Security overview
Last updated: September 2026
Threat model in one sentence
Coldkey is designed so that a full compromise of the website or server still cannot move your coins, because the site never possesses anything that can sign a transaction.
What the site can and cannot do
- No private keys, no seed phrases. There is no input, upload or API that accepts them. The wallet file the browser reads (
wallet.json) contains public addresses and an optional label only. - No sending, signing or swapping. The application is read-only by construction; there is no code path that builds or broadcasts a transaction.
- Local file access stays local. "Connect USB" uses the browser's File System Access API. The browser reads the file; only the parsed public addresses are sent to the server to look up balances.
- Auto-lock. While connected, the browser re-checks the file every 4 seconds. If the drive is removed, the portfolio is cleared and locked.
Server and transport
- HTTPS only, with HSTS. Certificates are issued and renewed automatically by Let's Encrypt.
- Strict Content-Security-Policy: scripts are served from this origin only; no third-party scripts, ads or analytics. Google Fonts is the only external resource.
- Additional headers:
X-Content-Type-Options: nosniff,X-Frame-Options: DENY,Referrer-Policy: no-referrer. - The API is a thin proxy to public blockchain and price data (Blockstream, mempool.space, public Ethereum RPC nodes, Ethplorer, CoinGecko). Responses are cached briefly in memory; addresses are not written to a database.
Accounts and sessions
- Passwords are hashed with scrypt (random 16-byte salt, 64-byte output). Plaintext passwords are never stored or logged.
- Sessions are HMAC-signed,
HttpOnly,Secure,SameSite=Strictcookies that expire after 12 hours. - Sign-in is rate-limited (5 failed attempts → 15-minute lock per network); sign-ups are limited to 5 per hour per network.
Your responsibilities
- Keep the USB stick and your written recovery phrase safe. Coldkey cannot restore either.
- Never open the key file on any website, including this one. The site only needs
wallet.json. - Use a unique password for your Coldkey account.
Reporting a vulnerability
If you find a security issue, please email contact@coldkeywallet.com with steps to reproduce. We ask for a reasonable time to fix before public disclosure. A machine-readable contact is published at /.well-known/security.txt.