Tenna is a browser for nsites — websites published to Nostr instead of to a
host. There is no server to go down and no domain to expire: a site is a
signed manifest listing every file by path and hash, and the files themselves
are content-addressed blobs on Blossom. Tenna finds the manifest, fetches the
blobs, verifies them, and serves the site to itself.
The home screen is a wall of tiles, and everything on it is yours. Sites sit
beside your installed apps in whatever order you drag them into, each with a
channel number counted down the wall. Add them from a catalog, from the people
you follow, or by pasting an naddr, an npub, a nostr: URI, or a gateway URL.
Tenna holds your keys; the sites never do. Each site gets a NIP-07window.nostr that proxies back to Tenna, which asks you before it signs.
Permissions are remembered per site and per event kind, and revoked from the
shield menu at any time.
Every site runs as the top-level document of its own WebView on its own
origin, so it is a real secure context — service workers, crypto.subtle, the
lot — with its own task in the recents switcher. Sites can also hold push
subscriptions open while closed, and take a place in the OS share sheet.