Is my portfolio actually private?
Yes, at the level we can prove in the browser. Your holdings are
encrypted on your device with AES-256-GCM before they ever leave.
The server sees only a blob of ciphertext plus a monotonic sequence
number. The key never touches the network.
What does the server see?
- Your username, for login.
- A scrypt verifier of whatever you use to log in — either a
passphrase or the secret your passkey derives (see “are logins
safe”). The passphrase or passkey itself never leaves your
device.
- If you signed up with a passkey: the credential ID, so we can
prompt the right one next time. Never the private key.
- Your email, only if you chose to add one.
- Your encrypted vault — unreadable without your vault passphrase.
- An audit trail: when your vault changed, from roughly
which region, and how big it got. Never what changed.
Passkey or passphrase — which should I pick?
Default to passkey. Your device (Face ID, Touch ID,
Windows Hello, a hardware key) holds a private key that never leaves
it; on login, the browser asks the device for a per-site secret and
we stretch that with the same scrypt KDF the passphrase path uses.
Nothing to remember, nothing to phish.
Pick passphrase if you'd rather memorise a phrase,
or if you plan to log in from browsers where passkey roaming is
awkward. You can't switch after signup yet — that's coming.
Either way, your vault passphrase — the one that actually
decrypts your holdings — is separate and still typed. That's the
key the server can never see, and it's what makes the encryption
real.
What if I lose the device with my passkey?
If your passkey syncs (iCloud Keychain, Google Password Manager,
1Password, etc.) it comes back with your account. If it doesn't —
say it lived only on one hardware key — the account is
stuck. StealthLedger can't reset it because it has no
shared secret to reset to.
Practical mitigations, in order of effort:
- Enrol a second passkey on another device (phone + laptop, or a
hardware key you keep in a drawer).
- Keep a passphrase attached as a fallback (coming to Settings
soon; for now, sign up with a passphrase if you want that
safety net).
- Write down your vault recovery code either way; it's
what protects the actual holdings, and it's paper-only.
Are logins safe if the server gets dumped?
The server never stores your login secret — passphrase or passkey.
It stores a scrypt verifier with N=65536, r=8, p=1
(about 64 MB per guess). A stolen database gives an attacker no
help decrypting any vault — vault contents need the vault
passphrase, which the server has never seen.
Passkey accounts are quietly stronger against dumps because the
secret going into scrypt is a 32-byte high-entropy value from the
authenticator, not something a human typed — offline cracking has
essentially nothing to guess against.
What if I forget my vault passphrase?
Your holdings are gone. Not “wait a while” gone — gone. There is no
reset flow because there is no reset key. Set up a
recovery code when you create the vault; that’s the escape
hatch.
What if I forget my login passphrase (or lose my passkey)?
Right now, the account is stuck. If we later add an email-based
reset it will only reset the login, not decrypt anything —
the vault contents are still gated by the vault passphrase.
What if the site owner turns evil?
Because the site serves you the JavaScript that touches your vault
passphrase, a determined operator could push a poisoned build. We
mitigate that with a strict Content-Security-Policy (no inline
scripts, no third-party origins), a small hand-written codebase,
and a published crypto spec you can diff against what your browser
loads. The application itself is proprietary; the encryption
layer, threat model, and audit-log format are open for review.
How is this different from Bitwarden or 1Password?
Same idea, narrower scope. Purpose-built encrypted spreadsheet
for crypto holdings. Fewer features, smaller codebase. Bitwarden
and 1Password are fully open source; StealthLedger publishes its
crypto layer and threat model rather than the whole app.
Do you have telemetry or analytics?
None. No trackers, no pings, no third-party scripts.
