What we can and cannot do

Your password stays on your device

1. When you sign in, your device turns your password and wallet ID into two keys. This is deliberately slow work, so guessing passwords takes a very long time even with powerful computers.
2. One key locks and unlocks your wallet and never leaves your device. The other only proves to our server that it is you, and it reveals nothing about your password.
3. Even if someone stole our entire database, they would find neither your password nor any way to open your wallet.

Your wallet is a sealed box

Everything private — your recovery phrase, imported keys, labels and contacts — is sealed on your device before it is sent to us. We store the sealed box and a version number. We cannot open it. If you have the wallet open on two devices at once, the wallet notices and merges the changes instead of overwriting them.

One site per coin

Each coin lives on its own site, and you sign in to each one separately. That is on purpose: a problem on one coin's site can never reach another coin's wallet.

Nothing from outside

Your browser loads code only from us, and it checks that every file is exactly the one we published. There are no ad networks, no analytics and no outside scripts or fonts. Blockchain lookups go through our server, so your browser never talks to third-party services directly.

Keys in memory only, and not for long

Unlocked keys exist only in your browser's memory while the wallet is open. Nothing secret is saved on your computer. After 15 minutes without activity (you can change this in Settings) the wallet locks itself and clears the keys. Signing out does the same.

Sign-in protection

• Wrong passwords are counted. After a few misses a human check appears, and further misses add growing waiting times, so guessing does not work.
• You can add an authenticator app as a second step. The wallet is not handed out until the code is right.
• We keep a record of sign-ins, failed sign-ins, saves and settings changes so abuse can be spotted. Internet addresses in that record are stored in a scrambled form that cannot be turned back into the real address.

What we do not have

• No password reset. If you forget your password, restore your wallet from your recovery phrase.
• No email, no name, no phone number. A wallet is not linked to any person.
• No custody. We cannot move, freeze or seize coins, and we cannot comply with a request to do so.

What you still have to do

• Write down your recovery phrase and keep it offline. Anyone holding the phrase holds the coins.
• Use a long password nobody could guess. We slow attackers down, but we cannot make a weak password strong.
• Keep your browser and device up to date. Malware on your device can see whatever you can see.
• Check the address bar. Only chainpouch.com and its coin sites (such as bitcoin.chainpouch.com) are us.