Security
How InWIF protects you. And what it can't.
Keys made on your device
Your recovery phrase is created on your own device using proven, widely used libraries. InWIF never makes or sees it.
Locked with your password
Each wallet is encrypted with your password and stays on your device. Unlocked keys live only in memory and are wiped when you lock or step away.
Wallets kept separate
Every wallet has its own lock. Opening one never opens another.
Right network, every time
Before anything is signed, InWIF checks it is really talking to Robinhood Chain. If it can't confirm that, signing stops.
See before you sign
Every transaction is checked first and explained in plain words, with clear warnings for anything risky.
Safe approvals
Apps only get permission for the exact amount by default. You can see and remove every permission in the Security Centre.
Nothing secret on our servers
InWIF's servers never receive your recovery phrase or keys, and refuse anything that looks like one.
Hardware wallet (coming soon)
InWIF One will show every transaction on its own screen and wait for a physical button press.
A hardened website
No third-party scripts, and the site cannot be embedded or talk to unknown servers.
Limits we want you to know
- Malware on your computer or phone can read what you type and see what you see. A hardware wallet reduces — not removes — this risk.
- InWIF cannot detect every malicious contract or address. The absence of a warning is not a guarantee of safety.
- Browser storage can be cleared. Your recovery phrase is the only backup that matters.
- InWIF has not yet been independently audited. The hardware wallet is a prototype and makes no hardware-security claim yet.
Found a vulnerability? Please report it privately to the InWIF team rather than posting it publicly.