trenchcoat
Free · no sign-up
Website report · 18 Oct 2026

nullmask.io

“Make any wallet and any transaction private — in one click.”

Template-written 19 evidence items Code reader analysed 18 scripts
What this means for you

nullmask.io talked to 2 outside services on a first visit, including 2 that measure visits or show ads.E6E5

  • Tech check: the site claims a working app / platform, and its public page shows matching evidence.E19E14
  • Tech check: the site mentions trading / swaps / bots and own chain / l2 / zk, but we found nothing behind those in what its public page loads.E17E18
  • Before you click anything, the page loads analytics or ad services: Google Analytics / Tag Manager.E6E5
  • 4 cookies were set in your browser, all by the site itself.E7E8E9

Tech check

What the site says about itself, next to what its public page actually loads. Facts only, no verdict: you decide.

Nothing found on the public page

Trading / swaps / bots

“…count abstraction. Automated privacy workflows: Handle swaps, bridging, and routing to maximize privacy without use…”E17

No matching code, calls or services in what loaded for us.

Nothing found on the public page

Own chain / L2 / ZK

“…e privacy: Enable Turing-complete spending scripts and zero-knowledge account abstraction. Automated privacy workflows: Hand…”E18

No matching code, calls or services in what loaded for us.

Evidence found

A working app / platform

“…es NEXT WAVE IN LIVE Leaves at 14:45 Your time · GMT+0 Open app MASK HuAXPy…CUa7 Buy Nullmask has solved the everlasti…”E19

Calls to its own backend: /api/wavesE14

Calls its own backend /api/wavesE14
Wallet code none seen
Contract calls in its code none seen
Talks to AI services none seen
Live connections none seen

The real tech may live elsewhere. This page links to: app.nullmask.io · check the app

What it is

  • The site describes itself as: “NullMask is a private VPN for crypto: confidential transfers, swaps and bridging for tokens and stablecoins on Ethereum and Base. One click.”E2
  • It's built with Svelte / SvelteKit (common tools for building web apps).E10
  • In your browser it can copy text to your clipboard.E12
  • While loading, it called 1 endpoint on its own servers, such as /api/waves.E14

Where your data goes

Analytics & trackingCount visits and record what you do on the page. 2
www.google-analytics.comGoogle Analytics / Tag Manager: Google's visitor analytics and tag loader 2×E6
www.googletagmanager.comGoogle Analytics / Tag Manager: Google's visitor analytics and tag loader 2×E5

How key features work

Loading its content

Its content loads from its own API while you browse (/api/waves).E14

/api/waves

Drawing and editing in the browser

The page draws and edits graphics in your browser using the canvas.E13

canvas

Measuring what you do

Visits and clicks are measured with Google Analytics / Tag Manager and Google tag (gtag.js) (found in its traffic or its code).E6E5E11

Google Analytics / Tag ManagerGoogle tag (gtag.js)

Cookies and storage

Names only. We never store the values.

CookieSet forKeptWhose
__vdplE7nullmask.io until you close the browserthe site
__vdplE7nullmask.io until you close the browserthe site
_gaE8nullmask.io about 400 daysthe site
_ga_R7WC64N31NE9nullmask.io about 400 daysthe site

Pages and API calls

Pages it links to

/

Endpoints

Called while loading (seen) or named in the code (code).

nullmask.io/api/wavesseenE14
/api/wavescodeE15

Evidence

Every sentence above points to one of these. Code references show the file, line:column and the short identifier that matched, never the site's code itself.

E1
Page title: Make any wallet and any transaction private — in one click.
page title · https://nullmask.io/
E2
Page description: NullMask is a private VPN for crypto: confidential transfers, swaps and bridging for tokens and stablecoins on Ethereum and Base. One click. Any walle
page description · https://nullmask.io/
E3
Main heading: One Click. Total Privacy.
page h1 · https://nullmask.io/
E4
28 request(s) to nullmask.io
types: 16 script, 5 font, 3 stylesheet
GET https://nullmask.io/ · script · 28 requests · network recording
E5
2 request(s) to www.googletagmanager.com
types: 2 script
GET https://www.googletagmanager.com/gtm.js · script · 2 requests · network recording
E6
2 request(s) to www.google-analytics.com
types: 2 fetch
GET https://www.google-analytics.com/g/collect · fetch · 2 requests · network recording
E7
Cookie '__vdpl' set for nullmask.io
session cookie
cookie __vdpl on nullmask.io · value not stored
E8
Cookie '_ga' set for nullmask.io
kept for about 400 days
cookie _ga on nullmask.io · value not stored
E9
Cookie '_ga_R7WC64N31N' set for nullmask.io
kept for about 400 days
cookie _ga_R7WC64N31N on nullmask.io · value not stored
E10
Svelte / SvelteKit found in the code
nullmask.io/ (page HTML) @ 73:533 · “svelte-rm02nq” · pattern scan
E11
Google tag (gtag.js) found in the code
nullmask.io/ (page HTML) @ 4:60 · “googletagmanager.com/gtag” · pattern scan
E12
Uses the browser ability: clipboard_write
can copy text to your clipboard
nullmask.io/_app/immutable/nodes/2.YN8AIvnw.js @ 3:11454 · “clipboard.writeText(” · pattern scan
E13
Uses the browser ability: canvas
draws graphics on a canvas
nullmask.io/_app/immutable/nodes/2.YN8AIvnw.js @ 1:127911 · “getContext("2d"” · pattern scan
E14
The page called /api/waves on nullmask.io (GET)
GET https://nullmask.io/api/waves · fetch · network recording
E15
Code reader found the endpoint /api/waves
how: call:fetch
nullmask.io/_app/immutable/nodes/2.YN8AIvnw.js @ 3:4829 · “/api/waves” · the code reader
E16
1 links to pages on the same site
page links · https://nullmask.io/ · /
E17
The site says: “…count abstraction. Automated privacy workflows: Handle swaps, bridging, and routing to maximize privacy without use…”
page text · https://nullmask.io/ · …count abstraction. Automated privacy workflows: Handle swaps, bridging, and routing to maximize privacy without use…
E18
The site says: “…e privacy: Enable Turing-complete spending scripts and zero-knowledge account abstraction. Automated privacy workflows: Hand…”
page text · https://nullmask.io/ · …e privacy: Enable Turing-complete spending scripts and zero-knowledge account abstraction. Automated privacy workflows: Hand…
E19
The site says: “…es NEXT WAVE IN LIVE Leaves at 14:45 Your time · GMT+0 Open app MASK HuAXPy…CUa7 Buy Nullmask has solved the everlasti…”
page text · https://nullmask.io/ · …es NEXT WAVE IN LIVE Leaves at 14:45 Your time · GMT+0 Open app MASK HuAXPy…CUa7 Buy Nullmask has solved the everlasti…

Limits

  • We only see what your browser sees: code and requests on a first visit, without logging in or accepting cookie banners. What the servers do with data is invisible from outside.
  • Site code is usually minified (compressed), so names are partly lost and some code may be only partly analysed.
  • Some trackers only load after you accept cookies or log in, so the real list can be longer.
  • We visited from a server in the United States. Sites load different trackers and cookie banners in different countries (visitors in the EU usually get a consent banner first).
  • The tech check compares the site's own words with what its public page loads. Work done on servers, in private code or in separate apps isn't visible here, so 'nothing found' means not visible on the public page, not that it doesn't exist.
  • This text was written from fixed templates because no AI writer was available. It uses exactly the same evidence.
  • The code reader hit its size budget on parts of 4 large bundle file(s); those parts weren't fully analysed.

Facts, not judgements: this page describes what the code and traffic show, not anyone's intent. Not financial advice. Case id esCJ58Sm.