Neptunium

A red-and-black Chromium desktop browser built with Electron, TypeScript, React, and Vite. Its start page contains only a search field, small branding, and a locally generated animated background. There are no advertisements, sponsored shortcuts, news feeds, or remote wallpaper requests in the browser interface.

Full uBlock Origin 1.75.0 comes preinstalled. The official extension distribution is included unchanged; a small Electron compatibility layer supplies the browser APIs it needs. This is uBlock Origin, not uBlock Origin Lite. Browsing waits for its filtering engine to initialize, including on the first launch. Use the shield in the toolbar to open its own controls, disable filtering for a site, or open its dashboard. Website blocking depends on the enabled filter lists and site behavior; Neptunium adds no advertising itself.

Launch the Windows app

Run Neptunium-1.1.0-Windows-x64-Setup.exe on Windows 10 or 11 (64-bit Intel/AMD). The setup wizard lets you choose an installation folder and installs Start menu and desktop shortcuts. Start Neptunium from either shortcut. Node.js is not needed. The installer includes the entire browser, fonts, QR decoder, and uBlock Origin; filter-list updates still use the network.

On first launch, create a profile with its own password of at least 10 characters. Leave Remember this profile on this device checked to open it automatically on future starts. For an existing profile, enter its password once with that option checked, or enable it in Browser profile. Remembering also makes it the startup default. If upgrading from 0.3, the first profile can import your previous tabs, bookmarks, passwords, and site storage. The old files are retained as a recovery copy and are never loaded by another profile. Subsequent profiles start empty. No profile password is chosen or stored in plaintext by the installer.

Existing profiles keep their passwords and data when upgrading to 0.7. Browser tools → Updates shows update status. Installed Windows builds check for stable releases 20 seconds after launch and every four hours, then download newer releases automatically. Choose Restart and update to install; save unfinished page changes first. Ordinary closing, locking, and switching profiles never trigger installation. A password generator is not included.

Uninstall through Settings → Apps → Installed apps → Neptunium, or its uninstaller. Uninstalling preserves your browsing profile, workspaces, and settings so reinstalling can restore them. This is an unsigned development build; Windows may show an unknown-publisher notice. Updates use HTTPS and SHA-512 integrity verification, including another check immediately before installation. This is not Authenticode publisher verification; a trusted signing certificate has not been configured.

Update requests use a separate cookie-free session restricted to the public Neptunium-Releases download path and Forgejo's attachment redirects on that same HTTPS host. No profile credentials or website cookies are sent. Private windows, development runs, portable folders, and unsupported platforms do not run the updater. Releases include the whole browser runtime and bundled extension. See release instructions for publishing new versions from the public source repository.

The earlier portable ZIP remains available: extract it and open Neptunium.exe. Keep the runtime files and resources folder alongside that executable.

When moving from the portable app to the installer, export any custom uBlock settings in its dashboard first and import them after installation. The extension's identity depends on its installation path, so moving the app can create fresh extension settings. Browser tabs and workspace preferences stay in the Neptunium profile.

Run from source

Install Node.js 24 LTS, open a terminal in this folder, and run:

npm ci
npm run dev

The first launch may download Electron. UI and CSS edits refresh automatically. Restart the command after editing electron/ or shared main-process constants. Development uses port 5173. The UI needs Electron's preload bridge, so opening the Vite URL in an ordinary browser will not run the app.

npm run build
npm start

To produce a Windows folder from source: npm run package. The packaging script uses the installed Electron runtime; no extra packaging dependency is required.

To build the Windows setup installer on Windows, run npm run dist:win. It builds the app, stages only runtime files, and uses the pinned electron-builder/NSIS toolchain. The result appears in installers/. The first build downloads the required packaging tools. No certificate is required for this unsigned development installer. Build Mac PKGs on a Mac with npm run dist:mac; the Apple silicon package appears in installers/. Build Linux x64 .deb and .AppImage packages on Linux with npm run dist:linux; these also appear in installers/. Every future release includes Linux alongside Windows and macOS; see the platform release checklist.

Linux

Ubuntu and Kubuntu users should install the versioned x64 .deb from the public NAS release with sudo apt install ./Neptunium-X.Y.Z-Linux-amd64.deb, replacing X.Y.Z with the downloaded version. A new package upgrades the existing installation. Launch Neptunium from the application menu as your normal user; do not run the browser as root. Neptunium-X.Y.Z-Linux-x86_64.AppImage is a portable alternative: make it executable and launch it as your normal user on a system that supports Chromium's sandbox. The filenames use each package format's name for the same 64-bit Intel/AMD architecture. Neither package adds a sandbox-disabling fallback. If the AppImage cannot use the sandbox on your distribution, use the .deb instead of adding --no-sandbox.

Linux 1.0.1 and later check and download updates automatically. Choose Restart and update to install; DEB installations request administrator approval, while a writable AppImage is replaced at its existing path. Linux 1.0.0 and earlier need one manual upgrade to gain this feature. Browser data stays in the user's Neptunium configuration directory when updating. Remembered profile access requires a working OS secret store; password unlock remains available when secure storage is unavailable. Keep installation, desktop integration, graphics, and distribution-specific results separate from a WSL or virtual-display smoke test.

macOS

The Mac PKG installs into /Applications. Use Neptunium-1.1.0-macOS-arm64.pkg on Apple silicon. Intel Macs use the last compatible release, 1.0.1. These builds are ad-hoc signed, without Apple notarization or a Developer ID Installer signature. macOS may require approval to open/install them.

Native window controls are on the left, with reserved space beside the Neptunium logo. Green toggles fullscreen; the Window menu and Control+Command+F also toggle fullscreen. Browser tools → Updates downloads verified PKGs from the NAS. Install update saves the browser session and opens Apple Installer after closing Neptunium. Respond to macOS prompts and close Installer when finished; the helper reopens /Applications/Neptunium.app only after its bundle identity, version, and replacement are verified. Cancelling installation does not report success or reopen a different application.

Profile sync

Open Profile settings → Profile sync, or Browser tools → Profile backup. Enter your server address and connection details, or use Import server connection to select a private connection JSON file supplied by your server administrator. Choose a sync passphrase of at least 12 characters and use the same details on other devices linked to this profile. Different profiles should have separate sync names, tokens, and passphrases.

Bookmarks, saved passwords, authenticator accounts, settings, history and saved tab groups merge across devices. Offline changes remain local and retry automatically while the profile is unlocked. Concurrent edits are reconciled against the last shared state; deletions do not resurrect old entries, distinct credentials are retained, and conflicting edits require a choice. The server receives encrypted snapshots only. Live tabs, cookies and sign-ins, permissions, downloads, uBlock settings, profile passwords and device unlock keys stay local. Continue using separate encrypted profile backups for recovery and tabs.

See self-hosting and sync details and server setup. A connection file contains a secret access token: keep it private and share it only with devices intended to share that profile.

App windows

Launch a website without the tab strip, address bar or sidebar:

Neptunium.exe --app=https://example.com/
neptunium --app=https://example.com/
open -na Neptunium --args --app=https://example.com/

These are Windows, Linux and macOS examples respectively. Quote the entire --app=URL argument when the URL contains shell-special characters. App windows open directly without creating or unlocking a browser profile. They share a dedicated persistent website session (AppMode/Chromium under Neptunium's user-data folder), so website sign-ins and storage survive restarts. uBlock filtering remains enabled. Protected browser profiles, their cookies, saved passwords, authenticator vaults and sync data are not opened or shared with app windows. Website permissions are requested per visit; profile password autofill is unavailable in this mode. Launching another app URL opens another window. Normal browser tabs remain separate, and app windows are not added to the saved browser tab session. Ctrl/Cmd+R reloads, Ctrl/Cmd+F finds text, Ctrl/Cmd+W closes the app window, and Ctrl/Cmd+L opens its address in the full browser.

Right-click Open link in new tab opens a background browser tab. Unfinished text in the top address bar and central new-tab search stays with each tab when switching. These drafts stay in memory, are cleared by navigation or tab closure, and are not saved across browser restarts or profile locking.

App controls are available from the page context menu or Alt+M. You can copy the address, open another app window, change zoom, reset visit permissions, open uBlock Origin or inspect the page. Ctrl+J (Command+J on macOS) lists app-session downloads with pause, resume, cancel, retry and show-in-folder actions when available. F12 opens developer tools for the website.

Native Chromium app windows

Plain --app=URL uses Neptunium. Choose Open in Chromium app window in App controls, or select the native engine at launch.

neptunium --app-engine=chromium '--app=https://example.com/'
neptunium --app-engine=chromium --app-id=abcdefghijklmnopabcdefghijklmnop

The second command takes the ID of a web app already installed in the native browser. To select its profile, add a flag such as "--profile-directory=Profile 1". Chromium, Google Chrome or Edge supplies its own app menus, permissions, downloads, extensions, developer tools and installed web apps. These windows use that browser’s profile and site sign-ins. Neptunium’s bundled uBlock Origin runs in the Neptunium engine. To select a particular native browser, set NEPTUNIUM_CHROMIUM_PATH to its absolute executable path. From a source build, pass the same flags after npm start --.

AI browser

Open Browser tools → AI browser in an unlocked regular profile. Choose New background tab to keep browsing while the AI works, or Share this tab to work on the same page. Select Start session. Both modes use the profile’s website sign-ins. The AI can read the assigned page, follow links, click controls, fill text fields and choose options. It has its own cursor and works with controls in the main page. Embedded frames, password fields, file pickers and browser dialogs require human input. On a shared page, navigation changes the page for both of you.

• Follow AI switches to its tab and shows its cursor. Switch tabs or choose Stop following to resume independent browsing. The AI cannot fill the field you are typing in on a shared page.
• External AI client. Configure a local Streamable HTTP MCP client with the endpoint and bearer token shown in the panel. For clients that accept headers, use Authorization: Bearer <token>. Each session has a new address and token.
• Model API. Enter the full Chat Completions endpoint, model name and optional API key for a provider that supports function calling. HTTPS and local HTTP endpoints are supported. Enter a task and choose Run task. Requested page content goes to that provider. Stop task cancels the run. The API key is held in memory.
• Stop session disconnects clients and cancels the current task. Closing the assigned tab or locking the profile also ends control.

Controls

• Profiles: regular launches automatically open the startup default when it is remembered on this device; otherwise they show the profile picker. Select a profile and enter its password. The profile menu supports renaming, password changes, a startup selection, lock-on-minimize, and idle locking (15 minutes by default; configurable). Windows screen locking also locks Neptunium. Lock or switch saves the session and restarts the process at the picker; save unfinished forms first. The startup default opens automatically only after that profile has been explicitly remembered. Locking (including automatic and screen locks) requires a password again, even after restarting; unlocking one profile never removes another profile’s lock. Changing a password revokes its remembered access.
• Password autofill. Save multiple accounts for a website. Click a supported login field or tab to it, then choose an account from the small menu beside the field. The default account appears first. An existing username limits the chooser to its matching login. Browser profile → Autofill saved passwords controls the chooser independently from offers to save new passwords.
• Default browser: Settings → Set as default browser opens the system selection flow. Confirm Neptunium when your operating system asks.
• Authenticator: open Authenticator to add a setup key, import authenticator.txt using Import file, paste setup links, or select local QR images from Google Authenticator's export flow. Select all images from a multipart export together. Review the listed accounts and confirm the import; imported accounts then show live codes and countdowns. Copy code uses the clipboard only when clicked and clears an unchanged copied code after 30 seconds or when locking. Delete requires confirmation.
• Authenticator backups: Export backup writes a .npauth file encrypted with a separate passphrase you choose. Import backup requests that passphrase and shows an account preview before confirmation. This is an explicit copy, including when importing into another profile; profiles never share accounts automatically. Keep your original authenticator until you have checked the imported codes. Neptunium does not connect to Google or import Google's cloud backups directly.
• Bookmarks: use the address-bar star or Ctrl/Cmd+D to save/remove the current page. Open Bookmarks from the toolbar or sidebar to search, edit titles/addresses/folders, open a saved page, or remove an entry. Bookmarks persist across restarts.
• Bookmark transfer: Browser tools → General imports standard browser HTML or Neptunium JSON files and exports either format. Nested HTML folders become folder paths. Existing bookmarks are preserved, duplicate addresses are skipped, and imports that exceed the 2,000-bookmark library limit are rejected before changing it. HTML/JSON exports are ordinary readable files; use an encrypted profile backup for protected storage.
• Passwords. Submitting a supported login shows a save or update bar above the page. Passwords groups related subdomains automatically and keeps accounts on separate hosting tenants apart. Choose Check related sites to group different domains that publish matching Digital Asset Links for sign-in. This reads public declarations directly from your saved HTTPS sites without sending cookies or account details. The grouping is saved in your encrypted vault. You can add, edit or delete each login. Autofill still checks the exact saved origin, including scheme and port.
• Sidebar toggle: retract or expand the workspace panel. Websites resize to fill the reclaimed space.
• Workspaces: select Personal, Work, or Research, or create your own. Right-click a workspace to move the current tab there or remove the workspace while keeping its tabs.
• Groups: create a named group for the current tab. Right-click other tabs to add them. Group chips collapse; the active page remains accessible.
• Tab menu: right-click to pin, move, group, duplicate, close, or sleep an inactive tab.
• Sleep: explicitly frees an inactive page's web contents. Waking reloads the page and restores its in-memory navigation history. Unsaved page state may be lost; audible tabs cannot be slept. Browser tools → Tabs & groups adds optional automatic sleeping after 5, 15, 30, or 60 minutes, disabled by default, with exact-hostname exceptions. Active, pinned, loading, audible, media-permitted, downloading, and detected edited tabs are excluded. Automatic sleeping cannot preserve arbitrary application state; add exceptions for sites whose state matters.
• Tab organization: drag tabs within a workspace to reorder them. Browser tools → Tabs & groups switches between horizontal and vertical tabs, and saves the current workspace's website tabs as a named group. Saved groups reopen into a new group; saving stores addresses and titles, not website sign-ins or form contents.
• Website icons: regular, pinned and vertical tabs use each website's own icon. A globe is shown when no usable icon is available. Icons are loaded within the tab's profile and converted to small local images; no third-party icon service is used.
• Tab search: finds open tabs across all workspaces and switches to the selected result.
• Settings → Background motion: turn the home-page animation on or off (on by default, saved per profile). The Motion on/off button on the home page does the same. Reduced-motion settings produce a static scene.
• uBlock Origin: the shield opens the genuine extension popup for the active page. Its dashboard supports filter lists and custom filters. Settings also shows whether the extension started successfully.
• Session restore: tabs, workspace/group membership, pins, order, recently closed tabs, sidebar, and motion preferences survive restart. Inactive restored pages load only when selected. Encrypted session snapshots and a previous-snapshot copy support recovery after an unexpected shutdown; a recovery notice is shown when needed. This restores addresses, not unsaved forms or the complete back/forward stack after restart.
• Downloads: choose a save location, then use Browser tools → Downloads for progress, pause/resume where the download supports it, cancel, retry, remove a record, or show its file in the system folder. Interrupted downloads can be retried after restart; cross-restart byte-range resume is not implemented. Downloaded files remain when their records are removed.
• History: Browser tools → History searches visits by title or address, opens entries, and removes individual visits. Each profile keeps its own history. Both search boxes suggest main website addresses from this history and bookmarks, keeping subdomains separate and combining visits to paths on the same site. Suggestions show the site's declared name or a saved page name above its main address; names are learned only from pages already visited. Empty-field recommendations require at least three visits and rank by usage count, then recency. Typing can find matching page titles or bookmarks and completes a frequent website address with a selected suffix; deletion and IME composition do not force completion. Use Up/Down and Enter to choose a suggestion, or Escape to dismiss it. Address suggestions float above the page without moving the toolbar, bookmarks, or website. Recommendations are computed locally and contain no sponsored sites. Private windows neither save history nor show profile suggestions.
• New-tab shortcuts: Add your own shortcuts with Add shortcut. Right-click a shortcut to edit or remove it. Up to twelve shortcuts are saved separately in each profile and included in encrypted profile backups and sync. History never adds or changes these shortcuts.
• Website permissions: camera, microphone, location, and notification requests show the requesting website. Allow once, allow always, block always, or dismiss; saved choices belong only to this profile and can be removed in Site permissions. Private windows offer temporary choices only. Requests from unsupported contexts, including embedded frames, are denied.
• Teams meetings. When you select Join now, allow the requested camera or microphone. To change a previous choice, open Browser tools → Site permissions.
• Page tools: find text on the current page, set zoom from 25% to 300%, print through the system dialog, or save a PDF. Right-click pages for navigation, text editing, opening/copying links, and saving supported links or images.
• Browsing data: clear history by the last hour, day, week, or all time. Cookies, cache, and website storage are cleared for all time, either across the profile or for a specified website. Clearing site cookies can also sign out related subdomains. Bookmarks, saved passwords, authenticator accounts, and uBlock settings are kept.
• Private windows: open a separate temporary session from General or Ctrl/Cmd+Shift+N. Each private window has isolated site and uBlock storage; saved profiles, bookmarks, passwords, and authenticators are unavailable. Closing or locking the parent browser also closes its private windows. Downloaded files and exported PDFs remain on your device.
• Search and default browser: General selects Google, DuckDuckGo, Bing, or Brave Search for address-bar searches. On Windows, Set as default opens Windows Default apps so you can choose Neptunium for website links; Neptunium does not silently take over existing associations.

Encrypted profile backups

Browser tools → Profile backup exports an encrypted .npprofile file using a separate passphrase of at least 10 characters. It includes bookmarks, saved passwords and preferred accounts, authenticator secrets, open/recently closed tab sessions, profile preferences, search and tab settings, history, saved groups, website permission choices, and download records. Files that have never been created are omitted.

The backup excludes website cookies and sign-ins, cache and site storage, uBlock custom settings and extension storage, downloaded file contents, operating-system/default-browser settings, other profiles, and legacy recovery files. Export custom uBlock settings separately from its dashboard when needed. This is a portable copy of Neptunium-managed data, not a complete disk image of Chromium's profile.

Restore is available both from the profile unlock screen and Browser tools → Profile backup. It asks for the backup passphrase, a new profile name, and a new profile password. The complete backup is authenticated and validated before the new profile is published. The restored profile has a fresh encryption key and isolated directory; existing profiles and their startup selection are preserved. Select the restored profile and unlock it with its new password; when restoring from an open profile, lock/switch first. The 12-profile limit still applies.

Remembered-device keys are excluded from backups. Both the profile password and backup passphrase are unrecoverable. An existing backup with a known backup passphrase can restore its saved contents under a new profile password, even if the original profile password is lost. Keep an independent copy of the encrypted backup and its passphrase. A backup only contains the data present when it was exported.

Shortcut	Action
Ctrl/Cmd+L	Address bar
Ctrl/Cmd+D	Save or remove current bookmark
Ctrl/Cmd+T	New tab
Ctrl/Cmd+W	Close tab
Ctrl/Cmd+Shift+T	Reopen the last closed tab
Ctrl/Cmd+R or F5	Reload
Ctrl/Cmd+Tab or Ctrl/Cmd+Shift+Tab	Next or previous tab in the workspace
Ctrl/Cmd+Shift+A	Search all tabs
Ctrl/Cmd+B	Toggle sidebar
Ctrl/Cmd+F	Find on page
Ctrl/Cmd+J	Downloads
Ctrl/Cmd+H	History
Ctrl/Cmd+Shift+N	New private window
Ctrl/Cmd+P	Print page
Ctrl/Cmd with Plus, Minus or 0	Zoom in, zoom out or reset
Alt+Left or Alt+Right	Back or forward

Performance choices

The home-page scene contains one large, continuous red plasma thread inspired by the Petrova line in Project Hail Mary. Nested fine strands and asymmetric white-hot folds move within a wider shared envelope, broad at the left and gradually tapering toward the right. A brighter cached starfield remains visible above and below. The scene is generated locally; it contains no ship or imported film imagery. Cursor movement gently deflects nearby internal strands independently, using different damped spring responses that settle when the pointer leaves; typing sends fading light surges through the volume. Flow and brightness respond to typing cadence and settle gradually. Reactions use only pointer positions and anonymous key-event timing: key names, codes and typed text are never read or stored by the background. Dialogs, password fields, authenticator forms and profile screens do not drive these effects. There are no skyline, circuit or grid overlays. Aldrich headings, Electrolize controls and Funnel Display body text are bundled locally; no font service is contacted.

The procedural canvas uses a reusable 384 × 216 light field with one continuous volume and six internal folds, cached falloff and exposure tables, 96 drifting particles, a cached starfield and at most eight simultaneous typing surges. Eighteen bright forked folds and 48 fine filaments render at display resolution to keep thin strands smooth. The folds retain one shared centerline and envelope, with small independent local cursor offsets capped at 12 CSS pixels at 720p (at most 16 pixels on larger windows). Geometry is calculated once per column independently of display resolution. Local spring motion reuses its buffers and skips node processing once the pointer is absent and the strands have settled. It runs at a maximum of 30 FPS, with a pixel-density cap of 1.5 and a 3.5-million-pixel canvas limit. It pauses when the window loses focus or is hidden, respects reduced motion, and is removed while browsing a website. It uses no downloaded images, video, animation library, or React state updates per frame. Blank tabs allocate no extra Chromium web contents; restored inactive tabs remain unloaded. Inactive views use Chromium background throttling. There is also a manual sleep command.

Chrome is the performance target; Opera GX is only a loose visual reference. See performance measurements for the matched local workload, process memory and CPU results, and the limits of that comparison.

Project layout

electron/main.ts              Window, tabs, views, workspaces, sessions, validated commands
electron/blocker-startup.ts   Bounded filtering readiness checks and recoverable retries
electron/preload.ts           Small bridge exposed only to the local UI
electron/bookmarks.ts         Persistent bookmark library and atomic bulk import
electron/bookmark-transfer.ts Inert Netscape HTML and JSON bookmark exchange
electron/passwords.ts         Profile-encrypted password vault and origin checks
electron/profiles.ts          Profile authentication, encrypted keys and preferences
electron/authenticator.ts     TOTP, Google QR imports and encrypted backups
electron/profile-backup.ts    Portable encrypted backup validation and restore
electron/browsing-services.ts Permissions, downloads, history and browser settings
electron/private-session.ts   Isolated private processes and temporary-data cleanup
electron/page-preload.ts      Private, isolated sign-in form observer
src/App.tsx                  Interface and interactions
src/styles.css               Red/black theme and layout
src/ProceduralBackground.tsx  Local canvas animation and motion controls
src/thread-motion.ts          Independent local spring motion for plasma strands
src/ProfileGate.tsx           Profile setup and unlock screen
src/ProfilePanel.tsx          Profile preferences and password changes
src/AuthenticatorPanel.tsx    Local QR decoding and authenticator controls
src/BrowserToolsPanel.tsx     Downloads, history, permissions, backups and settings
src/fonts/                   Bundled Aldrich, Electrolize and Funnel Display fonts
shared/browser.ts            Shared types and native-view dimensions
shared/navigation.ts         Address/search parsing and protocol validation
shared/features.ts           Browser tool commands, state and preferences
assets/                      Neptunium icon
extensions/uBlock0.chromium/  Official, preinstalled uBlock Origin
third-party/                 Licenses, upstream sources, and compatibility notes
scripts/                     Launch, build, portable packaging, integration checks
electron-builder.config.cjs   Windows setup installer configuration
electron-builder.mac.cjs      macOS PKG installer configuration
electron-builder.linux.cjs    Linux DEB and AppImage configuration
build/icon.png               Installer/executable icon
tests/                       Navigation, profiles, vaults, transfers and browser services

dist/, dist-electron/, .runtime-extensions/, release/, installers/, .installer-app/, and test-results/ are generated. Session data is stored under Electron's Neptunium user-data directory; on Windows this is normally %APPDATA%/Neptunium. Site data and cookies live in a separate persistent Chromium session from the local UI.

Scope

Remote pages are sandboxed, isolated, and cannot use Node.js or the UI bridge. HTTP(S) addresses are accepted; local files and executable URL schemes are rejected. Normal web security and certificate checks stay enabled. Camera, microphone, location, and notification access requires a supported active main-frame request and an explicit or previously remembered allowance. Other permission types remain denied. No extension store, DRM setup, or password generator is included. HTTP(S) sign-in popups open as sandboxed tabs while preserving Chromium opener messaging, referrers, POST bodies and self-close behavior. Deferred blank sign-in windows are supported. Provider-specific restrictions and some multi-step sign-ins still require manual testing.

Each regular profile has a UUID directory under %APPDATA%/Neptunium/Profiles/. Its Chromium session uses that profile's Chromium/ directory for cookies, local storage, cache, service workers, and extension data. A regular profile's browsing session and extension instance are created after unlocking. Only one regular profile runs at a time; switching restarts the entire process to stop pages, workers, and extension background pages from the previous profile.

Private browsing runs a separate process with a fresh UUID directory under PrivateSessions/, including temporary Chromium and extension data on disk. The parent removes that directory after the private process exits normally; abandoned directories are retried on the next normal startup. A crash or locked file can leave temporary data until cleanup succeeds. Private mode is not a guarantee of secure disk erasure, network anonymity, or protection from software running as your operating-system user. Downloads and PDFs intentionally saved outside the temporary directory are not removed.

Profile passwords derive wrapping keys with scrypt (N=65536, r=8, p=1 and random salts). Each profile gets a separate random data key protected with AES-256-GCM. Bookmarks, restored sessions, passwords, authenticator seeds, preferences, history, permissions, download metadata, and saved groups use authenticated encryption under that key. Changing a profile password rewraps the key, preserving its data. Profile names and the startup selection are public; no saved logins or authenticator secrets appear in the profile catalog. Wrong passwords are rejected and repeated attempts are delayed. Damaged encrypted files are preserved rather than reset. Portable profile and authenticator backups use their own random salts and separately derived encryption keys.

Remembered access stores only an OS-encrypted copy of that profile’s data key, bound to its UUID and current password wrapper. It never stores your password. Anyone using the same operating-system account can open a remembered profile. When secure OS storage is unavailable (including Linux’s basic-text fallback), password unlock is required. A lost profile password cannot be recovered. Keep authenticator backups and their separate passphrases safe. Browser profiles isolate data within Neptunium; they are not separate operating-system users. Chromium's own storage is separate per profile but is not wholly encrypted by the profile password, and this system does not protect against malicious software with access to your Windows account. Previous 0.3 files retained during migration keep their original protections (including OS encryption for the old password vault).

Password capture and fill support conventional top-level, same-origin sign-in forms on HTTPS websites; loopback HTTP addresses are supported for local development. The account chooser appears beside the selected field. Click an account or use the arrow keys and Enter. Escape closes the list. Autofill requires an exact origin match including the port, preserves typed values, and never submits. Username-only login steps can receive the username without receiving the password. Hidden fields, registration/new-password fields, cross-origin form actions, frames, and forms that opt out are skipped. Ambiguous forms and some JavaScript-only sign-ins need manual entry. The Passwords panel retains explicit Fill and Show controls. A save prompt indicates a form was submitted, not that the website confirmed a successful sign-in.

Bookmarks, passwords, and session state live in bookmarks.vault, passwords.vault, and session.vault inside their profile directory. Authenticator seeds live in authenticator.vault; permissions, history, download records, browser preferences, and saved groups live in browsing.vault. The installer preserves profiles when upgrading or uninstalling.

The authenticator implements RFC 6238 TOTP with SHA1, SHA256, or SHA512, 6 or 8 digits, and configurable periods. Google Authenticator's offline QR export and standard otpauth://totp setup links are supported; HOTP counter accounts and unsupported exports are rejected without a partial import. Google migration QR encoding is not a published standard, so future format changes may require an update. Code accuracy depends on your computer's clock. There is no camera scanning, automatic login submission, or cloud synchronization.

Windows is the tested target; the current portable packaging command is Windows-only. Keep Electron and the bundled uBlock Origin release updated when preparing releases. uBlock can update its own filter lists; application updates replace its bundled extension and Electron runtime only when a new Neptunium release includes those changes. If the blocking engine takes longer than 45 seconds, the interface reports the delay and keeps checking. Reload or the shield retries startup without resetting extension storage or custom filters. Navigation stays paused until both the filtering engine and its network observers are ready. The local blocker-startup.json diagnostic contains only version, timing, attempt count and startup flags; it contains no website addresses, account data or filter contents.

The compatibility build preserves Chromium's native blocking events and aligns its extension API namespaces. It does not edit uBlock Origin. See third-party/NOTICES.md for versions, upstream sources, licenses, and the reproducible patch in scripts/build.mjs.

Checks

The 0.7 review records website compatibility, recovery and data protection, security and the patch schedule, and performance against Chrome. These reports distinguish observed passes from remaining manual checks and platform limits.

npm test
npm run build
npm run test:ai
npm run test:meeting
npm run test:app
npm run test:smoke
npm run test:features
npm run test:suggestions
node scripts/address-suggestions-overlay-smoke.mjs
npm run test:autofill
npm run test:profiles
npm run test:migration
npm run test:compatibility
npm run test:security
npm run test:recovery
npm run test:blocker-startup
npm run test:background
npm run test:favicons

The integration suite uses real Electron with local test pages and an isolated profile. It covers navigation, page isolation, errors, tabs, sidebar geometry, workspaces, groups, pins, sleeping/waking pages, overlays, motion preferences, session restoration, and actual uBlock request blocking. Screenshots are saved in test-results/. A desktop session is needed for Electron; the integration run briefly shows the window for animation and screenshot checks.

Run npm run test:meeting for the local audio and video call, npm run test:ai for MCP and model-controlled browsing, and npm run test:app for app windows.

The feature suite exercises bookmark controls and persistence, explicit password capture/save/fill/delete, encrypted vault contents, and rejection of filling on a different host or port. All test credentials are fictional and used only on local fixture pages. Set NEPTUNIUM_PACKAGED_EXE to a packaged Neptunium executable to run the feature suite against that build.

The suggestions suite runs the real renderer in headless Chrome with synthetic profile data (Chrome must be installed). The native overlay regression uses a hidden, sandboxed Electron window and loopback pages to check unchanged website geometry/scroll, mouse and keyboard selection, and profile cleanup. It checks both search fields, keyboard and mouse selection, private/profile boundaries, cleared history and small-window layout without opening a desktop window or contacting suggestion services. The autofill suite uses hidden, sandboxed Electron windows with the real manager and page preload, temporary encrypted vaults and local fixture forms. It checks account selection, trusted interaction, stale replies, skipped forms and profile isolation; it explicitly rejects showing or focusing its windows. Neither test touches installed profiles.

Profile and authenticator tests cover password authentication, key isolation, password changes, encrypted persistence, RFC TOTP vectors, Google multipart imports, and passphrase-protected backups. Integration checks use real password unlocks and separate test profiles, never an authentication bypass.

The profile-backup tests cover wrong passphrases, authenticated tampering, complete payload validation, unchanged source profiles, recovery under a new profile password, authenticator code preservation, and cancellation when the profile locks during restoration. Bookmark-transfer tests cover inert HTML parsing, nested folders, Unicode and entity escaping, unsafe URL rejection, duplicate skipping, encrypted atomic imports, and capacity limits. These are test commands and coverage descriptions, not a claim that every platform or website has been validated.