MenuClose
About
Nonceworks is run by one engineer, Zachary Alexander, so where this site says "we", that is him. He started it in October 2026, after the Defender shutdown left small teams operating two Rust services with nobody whose job that was, and after a week of reading the Relayer source to understand why the nonce bugs those teams reported were still open.
The name and the mark
The name comes from those bugs. A relayer hands out nonces in order, one slot per transaction, and most of the bugs reproduced in the first week were about one slot falling out of line while the slots above it waited, which is what the mark draws: three slots, the middle one pushed out through the side of its frame. In the site's menu, the page you are on is the slot out of line.
The first week
On 3 October Zachary answered a question on relayer #757 about Google Cloud KMS and workload identity. Over the next three days he reproduced three Relayer bugs on 1.8.0 and posted each on its issue: #808 on 5 October, then #817 and #843 on 6 October, and confirmed a Monitor bug in the source on monitor #498. On 7 October he opened relayer #912, #913 and #914 and monitor #501, and ran a real AWS KMS key through the relayer, timing how fast a revocation takes effect.
Before Nonceworks
Zachary studies software engineering at Arizona State University and expects to finish his B.S. in December 2026. He works as an IT systems and security apprentice; before that he built SQL and Python claims pipelines as an insurance data analyst, and worked in remote technical support. His GitHub account, zachsplat, dates from June 2021.
When something breaks
The software runs as published. When something breaks, we reproduce it on the release, publish the files, comment on the upstream issue, and write down what reduces the exposure until a fix ships. What the service does not have yet is listed under Limits on the home page.
What we keep
- Visits
- The web server keeps its access log on our server: address, page, time and referrer. There is no analytics script on these pages.
- The validator
- A file you check there is sent to our server, checked and not stored.
- What you send us
- Messages and configs stay in our email and Telegram. Secret values are decrypted only into your stack's environment files, as the security page describes.
- When you leave
- You get your files and a copy of the relayer's store, and after that we delete your workspace and its secret files. Then revoke the grant you gave us.
- Payments
- Invoiced in USD; no card details pass through this site.
Type
Nonceworks Slot and Dot were drawn for this site; Nonceworks Text and Mono are adapted from Atkinson Hyperlegible under the SIL Open Font License.