i
Make a new wallet or open one you already have. Write the seed phrase down:
nothing is stored here, so it is the only way back in.
i
Receive gives you an address to be paid at, Send spends from the balance, and
Secrets holds the seed phrase. Transactions are logged beside the wallet.
Makes a brand new wallet with a fresh 25 word seed. The seed is shown once,
here, and never sent anywhere. Write it down before you fund it.
Optional. It sets where scanning starts, so the wallet does not read the whole chain. If you leave it blank, scanning starts from the wallet's own guess, which is slower.
For a wallet you hold as raw keys. Give the primary address and the private
spend key to open a full, spendable wallet; give only the view key to open
it watch-only, able to see the balance but not to spend.
Leave blank for a watch-only wallet.
Watch-only. This wallet has no spend key, so it can show the balance and incoming payments but cannot send. Open it with the spend key to spend.
Balance
0 XMR
(0 unlocked)
Receiving and sending live on their own tabs above. The seed phrase is under Secrets; write it down if you have not.
Receive
Anyone can pay you at this address. A fresh subaddress for each payer keeps them from seeing each other's payments.
Send
XMR
Confirm this payment. Once sent, it cannot be reversed.
Wallet secrets
The seed phrase is the whole wallet. Anyone who reads it owns the coins. Reveal it only where nobody can see the screen, write it on paper, and do not save it to this machine.
Starting to sync...
The honest notes
The keys never leave the tab. Creating, restoring, scanning and signing all happen in this page, in a background worker. What crosses the network is what any wallet sends a node: requests for blocks, and a finished transaction to broadcast. The security policy served with this page forbids it opening a connection to anywhere but this site, which your browser enforces, and the panel above lets you watch it do so.
The node talks to our server, not to you. Your browser cannot reach a node directly under that policy, so the request goes to this site and this site forwards it. The upside is real: the node never learns your IP address, and it never learns which of the transactions it hands over are the ones you care about, because that matching happens in your tab. The downside is that this site's server sees that some visitor is talking to that node. It does not see your address, your keys or your balance, none of which are ever sent to it. If even that is too much, run your own node and point the wallet at it.
Nothing is stored, on purpose. There is no wallet file, in this site's storage or anywhere else. The wallet is held in memory while the tab is open and discarded when it closes or reloads. That removes a whole category of risk (a wallet file left behind on a shared computer) and puts the entire weight on the seed phrase, which is why the page will not stop reminding you to write it down.
The cryptography is not ours, and this time we mean all of it. The wallet is monero-ts, which wraps Monero's own C++ wallet compiled to WebAssembly. Writing a Monero wallet from scratch would be exactly the irresponsible thing the paper-wallet page warns against, so this does not: it runs the same code the official wallet does, in your browser. It is served from this domain, unmodified except for removing an environment check that the security policy forbids, and the exact bytes are pinned by a test in the repository.
A saved copy is safer than this one. As with the paper wallet, a copy of this page saved to disk cannot be changed after you have looked at it, which closes the supply-chain risk that a fresh load each time cannot. Everything the page needs is served from this domain and built from the repository.
Sending is deliberate, not instant. A payment is built first, its fee shown, and nothing leaves until you confirm the exact amount and destination on a second screen. Check the address on that screen: malware that swaps an address on the clipboard swaps in one that looks just as valid.
Restoring is slow the first time. A wallet has to scan the chain from its restore height to catch up, and on a phone that can take a while. Setting the date it was made, when you know it, is what keeps that from being the whole chain.
i
Make a new wallet or restore one from its 12 words. Bitcoin's chain is public,
so the explorer above can group your addresses together.
i
Receive gives you an address to be paid at, Send spends from the balance, and
Secrets holds the seed words. Transactions are logged beside the wallet.
Makes a brand new wallet with a fresh 12 word seed (BIP84, the standard
every mainstream wallet restores from). The words are shown once, here,
and never sent anywhere. Write them down before you fund it.
Restores a BIP84 (bc1...) wallet: the kind this page creates, and the default in most wallets since 2018. A wallet that used legacy or wrapped addresses will show empty here; restore it in its own software.
Paste a zpub extended public key to watch a wallet: balance and
history, no spending, no secrets on this machine at all. An xpub works
only if it is a native-segwit (BIP84) account key; a legacy wallet's
xpub would show an empty balance here, because this derives bc1q
addresses.
Watch-only. This wallet was opened from a public key, so it can show the balance and history but cannot send. Restore with the seed words to spend.
Balance
0 BTC
Receive
This is the wallet's next unused address. Once a payment lands on it and you refresh, the wallet moves to a fresh one; reusing addresses is legal but bad for privacy on a public chain.
Send
BTC
Confirm this payment. Once broadcast, it cannot be reversed.
Wallet secrets
The 12 words are the whole wallet. Anyone who reads them owns the coins. Reveal them only where nobody can see the screen, write them on paper, and do not save them to this machine.
The honest notes
The keys never leave the tab. Seed words, derivation and transaction signing all happen in this page. What crosses the network is what any light wallet asks an explorer: address lookups, fee estimates, and a finished transaction to broadcast. The security policy forbids this page talking to anywhere but this site, which your browser enforces.
The explorer talks to our server, not to you. Same trade as the Monero tab's node, with one honest difference: a Monero node cannot tell which payments are yours, but an Esplora explorer is asked about your addresses by name, so the one you pick can link them into a cluster. It still never sees your IP (this site's server forwards the ask), your keys, or your words.
Which means our own server sees them too, and we say so. The questions pass through this site to get to the explorer, so the request log could be read as a wallet. Padded lookups, under Explorer above, mix every batch with real decoy addresses in a shuffled order, so the log holds a set your wallet is merely somewhere inside; the follow-up calls are padded too, or they would hand back exactly what the shuffle hid. It costs two or three times the requests, public explorers rate-limit, and it does not defeat someone willing to cluster the addresses on the chain itself. Pointing this at your own Esplora beats it outright, and so does reaching the site over its Tor mirror, where there is no Cloudflare in the path at all.
One standard, done properly. The wallet is BIP84 throughout: 12 words, m/84'/0'/0', bech32 bc1q addresses. Those words restore in Sparrow, Electrum, BlueWallet, Trezor, Ledger and everything else from this decade. Legacy address types are supported for sending to, not for holding.
The cryptography is not ours. Keys and signatures come from the audited scure/noble libraries, bundled into one file served from this domain and rebuilt from the repository by a test on every change.
Nothing is stored, on purpose. No wallet file, no browser storage; memory only, gone on reload. The seed words are the only way back in, which is why the page will not stop telling you to write them down.
Sending is deliberate. A payment is built and signed locally, its real fee shown, and nothing is broadcast until you confirm the amount and address on a second screen. Change below Bitcoin's dust limit goes to the miner rather than becoming a coin the network would refuse.
Fees are the network's, not ours. The fee options come from the explorer's live estimates in sats per vbyte. This site adds nothing on top, takes no cut, and would not know how to.
i
If your Monero wallet on this computer wrote an unsigned_monero_tx,
a Labyrinth Vault can open it and tell you what the payment says it does. This
turns the file into codes for the vault's camera. Nothing is uploaded and
nothing comes back.
The vault reads these. It does not sign them.
Everything inside one of these files is the sending wallet's own account of its
own transaction: the amounts, the ring, the destination, the claim that one
output is your change. A signature has to be over a destination the vault
rebuilt from its own keys, and a file cannot be checked that way. So the vault
opens it, shows you what it claims, and stops. What comes back is you having
read a screen.
220 ms a frame
Frame 1 of 1
The codes repeat until you leave this tab. There is no way for the vault to
say it has seen enough, so the loop is what makes a scan finish: a camera
that misses a frame catches it on the next pass.
Where do these codes come from?A format with two implementations, and a test that holds them together.
The frames are the Labyrinth Vault's own airgap format: the file cut into
pieces, each one base32 with a CRC-32 of the whole payload on every frame, so a
misread or a half-finished scan fails rather than assembling the wrong bytes.
The vault has its own encoder and this page has a second one, which is a debt
rather than a design. It is serviced by
test/vaultwire.test.ts, which checks this page's frames against
frames the vault's own encoder produced, over payload sizes chosen to break a
careless port. If the two disagree, this page is the one that is wrong.
i
Make a paper wallet, or read one back from its phrase or its view key. Checking
an address moved into the wallets, where an address turns up. Restoring and
watching handle no secrets; making a wallet here is the part that needs care.
Does this page actually work?Nine checks, run in your browser before anything else was allowed to happen.
If any of it fails, the generator stays switched off. This is the evidence for
that claim rather than the claim itself, which is why it is folded: it is here
to be opened when you want it, not read before you can reach the tool.
Make a paper wallet
Go offline first. Save this page to disk (Ctrl-S),
disconnect the machine from the internet, and open the saved copy.
Nothing here needs the network once the page has loaded, which you can
watch for yourself by pulling the plug and seeing it keep working. Best
of all is a machine that will be wiped afterwards.
Pick the coin and make the wallet. Add your own
randomness if you have any: dice, a keyboard mash, anything. It is
hashed together with the browser's, so it can only add.
Write the words down on paper. Not a photo, not a
password manager, not a text file. Nothing here is stored, so the words
are the only copy there will ever be.
Check it restores, in other software, before funding it.
This is the step that actually proves the wallet, because it is a
different implementation agreeing. If the address differs by a single
character, this page is wrong and you have lost nothing.
Send a small amount, then spend it back out. Do that
before the wallet holds anything you would miss.
The two checks that matter, spelled out.
Generate with the network off. Save this page to disk
(Ctrl-S), disconnect the machine from the internet, open the saved copy,
and generate there. Nothing here needs the network after the page loads,
which you can watch by disconnecting and seeing it keep working. Best of
all is a machine that will be wiped afterwards.
Restore it in the official wallet and confirm the address
matches, before you send anything to it. This is the check that
actually proves it, because it is a different implementation agreeing.
monero-wallet-cli --restore-deterministic-wallet, type the 25
words, and compare the address it shows against the one printed here. If
they differ by a single character, this page is wrong and you have lost
nothing.
And then, always: send a small amount first, and spend it back out again,
before the wallet holds anything you would miss.
Make a
Where the randomness comes from
32 bytes from crypto.getRandomValues, your browser's own
cryptographic generator. You can mix in your own on top: roll dice, mash the
keyboard, type anything at all. It is hashed together with the browser's
bytes, so it can only add and can never subtract, and it means a weak or
tampered generator is not enough on its own to predict your key.
Twelve words, BIP84, a bc1 address: the standard every
mainstream wallet has restored from since 2018. Derived here in the tab
and never sent anywhere.
Your Bitcoin wallet
Nothing here is stored. This page keeps no record of it, there is nowhere
for it to be sent, and closing the tab destroys it. Write it down or print
it before you leave.
Your wallet
Nothing here is stored. This page keeps no record of it, there is nowhere
for it to be sent, and closing the tab destroys it. Write it down or print
it before you leave.
Restore a phrase
Type 25 words and see which wallet they open. Useful for two things:
checking a phrase you wrote down is legible and correct, and confirming the
words on your paper really do produce the address printed beside them.
Watch a wallet without being able to spend from it
A Monero wallet has two secrets and they do different jobs. The
view key finds money arriving. The spend key
authorises money leaving. Hand only the view key to the official wallet and
it will show you the balance and every incoming payment, while the spend key
stays on the paper where you put it.
That is how you check a paper wallet's balance without ever exposing it, and
it is why this page does not need to become a wallet to answer the question.
A view key is a smaller secret, not a public one.
Anyone holding it can see every payment that address receives, for as long
as it exists, and can tell how much is there. They cannot move any of it.
Put it on a machine you would be comfortable having that history on, and do
not paste it into a block explorer or a "balance checker" website, which is
the same mistake as pasting a seed phrase, just quieter.
The honest notes
Nothing is uploaded, and there is nowhere to upload to. Static page, no endpoint, no account. The security policy served with this page forbids it opening a connection to any other domain at all, which is a rule your browser enforces rather than a promise from us, and the panel above lets you watch it being enforced.
We would rather you used the official wallet. That is not modesty. A browser tab shares a process with everything else you have open, cannot wipe a key out of memory reliably, and is delivered fresh from a server every time you load it. The official wallet has none of those problems. This page exists for the case where you want a throwaway receiving address without installing anything, and it should be treated as exactly that.
The cryptography is not ours. Keccak-256 comes from @noble/hashes and the ed25519 arithmetic from @noble/curves, both audited and both served from this domain. What is written here is the Monero-specific part: scalar reduction, the key derivation, base58 and the seed phrase.
What the checks above actually prove. Keccak against published vectors, the ed25519 base point against its one published encoding, and base58 and the checksum against a real address that the official Monero wallet produced rather than this code. The last of those is a genuine cross-check against software that is not ours. The seed-phrase checksum is verified against Monero's own published test vector too, in the test suite.
What they cannot prove. There is no published secret-to-address vector to test the private-to-public step against, and inventing one would prove nothing. That gap is exactly why the instruction to restore in the official wallet before funding is not a formality. It is the only check that closes it.
A saved copy of this page is safer than this one. Not because we would change it, but because a saved copy cannot be changed after you have looked at it. Save it, read it, disconnect, and use the copy. The whole page and everything it loads is in the repository, and what is served is built from it with nothing added.
A paper wallet is a receiving address, not an account. Spending from it means importing the key into a real wallet, and at that moment it stops being cold. Sweep it in one go rather than repeatedly, and treat the paper as spent once you have. If you want to spend in the browser rather than install anything, the wallet page runs a real Monero wallet in the tab, with all the caveats that implies stated up front.
Checking the balance does not need this page. The Watch a wallet tab prints the exact command to load an address and its view key into the official wallet as watch-only. That gives you the balance and every incoming payment in software built for it, with nothing here talking to the network and the spend key never leaving your paper. It is the reason this page can stay read-only rather than growing into a wallet.
The restore height is an estimate, and it errs early on purpose. A new wallet that scans from the genesis block takes days, so the export sets a starting height worked out from the date. Starting too early only costs patience; starting too late means the wallet silently never sees payments that arrived before that block, and the balance reads zero with nothing to say why. So the number is deliberately about a week behind, and if you know the real date the wallet was made, use that.
The view key is on the paper too. It lets someone see what arrives without being able to spend it, which is useful for watching a balance from a machine you trust less. It is still worth keeping private: anyone with it can see everything that address receives.
A wallet that lives in a browser tab is the least safe way to hold Monero, and being honest about that is the point of this page.
The keys are made and kept in this tab and nowhere else. That is the good part.
The bad part is everything a browser tab is: it shares a process with every
other page you have open, it cannot reliably wipe a secret out of memory, and it
is delivered fresh from a server every time you load it, so a single altered
script on a single day would harvest every key made that day. The
paper wallet page spells this out at length and it
all applies here, more so, because this page also holds the spend key while it
runs.
So the honest recommendation is the same one that page makes: for anything you
would be upset to lose, use the
official Monero wallet,
offline. Use this for a small, spendable amount you can afford to lose, the way
you would carry cash in a pocket rather than keep your savings there. Write the
seed phrase down when you create a wallet: it is the only copy, and closing this
tab erases everything else.
Nothing is stored. The wallet lives in memory for as long as
this tab is open and is gone the moment you close it or reload. That is
deliberate: a wallet file sitting in browser storage is a wallet file waiting to
be read. It also means the seed phrase is the only way back in, so if you have
not written it down, you have not made a wallet, you have made a countdown.
The Monero warnings apply here too, plus one Bitcoin brings itself.
Everything the Monero tab's warning says about a wallet in a browser tab is
true here too: keys made and held in this tab only, nothing stored, a reload
erases everything but the seed words, and one poisoned script on one day
could steal every key made that day. For anything you would be upset to lose,
use a hardware wallet or Sparrow
offline; use this like cash in a pocket.
The extra warning is privacy. Bitcoin's chain is public: every address, every
amount, forever. This wallet asks the block explorer you pick about your
addresses as a group, so that explorer can link them together as one wallet.
The request goes through this site's server, so the explorer does not learn
your IP, but linkability is what Bitcoin is. If that matters to you, it is
the reason the rest of this page is about Monero.
A wallet generator on a website is a dangerous thing, and this one is no exception.
Every other tool on this site fails loudly. A broken image converter gives you a
broken image and you can see it. This one fails silently: a derivation
that is wrong by a single step produces a perfectly well-formed address that
looks exactly like a working one, and the only way to find out is to send money
to it and never see the money again.
Web wallet generators have also been a favourite target for supply-chain
attacks, because one altered script on one day harvests every key made that day.
That risk does not go away because we are honest. It goes away because you check.
So the recommendation is plainly this: do not use the generator unless
you are willing to do the two checks below. If you are not going to do
them, use the
official Monero wallet
instead, offline. It is free, it takes ten minutes, and it is what we would tell
a friend to do. The address checker and the phrase restorer on this page are
safe to use for anything, because they handle no secrets.
A wallet has to talk to a Monero node to see the chain and to broadcast a
payment. Your browser is not allowed to reach any other site from this page, so
the traffic goes through this site's server to the node you pick. The node sees
this site asking, never your address or your IP; it cannot spend anything and,
because the scanning happens here in the tab, it cannot even see which payments
are yours. If the node you pick stops answering, the wallet quietly tries the
others and says so. Point it at your own node if you would rather not trust one
of these.
A light Bitcoin wallet asks a block explorer about its addresses and hands
it finished transactions to broadcast. Your browser is not allowed to reach
any other site from this page, so the traffic goes through this site's
server to the explorer you pick. The explorer sees the addresses it is
asked about, never your IP; it holds no keys and cannot spend anything. If
it stops answering, the wallet quietly tries the other and says so. Point
this at your own Esplora instance if you would rather trust nobody.
Lookups. Direct asks the explorer about your addresses and
nothing else, which is fast and lets it group them as one wallet. Padded hides
them among others so it cannot, at the cost of a slower sync.
Is this actually private?
The honest notes
The keys never leave the tab. Creating, restoring, scanning and signing all happen in this page, in a background worker. What crosses the network is what any wallet sends a node: requests for blocks, and a finished transaction to broadcast. The security policy served with this page forbids it opening a connection to anywhere but this site, which your browser enforces, and the panel above lets you watch it do so.
The node talks to our server, not to you. Your browser cannot reach a node directly under that policy, so the request goes to this site and this site forwards it. The upside is real: the node never learns your IP address, and it never learns which of the transactions it hands over are the ones you care about, because that matching happens in your tab. The downside is that this site's server sees that some visitor is talking to that node. It does not see your address, your keys or your balance, none of which are ever sent to it. If even that is too much, run your own node and point the wallet at it.
Nothing is stored, on purpose. There is no wallet file, in this site's storage or anywhere else. The wallet is held in memory while the tab is open and discarded when it closes or reloads. That removes a whole category of risk (a wallet file left behind on a shared computer) and puts the entire weight on the seed phrase, which is why the page will not stop reminding you to write it down.
The cryptography is not ours, and this time we mean all of it. The wallet is monero-ts, which wraps Monero's own C++ wallet compiled to WebAssembly. Writing a Monero wallet from scratch would be exactly the irresponsible thing the paper-wallet page warns against, so this does not: it runs the same code the official wallet does, in your browser. It is served from this domain, unmodified except for removing an environment check that the security policy forbids, and the exact bytes are pinned by a test in the repository.
A saved copy is safer than this one. As with the paper wallet, a copy of this page saved to disk cannot be changed after you have looked at it, which closes the supply-chain risk that a fresh load each time cannot. Everything the page needs is served from this domain and built from the repository.
Sending is deliberate, not instant. A payment is built first, its fee shown, and nothing leaves until you confirm the exact amount and destination on a second screen. Check the address on that screen: malware that swaps an address on the clipboard swaps in one that looks just as valid.
Restoring is slow the first time. A wallet has to scan the chain from its restore height to catch up, and on a phone that can take a while. Setting the date it was made, when you know it, is what keeps that from being the whole chain.
Nothing here is for sale, nothing is tracked, and there is no account to make.
If something saved you an hour: 83TQcTwusSQ4WKbPQE5osrF3cR4GWe2zmcNWeozK6BSqHSaeLvjUVe476ouVwLKn1uVwEFcbJQvnme7W6dTV5SB93x45DEy
You can
check that address here before sending anything.