Security
Your keys deserve
fewer assumptions.
Security starts before you sign. This page describes how Filecoin Wallet separates the website from the signing environment.
filecoinwallet.org will never ask for a recovery phrase or private key.
Signing never happens
on this site.
The diagram below shows where each step happens. The marketing website is not part of the signing path and should never receive secret information.
User
Chooses an action.
Wallet application
Builds the request on your device.
Local signing
Keys never leave the signing environment.
Signed transaction
Ready for submission.
Filecoin network
Receives the signed message.
Verification
Follow the transaction identifier.
Security principles
Private wallet material stays under the control of the wallet user. Any action that moves value is presented for review before it is approved.
Review the security information and compatibility details before using the wallet.
Website vs wallet application
filecoinwallet.org is a marketing, documentation and download website. It performs no signing, holds no keys and contains no field that accepts a recovery phrase or private key.
All signing happens inside the wallet application on your own device.
Key management architecture
The wallet application is designed so account material is generated and held locally, under the user's control, rather than transmitted to a server.
Transaction signing
A request is assembled locally, presented with its network, destination, amount, method and fee, and only signed after explicit approval.
Recovery phrase safety
A recovery phrase should be recorded offline and never typed into a website, a chat message, a support ticket or an email.
Filecoin Wallet support will never ask for your recovery phrase or private key.
Hardware wallet architecture
Hardware-wallet workflows are part of the product design. Check device compatibility before use.
Release verification
Check the release verification data before installation. Compare the downloaded file with its published checksum and signature.
Checksums
Compare the SHA256 checksum of your downloaded file with the value in its release details before installing.
Code signing
Check the signature information alongside the build. No signing key is provided on this website.
Open-source status
No public source repository is linked from this website.
Audit status
No independent security audit report is provided on this website.
Responsible disclosure
No dedicated security contact is listed. The Support page contains the available contact options.
Please do not include recovery phrases, private keys or any secret material in a report.