, text in Schibsted Grotesk, numbers in IBM Plex Mono. Warm stone and cool water, with ember saved for things that are live. Weather data from MET Norway (CC BY 4.0), headlines from NRK.