AirWallet Security model
What AirWallet protects you against, how, and the few things only you can protect.
AirWallet keeps your keys on a device that never connects to anything. Your everyday device watches balances, prepares payments and sends what was signed, without the keys. QR codes are the only thing that crosses between the two. The design rests on one rule: the offline screen shows exactly what will be signed, and anything it cannot show completely, it refuses.
Read the recipient and the amount on the offline screen, not the online one. A hacked online computer can show you anything, but it cannot change what the offline device shows.
What stops each threat
| Threat | What stops it |
|---|---|
| Malware on your online device | Watched wallets have no keys there. The offline screen shows what is really signed. |
| A swapped recipient address | The full address on the offline screen, look-alike warnings, and a "whose address is this" answer for any scanned address |
| A hidden fee or lies about input amounts | The signer computes the fee itself. SegWit coins need their whole previous transaction. A fee far above normal is asked about once more. |
| Fake balances or history | Balances are for display only, and nothing signed depends on them |
| A lying server or a network eavesdropper | Keys never travel. A send is looked up by its own ID before any retry. Tor or another proxy is optional. |
| A malicious website | Sites cannot see AirWallet until you allow them, and requests open in AirWallet's own window |
| A malicious QR code | The signer reads it as text only, with hard limits on animated codes |
| A weak random generator | 2 independent generators mixed, plus your own dice if you like |
| A signer leaking key bits | Deterministic signatures you can make again on another machine |
| Changed outside code | A fingerprint list checked by a test, pinned build tools, and pages that run only their own scripts |
| A swapped download | A signed SHA256SUMS.txt |
| Someone forcing you to unlock | Duress PINs |
| Your written words, found | Nothing in the app can help, so keep them private |
The sections below explain the parts that need more than a line. For every check the signer makes, coin by coin, see What the signer checks.
A hacked online device
Malware on your everyday device cannot spend a watched wallet's coins, because the keys are not there. What it can try is getting you to sign something you did not mean: another recipient, a bigger amount or a huge fee. The offline device decodes the exact bytes it is about to sign and shows what they do, so a lie on the online screen does not reach the signature.
It can also try subtler tricks, and the signer has an answer to each:
- It can lie about Bitcoin input amounts to hide a fee (CVE-2020-14199), so the signer checks each SegWit coin against its previous transaction. Taproot signatures cover every input's amount anyway.
- It can label someone else's address as your change, so the signer works out change from its own keys and never takes the online side's word.
- It can show fake balances, which reach the offline device only for display.
- It can hold a signed Solana transaction back to send later, so a pending one can be called off.
A break-in tends to show on the online side first. The app logs every send it broadcasts, and a send from a watched wallet that it did not make is marked "Not sent from this app" in Activity.
Address swaps and look-alikes
Some malware replaces the address you copied with the attacker's. Scammers also send tiny payments from addresses that look like yours, hoping you copy one from your history. This trick is called address poisoning.
The offline screen always shows the full recipient address. AirWallet also flags an address whose first and last 3 characters, after the prefix, match one you know: your contacts, your recent recipients, everyone your wallets have paid, and your own wallets. Activity tags look-alike senders and never offers their addresses for copying. Scan any address on either device, and AirWallet tells you whether it is yours, and which wallet and address it is.
Servers and the network
Only addresses, balances and finished, signed transactions travel over the network. Keys never do. A server's numbers never decide what gets signed: the signer checks fees against its own limits, and balances are for display.
A send is never broadcast twice by accident. If an error might hide a send that went out, the app first looks the transaction up by its own ID. Send again sends the same signed bytes and never makes a new payment.
To hide your IP address, use Tor or another SOCKS5 proxy (Settings → Proxy (Tor) on the desktop apps and Android). See Privacy.
Websites and the Chrome extension
Websites cannot see AirWallet until you turn on Solana apps or Ethereum apps in the extension's Settings → Websites. Both are off by default. Each request opens in AirWallet's own window, where the site cannot draw, and its buttons ignore clicks for 0.8 seconds so a click aimed at the site cannot land on Approve.
What the extension refuses or flags:
- on Solana, token approvals, handing over a token account, anything that fails in simulation, and a message that is really a transaction
- on Ethereum,
eth_sign, which is refused outright - typed data, which is summarized in words with unlimited permits flagged
- calls that hand over a contract, a Safe delegatecall (the trick behind the Bybit theft), and a spender that is a plain address rather than a contract, which are all flagged loudly
The extension is an online wallet. For keys that hold real money, use it as the everyday half and keep the keys on an offline signer.
QR codes, randomness and signatures
To the signer, a QR code is only text. It cannot run code or open a connection. The reader for animated codes stops at 2,000 parts or a 1 MB message, so a hostile code cannot make it grow or run forever.
New keys mix 2 independent random generators with anything you type or roll, so a flaw in one generator alone cannot make your keys guessable. See How keys are made.
Signatures for Bitcoin, Ethereum, Solana and Zcash are deterministic: the same key and transaction always give the same signature. A dishonest signer therefore has no random choice in which to hide bits of your key, and you can make each signature again on another machine to check. Monero's ring signatures cannot be checked this way.
Someone who makes you unlock
Settings → App lock → Duress PINs gives you extra PINs. Each opens a separate AirWallet holding only the wallets you chose for it, and nothing in it or in the saved data shows there is more. It hides your other wallets from whoever uses the app, but not from an expert examining the device's storage over time. See App lock, duress PINs and disguises.
What only you can protect
Your recovery phrase is the wallet. Whoever has it has the money, on any device. Write it on paper or stamp it in metal. Never keep it as a photo, a screenshot, a cloud note or in a synced password manager. The one documented theft from AirGap, a similar air-gapped wallet, started with a photographed phrase.
The signer is an ordinary phone or laptop, not a hardware wallet with a secure chip. Its keys are encrypted, but someone who can open the device and the app can use them, so turn on the app lock. If a device is lost, restore your words on another device and move the money to a new wallet.
The signer shows you everything it signs, but it cannot read the screen for you. Check the recipient, the amount and the fee every time.
A signer device that was compromised before it went offline stays compromised. Use a device that runs nothing but AirWallet, and keep it offline for good. See Keeping the offline device offline.
There are 2 smaller limits:
- Monero signatures cannot be made again and compared, so for Monero you trust the code, which you can read.
- A Squads (Solana multisig) proposal made by someone else cannot be fully checked, because what it does is stored on the blockchain, not in the code you scan. The signer says so, names the proposal's number so you can check it in the Squads app, and asks once more.