Why I built a box that keeps my browsing away from anyone but me

A while back I ran into a website that wanted me to verify my identity before it would let me in. The options included scanning my face or handing over my bank card details to a third-party verification company I'd never heard of.

That struck me as a strange trade-off. I was being asked to share sensitive information with another company, one I had no particular reason to trust, simply to access a website. What would it store? How long would it keep the information? What would happen if its systems were compromised?

I couldn't see why accessing a website should automatically mean putting more of my personal information into someone else's hands. And the more I thought about it, the more I realised this wasn't just about one website or one particular kind of verification. It was a broader problem with how much information we're increasingly expected to hand over online.

Once a copy of your identity documents or biometric data has been exposed, you can't simply change your face or take that information back. The company collecting it might be doing everything right, but you're still taking on a risk you wouldn't otherwise have had.

This isn't just a theoretical concern. In October 2025, a security incident involving a third-party customer support provider used by Discord exposed government-ID photos associated with approximately 70,000 users. The incident was a reminder that when we hand information to one service, it can end up with other organisations too. Each additional hand-off comes with its own set of risks. TechCrunch reported on the breach.

Around the same time, the UK's online safety rules brought new attention to how websites verify users and what those checks can mean for personal privacy. I wasn't particularly interested in arguing about what websites should or shouldn't require. What bothered me was the data collection itself, and whether there was a way to avoid exposing so much information in the first place.

So I started looking at alternatives.

One of them was Tor. It's free, open-source software that routes internet traffic through a series of relays, helping separate your home IP address from the websites you visit. It's a well-established privacy tool, but using it for just a handful of websites across several devices isn't particularly straightforward.

You can configure browsers individually, use extensions, or set things up at the network level. Each approach has its own complications. If you want the same arrangement on a laptop, a phone and a tablet, you're potentially repeating the work several times. And if you only want certain websites to use Tor, you don't necessarily want to change how everything else works.

I thought it ought to be possible to make that a bit less painful.

That was the starting point for Sidedoor: a small hardware device that lets you choose which websites should be routed through Tor, rather than having to configure each device separately.

The idea is to set it up on your network, choose the sites you want to route, and let the device handle that part of the configuration. No separate browser extension on every device, no subscription to a service that needs to manage your browsing, and no need to become an expert in networking just to get started.

There are limits, of course. Tor doesn't make you anonymous in every situation. A website can still recognise you if you log into your account, and other tracking methods can still apply. Your internet provider can generally see that you're using Tor, even though it ordinarily can't see the destination websites carried inside a properly established Tor connection. Some websites also restrict traffic from Tor exit nodes.

Sidedoor isn't intended to solve every privacy problem, and it doesn't guarantee access to any particular website. I'm trying to solve a much narrower problem: making it easier to keep selected browsing traffic from being directly associated with your home connection, without having to set everything up by hand on every device.

I'm still gauging interest before opening pre-orders, so I'm sharing the project while there's still room to learn from the people who might use it. I'd like to know whether this is a problem other people recognise, what they'd want the device to do, and where the approach could be better.

If that sounds useful, you can join the waiting list below. Or get in touch if you'd rather have a conversation about it.