Skip to content

e2ee chat · abliterated models · OpenAI-compatible

Private inference. Uncensored models.

Chat that is encrypted in your browser and opened only inside verified hardware. Open-weight models with the refusals taken out. One API, and every model labelled with exactly who can read your prompt.

No account or card needed to chat.

Summarise my lab results and flag anything worth asking my doctor.

on the wire 8f3a·c19e·77d0·b2e4·0a5f…

attestation verified · enclave key pinned

readable by you

Encrypted in this tab before it leaves your device

Who can read your prompt? Every model answers.

Every model ID starts with its privacy mode, and every response carries an x-garlic-privacy header. You choose the trade-off; Garlic never makes it silently.

  1. e2ee

    Readable by

    Only you

    Encrypted in your browser, decrypted only inside attested hardware. Garlic's servers carry ciphertext.

    Browser chat

  2. tee

    Readable by

    You and Garlic's server, in transit

    Garlic's server verifies the enclave and encrypts to it, so the model host's operators cannot read the prompt.

    API, attested models

  3. passthrough

    Readable by

    The GPU host

    Plain TLS to a GPU host. Labelled as such on every response, never dressed up as private.

    API, including abliterated models

End-to-end encrypted chat

The strongest privacy you can get from a hosted model: the prompt is sealed before it leaves the tab, and the hardware proves what it is before it gets a key.

  • Encrypted in your browser, not on our server
  • Hardware attestation checked before every key exchange
  • History encrypted on this device, never on ours
  • Vanish mode: kept in memory, gone when the tab closes

Abliterated models

Open-weight models with the refusal direction removed from the weights themselves. Not a jailbreak prompt that stops working next week, and not a lecture before the answer.

  • Answers the question you asked
  • No hidden system prompt added to your request
  • Served on GPUs Garlic runs, OpenAI-compatible
  • $0.20 in / $0.80 out per million tokens

Runs in passthrough mode: the GPU host can read prompts, and Garlic retains requests encrypted for 30 days for abuse review. Use e2ee chat for anything sensitive.

You can verify private AI in three steps.

  1. 1

    Encrypted on your device

    Your message is locked in the browser before it leaves.

    Ask anything...

    Encrypted locally

  2. 2

    Hardware proves itself

    Garlic verifies the secure environment before anything is sent.

    Attestation verified

    • Genuine confidential hardware
    • Approved code
    • Fresh session
  3. 3

    Only you get the answer

    Your prompt is decrypted only inside protected hardware, and the response returns encrypted.

    What’s the best way to structure this problem?

    Private session

    Encrypted response

Garlic cannot read your encrypted chat content.

Keep your OpenAI client. Change the base URL.

Chat completions, streaming, and usage reporting work as your SDK expects. Pick attested models for sensitive work and abliterated ones for everything a mainstream API refuses, from the same key.

Read the API reference

main.py

from openai import OpenAI

client = OpenAI(
    base_url="https://garlic.ai/v1",
    api_key=os.environ["GARLIC_API_KEY"],
)

reply = client.chat.completions.create(
    model="passthrough-runpod/qwen-abliterated",
    messages=[{"role": "user", "content": prompt}],
)

Pay for what you use.

Prepaid credits from $5 that never expire, or a membership with a monthly grant: Pro $20/mo, Power $60/mo, Max $200/mo. Browser chat is free to try.

Private, and uncensored.

All topics

Ask anything. Keep it yours.

Start a private chat without an account, or get an API key for the uncensored models.