Is my portfolio actually private?
Yes, at the level we can prove in the browser. Your holdings are
encrypted on your device with AES-256-GCM before they ever leave.
The server sees only a blob of ciphertext plus a monotonic sequence
number. The key never touches the network.
What does the server actually see?
- Your username, for login.
- A scrypt verifier of your login secret — passphrase or the
secret derived from your passkey. The secret itself never
leaves your device.
- If you signed up with a passkey: the credential ID, so we can
prompt the right one next time. Never the private key.
- Your email, only if you chose to add one.
- Your encrypted vault — unreadable without your vault
passphrase.
- An audit trail: when your vault changed and how big
it got. Never what changed.
Passkey or passphrase — which should I pick?
Default to passkey. Your device (Face ID,
Touch ID, Windows Hello, a hardware key) holds a private key that
never leaves it; on login the browser asks the device for a
per-site secret and we stretch that with the same scrypt KDF the
passphrase path uses. Nothing to remember, nothing to phish.
Pick passphrase if you'd rather memorise a
phrase, or if you plan to log in from browsers where passkey
roaming is awkward.
There are actually two secrets, doing two
different jobs. Login proves who you are to the server so
it hands over your encrypted file. Unlock then decrypts
the file inside your browser — the server never sees the unlock
key. Both can be passkeys, or one passkey and one passphrase, or
both passphrases. The most common setup is: login passkey +
unlock passkey, so a normal visit is a single Face ID prompt.
Your vault passphrase stays as a fallback either way —
it's what protects your holdings if you ever lose every device
that holds a passkey.
Login vs unlock — why are there two steps?
Because they do different jobs and only one of them can involve
the server.
-
Login is between you and the server. It proves
you’re allowed to have the encrypted file, and the server hands
it over. A login passkey or login passphrase
unlocks this step.
-
Unlock is entirely in your browser. It decrypts
the file the server just handed you — the server never sees
the key. An unlock passkey or vault passphrase
unlocks this step.
So there can be up to four credentials on a full account: a login
passkey, a login passphrase, an unlock passkey, and a vault
passphrase. Most people set one on each side and forget about it.
Settings groups them under “Login — how you prove it’s you” and
“Unlock — how the vault decrypts” for exactly this reason.
Rule of thumb: if a screen is titled Log in, it wants a
login credential. If it’s titled Unlock your vault, it
wants an unlock credential. Adding a passkey on one side doesn’t
add it on the other — they’re independent.
I added a passkey but it’s still asking for a passphrase
You added it on one side; the other side doesn’t have one yet.
The most common case: you added a login passkey, signed
in with a tap, and then the unlock screen asked for your
passphrase because the vault itself doesn’t know about a passkey
yet.
Fix it in Settings → Unlock — how the vault decrypts
→ Add passkey for unlocking. That wraps the vault key with
a passkey-derived secret and appends it to the vault’s unlockers,
so next time the unlock screen offers a passkey button instead of
the passphrase field.
Restoring a backup carries over whatever unlockers the backup had,
which is usually just the original passphrase. Add an unlock
passkey once, after restore, and you’re done.
What if I lose the device with my passkey?
If your passkey syncs (iCloud Keychain, Google Password Manager,
1Password, etc.) it comes back with your account. If it doesn't —
say it lived only on one hardware key — the account is
stuck. StealthLedger can't reset it because it has no
shared secret to reset to.
Practical mitigations, in order of effort:
- Enrol a second passkey on another device (Settings →
Add another device). One on your laptop, one on
your phone is the pattern.
- Keep a login passphrase attached as a fallback — the signup
flow lets you choose one, and Settings lets you add or change
it later.
- Write down your vault recovery code either way —
that's what protects the actual holdings even if every device
is gone.
What if I forget my login passphrase (or lose my passkey)?
Right now, the account is stuck. If we later add an email-based
reset it will only reset the login, not decrypt anything
— the vault contents are still gated by the vault passphrase.
Restoring a backup — what should I expect?
A backup file is your encrypted vault as it was on the day you
exported it: same vaultId, same unlockers, same holdings.
Restoring it into a new account overwrites whatever vault that
account currently has and hands you back the old one. You’ll
unlock it with the backup’s vault passphrase or
recovery code — not the passphrase you just used to sign up.
The usual flow when moving between accounts or coming from the
old single-tenant version:
- Sign up on the new site (any username you like).
- Log in, then head to Settings → Restore from backup…
and pick the JSON file.
- Confirm the “different vault” warning; the app locks itself.
- Unlock with the passphrase (or recovery code) that opened the
backup back when it was made.
- Optional but recommended: add an unlock passkey so future
unlocks are one tap.
If the restore screen refuses your file, the fastest reset is
Settings → Forget access token, log in again with the
account passphrase, then retry.
Does Koinly import work on my phone?
No — the Koinly import is a bookmarklet you drag onto your
desktop browser's bookmarks bar, and mobile browsers don't have
one. Run the import once on a laptop or desktop and the resulting
Koinly section syncs to your vault; from then on you can view it
on mobile like any other section.
Are logins safe if the server gets dumped?
The server never stores your login secret. It stores a
scrypt verifier with N=65536, r=8, p=1 — about
64 MB of memory per guess. A stolen database gives an attacker
no help decrypting any vault; vault contents need the vault
passphrase, which the server has never seen.
What if I forget my vault passphrase?
Your holdings are gone. Not "wait a while" gone — gone. There is
no reset flow because there is no reset key. Set up a
recovery code when you create the vault; that's the
escape hatch.
What if the site owner turns evil?
Because the site serves you the JavaScript that touches your
vault passphrase, a determined operator could push a poisoned
build. We mitigate that with a strict Content-Security-Policy
(no inline scripts, no third-party origins), a small
hand-written codebase, and a published crypto spec you can
diff against what your browser loads. The application code
itself is proprietary; the encryption layer, threat model,
and audit-log format are open for review.
How much does it cost?
Free while we’re in preview. There’s no ad tier, no data resale,
and no plan to add one — the whole product only works if the
server can’t read your vault. If it stays around long-term it’ll
be a small optional subscription so hosting pays for itself; the
free tier and the encryption model don’t change.
Do I need to connect an exchange or a wallet?
No. You type in what you hold (or paste it from Koinly), and we
fetch unit prices only — the same anonymous quote your
browser can already get from CoinGecko. We never see, ask for,
or store your exchange logins, wallet addresses, or API keys.
Does it work on my phone?
Yes. StealthLedger runs in any modern mobile browser — Safari,
Chrome, Firefox — and installs to your home screen like a native
app (“Add to Home Screen”). Face ID / Touch ID passkeys give you
a one-tap unlock. The only thing you can’t do on mobile is the
Koinly bookmarklet import; run that once on a laptop and the
result syncs everywhere.
How is this different from Bitwarden or 1Password?
Same idea, narrower scope. StealthLedger is a purpose-built
encrypted spreadsheet for crypto holdings — fewer features,
smaller codebase. Bitwarden and 1Password are fully open source;
StealthLedger publishes its crypto layer and threat model rather
than the whole app.
Can I delete my account?
Yes, any time. Settings → Account → Danger zone → Delete my
account. Type your username to confirm. It’s a hard
delete — encrypted vault, sessions, audit log, all of
it. No grace period, no undo. Export your data first from
Settings if you want a copy.
Can I export or leave whenever I want?
Yes. Settings → Export encrypted vault downloads your
holdings as an encrypted file you can restore later, and
Delete account is a real delete — there’s nothing to
hold on to anyway, since we can’t read what we’re storing.
Do you have telemetry or analytics?
None. No trackers, no pings, no third-party scripts.
