Protect your backup
Your wallets are backed up to your motion account, encrypted. You can add an extra lock — 2FA, a passkey, both, or none. Nothing changes unless you choose.
your backup today
Your trading wallets live in this browser’s vault. A sealed copy is kept on your motion account so you can get them back on a new device. Today it opens with your sign-in — the signature of your main wallet (for an e-mail or Google account, that account’s Privy wallet).
So whoever takes over your sign-in — a stolen e-mail, a hijacked Google account — could restore your wallets. The locks below close that gap.
You may see a short card offering this once — “Later” and “Don’t show again” both work. It is also in Settings → Security. If you keep a backup file only, with no copy on motion’s server, there is nothing to lock: your file is your backup.
the two locks
| To restore on a new device | Stops | Does not stop | Works on | |
|---|---|---|---|---|
| No extra lock (today) | Your sign-in | Someone without your sign-in | Someone who takes over your sign-in | Everywhere |
| With 2FA | Your sign-in + your 2FA code (once per login on each device; a device that proved it is trusted for 30 days) | A stolen e-mail or Google login without your authenticator app | motion’s server itself, or a script running on motion.gift: the server checks the code and holds the copy | Every browser and the motion app |
| With a passkey | Your sign-in + your passkey (Face ID, a fingerprint, your device PIN or a password manager) | A stolen login, a hijacked e-mail — and motion’s server: the copy can’t be opened without the passkey, which never leaves your device or password manager | Malware on a device that is already unlocked; losing every passkey and your recovery code (keep your backup file) | Browsers whose passkeys can lock data (recent Chrome, Edge and Safari) — the page checks before it offers it. Not in the motion app yet |
| Both | Your sign-in + the 2FA code + your passkey | All of the above | Malware on an unlocked device | Where passkeys work; 2FA alone everywhere else |
step by step
With a passkey — about a minute
- Create your passkeyYour device asks for Face ID, a fingerprint or its PIN.
- Confirm itOne more touch proves the passkey can lock your backup. Some older passkeys can’t — then nothing changes.
- Save your recovery codeWith your sign-in it opens your backup if you lose every passkey.
- Check the new backupThe new copy is saved next to the current one; the vault opens it with a fresh touch and checks every wallet is there. Only then does motion switch to it.
Nothing changes until the last step succeeds. Stop at any step and your backup stays as it was.
With 2FA — about two minutes
- Get an authenticator appGoogle Authenticator, 1Password, Authy or any TOTP app.
- Scan the code and enter the 6 digits
- Save your recovery codes
Your backup stays the same copy. From then on motion’s server asks for the code before it hands it to a new login.
what it does not cover
Older (v1) wallets
Wallets made by the first accounts, before the second wallet generation, are derived from your sign-in alone. A passkey cannot lock them: anyone with your sign-in can still re-create them. Move their funds to a new wallet — new wallets are sealed under your passkey.
Your previous copy, kept for a while
When you switch to a passkey, your previous copy is not erased at once: it stays sealed on motion’s server as a safety net — 30 days, longer while this feature is rolling out — and your settings show until when. In that window motion’s operator could put it back (for example in a support case). It still opens only with your sign-in, exactly as today. After the window it is erased.
The motion app
The motion app (iPhone, Android) does not offer passkeys yet; 2FA works there. A passkey-protected backup opens in a browser that supports it; in the app, use your backup file.
Phone access
Phone access for wallet-app accounts works as before. A phone that restores through it still needs your passkey to open the protected wallets.
A device that is unlocked
A device where your backup is unlocked holds its key. Lock your device and keep your browser up to date.
if you lose something
| You lost | Your way back |
|---|---|
| One passkey (you have another) | Use the other one, then add a new passkey and remove the lost one in Settings → Security. |
| Every passkey — but a device still has your backup unlocked | On that device, add a new passkey. |
| Every passkey and every device | Your recovery code + your sign-in, then add a new passkey. |
| Every passkey, every device and the recovery code | Your backup file restores your wallets (the server copy stays sealed). For a fault on our side, support can put back your previous copy while it is still kept. |
| Your sign-in (main wallet) | Same as today: without it nothing opens. Wallet-app accounts can use phone access. |
| Your 2FA app | One of your 2FA recovery codes. |
turning it off
Settings → Security → Protect your backup → Turn off. It asks for a fresh passkey touch (and your 2FA code if 2FA is on) and switches back to a copy that opens with your sign-in. 2FA is turned off in its own section of the same page.
check it yourself
The vault’s code is public: motion-vault on GitHub. The engine your browser runs is pinned by its hash, published in releases.json. More in the Security Center.
Optional. motion never turns a lock on for you, and nothing changes for an account that ignores this.