It's 2019. You're still just a row in someone's database.

Your digital life is spread across all kinds of accounts, apps and services.

Every one of them does only one thing and is controlled by someone else. They work great, but they're really just big, dystopian toys.

The limits of these fake, single-purpose computers are clear. People deserve better.

Your Urbit is a personal cloud server. A simple, private, general-purpose virtual computer on an encrypted P2P network.

Your Urbit is your digital passport, your digital vault, and your digital assistant. You own it on Ethereum – no one controls it but you.

The future was actually just a technical problem.

Today, you have two bad options for cloud computing: run your own Unix server or join a bunch of apps and services.

We aren't going to take this deal. We don't want to be system administrators and we don't want to be ruled by some MEGACORP.

So we built a new platform. A clean-slate stack simple enough that ordinary people can run their own servers.

Urbit is a stack of three layers: Azimuth, Arvo and Aegean. Each layer could be used as a product on its own, and they're all open source.


is virtual land on Ethereum. An Azimuth point is a secure digital identity and network address.


is a clean-slate OS and P2P network. An Arvo server uses an Azimuth point as its name and address.


is a pattern of independent, decentralized societies on top of the Arvo network.

Urbit is still young. It's not quite ready for everyone. Great system software takes a long time to grow.

But Urbit isn't a dream. It's real. It's a running, stable network. And once you find your way in, there's a lot to explore.

Urbit is the last platform. The personal-computing revolution hasn't even happened yet.

Aegean: What Urbit is For

Today MEGACORP runs our cloud software, decides how to update it and stores our data. What will the world look like when people can run their own servers?

In the real world, different cultures and societies coexist on top of neutral physical infrastructure. Different people, communities and cultures share the same roads and electrical grid.

In the cloud, it's as if we spend our lives in hotels.

Aegean is a pattern for building cities. A city is a group of people running the same agent, a kind of program, on their Arvo servers.

A city is not an 'app' designed for one thing. A city is a combination of tools for a community. Each city is independent and self-governing. Cities control their own interfaces and update their own code over the air.

We've started a few cities already, and we'll talk a bit about what we see on the horizon. What we can imagine is only the beginning.

One thing we know for sure: the future isn't a single monoculture. All of humanity doesn't want to live in the same city. Most people live in many and move comfortably between them.

We see a vast archipelago of hypercultures. A centerless network of networks on top of the neutral Arvo and Azimuth infrastructure.

Homesteading this new continent

As a community building a new platform we need to chat and engage in longform discussion. Separate platforms with separate logins and bloated interfaces are a drag to use.

So we built an agent to work just for us. It's called Landscape, and we've used it to start a few invite-only cities.

These cities are sort of like colonies on a new continent. They're rough. They aren't ready for everyone. They aren't secure yet, they won't last forever. But we already like them better than the alternative.

And we can already see what it will look like to let others start homesteading with us. Living on a platform where your community is in control is a whole new world.

We're excited to not only welcome other communities, but to extend the flexiblity of our agents. To experiment with what's possible.

Location data, heart rate, nutrition and note taking between members of an expedition, for example. Anonymized genetic data, visualization tools and documents for a group of researchers. There's so much to explore.

The blockchain is an I/O device

The blockchain was supposed to make the financial system open to anyone. But we're still stuck on MEGACORP exchanges or using flimsy 'dapps' in our browser.

A city of traders on Urbit could easily relay orders to one another and send signed transactions directly to the chain from a single agent. That's what you get for free with a fast, deterministic computer on a secure authenticated network.

And why not go a step further? Let your Arvo server run your trading algorithms or participate in prediction markets. Today's 'dapps' don't have access to persistent state and their UI is limited. Worse, they can't communicate with one another.

Blockchains are so much more useful when connected to a secure personal server. Consensus computation can be much more than just trading coins.

Your private city of robots

The 'internet of things' is a mess. Some of the 'things' are pretty nice pieces of hardware. But they all require that I use some MEGACORP service. Why can't I just talk directly to my own thermostat?

Your Azimuth identity, orplanet, can launch 232(4 billion) child identities, ormoons. That should be enough for your lights, your fridge, your 3D printer, and your swarm of farm robots. Own a factory? Sure, that too.

Once they run Arvo servers, your devices can all run the same agent and join your own private city. Taking control of your robot army is simple once they share the same computing platform.

The archive of your life

Your human record needs to be safe in the cloud. The technology works. MEGACORP is always the weak link. No corporation can promise to live forever — or care forever.

That's why your Arvo server is the right place to store all the data you want to keep — every message you've ever sent, every photo you've taken, even your financial and medical records. Your personal server maintains an archive, a permanent, trusted place to keep your digital life.

Once your data is safe on your personal server, the way you managed it now will seem scary and backward.

Arvo: What Urbit is

One file


Your passcode


A program


Your personal server, called a ship, is stored as a log of the events it's received, encrypted with a passcode. To start your ship, open your event log file with the Arvo program and type in your passcode. To stop it, just close the program; the event log will wait patiently for next boot.

To use the Arvo network each ship must have an Azimuth name, or point. You own your point on Ethereum. It's a short, pronouncable name like ~laptel-nilfur or ~doplyx-halsev (the '~' is silent). Other ships use your Azimuth point to find and talk to your ship, no matter where it is in the world.

Most people park their ship in the cloud. If you prefer to host yourself, your ship can live on a laptop, a phone, even a USB stick. It's just a file. It doesn't have to be on all the time. Just don't lose it.

Wherever your ship is, just log on at with your name and passcode — like a normal web account.

You operate your ship through a web UI and/or a local console. You can sync the current version its files with your local computer. (Arvo remembers every version, forever.) Your ship can also host its own webpages and interact with existing webservices on your behalf.

Your ship is designed to need no maintenance at all. Upgrades come in over the network. It never gets old or out of date. Leave one off for a century, then turn it on — it might take a week, but it will automatically upgrade itself to 2119.

Okay nerds, here's a quick technical overview

Arvo is a general-purpose computer that runs as a virtual machine. You can think of it as an overlay OS; it treats Unix the way Unix treats the BIOS.

Its behavior is completely defined by a frozen transition function called Nock that goes from [event, current-state] to [effects, next-state]. An event might be a keypress, an HTTP request, or a UDP message from another Arvo. An effect might be a command to the Unix terminal, an HTTP response, or another UDP message to another Arvo.

Arvo consists of the following stack of components, from the bottom up.

Vere, our interpreter, written in C, is a transactional I/O processor over libuv, which stores its state as a persistent event log and/or memory checkpoint. Vere interprets Nock.

Nock, our machine language, is like a pico-Lisp with no symbols. It's a homoiconic purely functional machine code with 12 opcodes and one universal datatype, the noun: an acyclic binary tree that is either a number (which can also represent an arbitrarily large bytestream) or a cell, which is a pair of nouns.

Hoon is a purely functional, statically typed, strictly evaluated programming language that compiles to Nock.

The Arvo kernel is a functional, nonpreemptive, general-purpose OS written in 1000 lines of Hoon.

Our stack is weird. But you'll get used to it. The whole thing is open source under the MIT license – take a look.

Nock Virtual machine Hoon Programming language Arvo Operating system
  • Arvo kernel
  • Core OS and event manager
  • Ames
  • Peer-to-peer network
  • Clay
  • Global filesystem
  • Ford
  • Build system
  • Gall
  • Application sandbox
  • Jael
  • Vault for secrets
  • Eyre
  • Web server
  • Landscape
  • Chat and discussion agent
  • API gateways
  • To existing services
  • Dill
  • Terminal driver

How do you embed a general-purpose computer into a function? You load programs and data into the state, which the transition function can update on each event.

To boot a new ship, the first several events are run by the VM (named Vere, written in C) before your ship enters the network. These initial events load in a Hoon compiler, compile and install the Arvo kernel, initialize userland apps and files, and assign your Azimuth point and private keys as your ship's identity. Now your ship is ready to talk to the the world.

The Arvo stack can push any update to any part of itself, except Nock and Vere.

Let's walk through some of the components of the Arvo kernel. This is where it gets interesting.

Ames, our network protocol is overlayed over UDP. Every message between ships is signed and end-to-end encrypted. Ames is message-oriented, CQRS, connectionless, data-centric, and transactional.

Clay, our filesystem, is a reactive, typed, distributed revision-control store that defines an authenticated global immutable namespace.

Ford, our functional build system, can auto-update a page in your browser when someone checks in a change to a math function in a back-end rendering library.

With compiler, libraries, Arvo and modules, the whole OS is ~30,000 lines of code.

Urbit is also a nontrivial list of other features and components. You can read more in our long, peculiar, mildly outdated whitepaper. Caveat lector, it's a tad academic.

Today, Urbit is a stable testnet. Urbit hosts its own site, forum, and federated chat. Its last unplanned breach (global hard fork) was in 2016.

Urbit now has a practical clean-room Vere alternative, Jaque, built on Graal/Truffle. Jaque can boot a ship and join the network. It still has some stack issues.

Urbit is not done. It needs optimization, documentation, a lot of polish and even a bit of architecture. But it certainly does work!

Azimuth: What Urbit is

If IP addresses were cryptographic property, the Internet could have funded its own development with its own address space.

With clear ownership, IP addresses would develop clear reputations. Abusers would lose real money in reputation cost and the internet would be a friendly network.

We can't fix IP. So we built a system of decentralized address space and called it Azimuth. Ames, the Arvo UDP overlay network, uses Azimuth addresses for identity and routing.

Any reputation system needs scarcity of identity. Numerical scarcity is more elegant than a real-name policy. So Azimuth is limited to 4,294,967,296 independent planets.

The Azimuth address space grows like a family. 8-bit galaxies (like ~hal) can issue 16-bit stars ~sogtyv, which issue 32-bit planets (~laptel-holfur). Each of these addresses is called an Azimuth point.

  • 1 Galaxy
  • 1 Star
  • 1 Planet
  • = ~28Stars
  • = ~216Planets
  • = ~232Moons

Stars and planets can emancipate themselves by changing sponsors, so you're never trapped. Moons are meant for devices, so they can't escape from their planets. (We don't want a bunch of connected lightbulbs wandering around forming botnets, do we?)

The basic idea is, you need someone to sponsor your membership on the network. An address that can't find a sponsor is probably a bot or a spammer. In the Arvo network parents provide P2P routing and distribute software updates. Azimuth sponsorship is a very simple reputation system. Just enough to decide who to route packets to, and easy to build on top of.

Governance is performed by the galaxies. The galaxies form a senate which updates the logic of the Ethereum land registry by majority vote.

Azimuth is designed to make Arvo a safe, friendly network. Once that's true, who wants to keep using the Internet?











At the start, a new platform takes imagination, independence, and time. At the end, it takes hustle, organization, and money.


Curtis goes down to his garage to reinvent computing. Or something.


Nock works. Coming in at 32 lines of code, that's about 1 line of code every two months.

While Nock is cool, it needs a language. Work on Hoon begins.


Hoon works pretty well. It's much easier to write Hoon than Nock.

But what do you do with a language on its own? Not much. Work on Arvo begins.


Arvo boots and can do a few tricks.


The first live Urbit test network is started with a command-line chat.

11 years later

Tlon is founded as the corporate vehicle for Urbit.


Urbit serves its own website and chat.


The first public sale of Urbit address space. Finishes in four hours.


Our test network runs for ten months without a reboot.


Our private sale sells out in six hours — limit 2 per person.


Work on new versions of networking, frontend, boot sequence, secret storage, Arvo kernel, and Hoon language begins.


The great migration to Ethereum starts.


Landscape begins in earnest, wallet design, Bridge, Ford is rewritten.


Landscape is demoed to all of Tlon.


Azimuth is live on Ethereum, Bridge and Wallet Generator are live. Landscape is in a private beta.

(5)Azimuth distribution

Azimuth, the Urbit address space, is digital property. Property is a fact, not a value judgment. Who owns it is who owns it.

At first, most of it was just given away. Like bitcoins, galaxies used to be easy to get. In 2010, you could earn a galaxy by writing decrement in Nock.

In 2013 we started Tlon as the vehicle for Urbit development. Tlon bought half the address space for what is now just a few BTC. Soon after, we created '' — a pool of 64 galaxies meant to fund development of Urbit infrastructure. Tlon remains the guardian of the galaxies.

We have always wanted the address space to be widely distributed. As urbit becomes more useful, this happens on its own.

At the launch of Azimuth to Ethereum (~2019.1), this is the distribution of stars:

Contributors + supporters
Founders + Tlon employees
Tlon investors
2018 Galaxy Buyers
2016 + 2017 Star Buyers


Star and galaxy owners


Of the network dedicated to funding open source development through

Azimuth unlocking

To prevent the network from growing too quickly, Azimuth has built in 'unlocking' for stars. Galaxies remain transferrable, but their stars unlock over time.

Each star also unlocks its ability to issue planets over six years. 1024 in the first year, which doubles each year thereafter.

Star buyers in the first two sales (2016 + 2017) and private buyers since 2015 are unlocked right away.

Galaxy buyers from 2018 unlock over either one or three years. unlocks linearly over two years.

Founders, early employees + contributors, supporters, prizewinners and Tlon and its investors are locked for a year, then unlock linearly over four years.







2017 / 2018 Star Sales, Private Buyers 2015 - 2017 + Prize Winners
2018 Galaxy Buyers
Founders + Early Employees, Contributors + Supporters, Tlon + Tlon Investors