account security

Two-factor authentication

A six-digit code from your authenticator app, asked for only where you decide — before money leaves to an outside address, before a private key is shown. Ten recovery codes cover a lost phone.

Authenticator app

Google Authenticator, 1Password, Authy or any TOTP app.

Ask for a code when

Your choice. Each applies to the wallets in this terminal and asks for a login first; a verified code lasts ten minutes in this browser.

Account

Login and the main wallet are provided by Privy; keys of wallets created in the terminal stay encrypted in this browser. The two-factor secret lives on the terminal's server, encrypted, and is only ever compared against the code you type — it cannot sign or move anything by itself.