Security
How your keys are kept
Every key is generated, sealed and used inside your browser. The wallet's servers deliver the application and nothing else; they never see a phrase, a key or a password.
Keys are made on your device
A 24-word recovery phrase is drawn from your device's own randomness. Accounts are derived from it with SLIP-0010 Ed25519 on the path m/44'/7771'/0'/0'/i'. The work happens in an isolated worker inside the page, apart from the interface.
Sealed with your password
The phrase is encrypted with XChaCha20-Poly1305 under a key stretched from your password by Argon2id (64 MiB, three passes) — deliberately slow, to resist guessing. Only the sealed copy is stored in the browser. Locking, manually or after inactivity, clears the keys from memory.
You see what you sign
Before you sign, the transfer is priced by the network and shown as a formal instruction decoded from the exact bytes to be signed: recipient, amount, fee, network and validity. Signing needs a deliberate press and hold.
The network is checked every time
The wallet signs only for AletheiaChain chain 7770 with the expected genesis block. Addresses carry a checksum bound to their network, so an address from another Aletheia network is refused rather than silently accepted.
What you can do
- Open the wallet only at wallet.mainnet.stateofaletheia.org. Bookmark it.
- Write the phrase on paper. Never photograph it, never type it into another site, never share it — no official will ask for it.
- Check the first and last characters of an address after pasting; some malware replaces copied addresses.
- Lock the wallet on shared computers.
Report a vulnerability to security@stateofaletheia.org.