jailscale.sinabro.io is a jailscale hub. It publishes a port on your machine over HTTPS without opening an inbound port: the hub relays the bytes and your machine terminates the TLS. What this is.
Download jailscale for Linux, Apple-silicon macOS or Windows: one file, no runtime to install underneath it, no root. Intel Macs run jailscale.jar on a JVM.
This hub speaks protocol 2 and takes nothing older. One that is too old is turned away at the handshake with a line saying so and which version this hub runs, rather than half-working; a jailscale newer than this hub decides for itself whether it will still talk to it. jailscale version prints the protocol a current copy speaks, beside its build. A copy that prints no protocol is older than the release this hub came from.
The releases are signed. Once you have jailscale, jailscale update --download checks the signature of everything it fetches after that, so this is the one copy you check by hand: the signature is over RELEASE.txt, which names the tag and carries the digest of SHA256SUMS.txt, and your download's hash is in that. How to check it is one command from a clone, or four by hand. The first copy is the one nothing of ours can vouch for yet; every copy after it is checked against a key this one pinned.
Registration is open, so joining takes effect immediately:
jailscale up --hub jailscale.sinabro.io jailscale open 3000
That serves 127.0.0.1:3000 at https://<name>.jailscale.sinabro.io, with a certificate your own machine terminates. --name myapp asks for a particular name.
Not the traffic. It reads the TLS SNI to pick a node and forwards the rest untouched; the session key belongs to the machine at the other end. It does hold the wildcard private key for *.jailscale.sinabro.io and signs one handshake digest per visitor, so a dishonest hub could point a name at a machine of its own instead. That is what jailscale verify checks from your side, and what the daemon re-checks on its own every half hour.
All systems operational
| Version | 0.2.2 |
| Protocol | 2, and takes nothing older |
| Binary | sha256:deef7e88015f2dc473b702c1a1833d286070c504ccb10544cf587ca6a41f56eb |
| Hub key | hkey:4zs-ys5jY3UENRRWBXaEwfUke63SQvAFxVqWcFw6OzA |
| Uptime | 9d 20h |
| Nodes | 0 online of 0 registered |
| Certificate | Sun Jan 03 01:33:14 UTC 2027 (60d 22h left) |
| Memory | 33.7 MB resident |
The hub key is the one a node pins when it joins, and jailscale status prints the one yours pinned. The binary hash is of the file this process is running: compare it with SHA256SUMS.txt in the release it claims to be -- checked through RELEASE.txt's signature the same way as above, since an unchecked checksum list says nothing about which release it belongs to -- and remembering that a container or source build is its own binary. Both are what this hub says about itself, so they tell you an operator is running what they think they are; a dishonest hub prints whatever it likes here.
None open right now.
| Visitors per name | 1024 at once, and no more than the node serving it will hold |
| Visitors the nodes will hold | not advertised, 0 being served right now |
| Buffered per visitor | 256 KiB at most |
| Buffered in total | 24 MiB, then the slowest stream is dropped |
| Links per node | 20 |
| New control connections | 30 per address, then 1 a second |
The operator can remove a node or bar an address, so treat an open hub you do not run as a place to try this rather than one to depend on.