ISS
← Field Notes
Security & Privacy screenshot
June 23, 2025 · Security & Privacy · 2 min read

A Social Platform Where Ed25519 Keys Are the Account

A decentralized social platform where users own their space through cryptographic keys, with real-time cross-device sync and no accounts, servers of record, or tracking.

walled.garden is a decentralized social platform built on a simple inversion: your keys are your account. Users own and control their digital spaces, called gardens, through cryptographic signatures rather than through a username, a password, and a company's database. The tagline captures the intent, your space, your rules, synced forever. It lives at walled.fun.

Ownership without accounts

A garden is claimed through an Ed25519 signature. There is no sign-up, no email, no account row on someone's server. You generate a keypair, and possession of the private key is what proves you own the garden. That single decision cascades through the rest of the design. Because there are no accounts, there is nothing to harvest, and the platform can honestly say zero surveillance and no data collection, since it never holds the identifying data in the first place.

The obvious cost of keys-as-identity is key management, and the design takes that seriously rather than hand-waving it. Keys are generated with an automatic backup download, and there is explicit export and import so you can move between browsers and devices and never get locked out. Anyone who has built a crypto-identity system knows that lost-key handling is the whole game, because ownership you can permanently lose is a trap, not a feature.

Sync as a distributed state problem

The other hard part is that ownership by key and real-time cross-device sync pull in opposite directions. There is no central account tying your devices together, yet posts need to appear across all your browsers and devices in real time. walled.garden handles this with a distributed state model. Cryptography is Ed25519 via @noble/ed25519, and real-time synchronization runs on Multisynq/Croquet, with keys kept in browser localStorage and content synced to the cloud.

Layered on top is a privacy model that only makes sense once identity is cryptographic. Content can be public, private, friends-only, or owner-only. A circle of trust lets you add friends and control who sees private posts, and direct messaging supports owner-only messages to a garden's creator. Because the poster's identity is a verifiable signature, "friends-only" can mean something enforceable rather than a UI toggle over a shared database.

The frontend is Next.js and React with Tailwind, and it runs locally against a Multisynq API key for anyone who wants to stand up their own instance.

The lesson I take from building this is that going keyless-account changes every downstream decision. You gain genuine ownership and genuine privacy, and in exchange you inherit key backup and distributed sync as problems you cannot skip. Those two are the real engineering, and any honest crypto-ownership platform is mostly a careful answer to them.

Have something that needs building, or stabilizing?

These notes are the work log. The paid work runs through Moonshine Labs, my product and engineering studio. Tell us what you're building, or grab a call.

Work with us →
the studio: moonshinelabs.io