Agent keeps the TLS key
Your agent serves the certificate and terminates TLS for the tunnel route.
End-to-end encrypted tunnels on nfltr.xyz
One command.
Encrypted by default.
Relay stays blind in verified mode.
Start a public tunnel in seconds while keeping TLS termination on your agent. Use proof endpoints and fingerprint checks to verify what mode your route is running in.
Terminal - encrypted tunnel via nfltr.xyz
# E2EE is enabled by default for tunnel commands
$ nfltr http 8080
nfltr latest
Mode verified (agent terminates TLS)
Server nfltr.xyz:443 (routes by SNI)
Forwarding https://abc123.nfltr.xyz/ -> http://localhost:8080
Connected - waiting for requests...
Default
verified mode for
tunnel commands
tunnel commands
Blind
relay does not read
HTTP bodies in verified mode
HTTP bodies in verified mode
1 cmd
from localhost to
public encrypted URL
public encrypted URL
How encrypted routing works
The trust boundary is simple: your agent handles TLS identity, the relay handles routing.
Relay routes by hostname
The relay uses SNI and forwards opaque traffic to the connected agent.
Inspectable mode is explicit
Use --e2ee=false only when you want traffic inspection for debugging.
Proof over promises
Verify route mode with public artifacts
Check mode labels, proof JSON, and fingerprint matches to confirm what is running in production.
Check mode label
Dashboard and agent output should show Verified for blind relay routing.
Open proof JSON
Confirm blind_relay: true for the route you exposed.
Match fingerprints
Ensure the agent fingerprint matches the public proof entry.
These checks give you concrete evidence that the route is running in verified mode with agent-held TLS identity.
Quickstart in three steps
Start local, publish encrypted, then verify mode.
1. Download
# macOS (Apple Silicon)
curl -fsSL https://storage.googleapis.com/nfltr-downloads/latest/nfltr-darwin-arm64 \
-o nfltr && chmod +x nfltr
# Linux (x86_64)
curl -fsSL https://storage.googleapis.com/nfltr-downloads/latest/nfltr-linux-amd64 \
-o nfltr && chmod +x nfltr2. Run a tunnel
# Verified mode by default
nfltr http 8080
# Optional stable endpoint
nfltr http 8080 --name my-api --api-key $NFLTR_API_KEY3. Verify behavior
# Inspect proof artifacts
open https://nfltr.xyz/proof/my-api.json
# Compare fingerprint from agent output
# with tls_fingerprint in proof JSONDownload the agent
Single binary for Linux, macOS, Windows, ARM, and WASM.
Latest: latest
Ship your first encrypted tunnel now
Start fast, then verify exactly how the route is handled.