Wallet & security
Your key stays in the browser: passkeys, backups, restore, Phantom import, locking, lost devices and phishing.
Where your key lives
Your Solana key is generated in your browser and stored in IndexedDB, encrypted with AES-GCM. The encryption key comes from your passkey (WebAuthn PRF → HKDF) or from your password (PBKDF2, 600,000 iterations). The server never receives your key, seed or password.
Passkey account
New wallets are passkey accounts: the wallet is derived from your passkey, so the same passkey finds it again on any device where it syncs (iCloud Keychain, Google Password Manager, 1Password…) — tap Find my account. Nothing is stored on a server. The derivation ends in a regular 12-word seed, which stays your emergency backup if you lose the passkey. Anyone who controls your passkey can open the account, so protect the passkey provider with strong 2FA. Older wallets and password wallets keep working as before.
Backup and restore
- New wallets come from a 12-word seed (BIP39, same derivation as Phantom:
m/44'/501'/0'/0'). Imported wallets back up as a private key. - Back up under Wallet → Back up: write the words on paper, then pass a 3-word quiz. Withdrawals require a confirmed backup.
- Restore on any device with Restore from seed. The same 12 words also import into Phantom or Solflare (first account).
Locking
Choose how long to stay unlocked: 30 minutes, 4 hours or until the tab closes. A session keeps a non-extractable key in the browser so a reload doesn't ask again; the decrypted wallet key is never stored. Lock any time from the sidebar.
If you lose your device
Restore from your 12-word backup on a new device — that's the only way to recover. Then move funds to a new wallet if you think the old device could be compromised. Without a backup, funds are lost: nobody, including the operator, can recover or freeze a key.