Security & privacy
Know what protects you. Know what does not.
Test first. Never mistake encryption for anonymity.
This application is not independently audited. Wallet contents are encrypted at rest, but ordinary BTC and ETH transfers are public. Tor, I2P, CoinJoin, and zk-SNARK transaction protocols are not active.
Local encrypted vault
AES-256-GCM · PBKDF2-SHA256 · 600,000 rounds
The entire local vault, including history and recovery phrase, is encrypted. Clearing browser data removes it. Browser extensions, malware, and malicious application updates can access secrets while unlocked.
Recovery & key management
HD wallet · BIP39 / BIP84 / BIP44
Back up your encrypted vault and keep the recovery phrase offline. The password protects this file; the recovery phrase controls the assets on both networks.
Encrypted account backup
GenMB built-in key-value store · private user scope
Only ciphertext is uploaded, and the server enforces account isolation. Your password and plaintext keys are never sent to the key-value store.
No account backup loaded in this session.
Restoring requires an empty local vault. Retain your file backup before removing the local one.
Network & privacy
No hidden anonymity claims
GenMB’s server calls mempool.space and PublicNode. Providers see your queried addresses and the server’s IP. Using Tor Browser would not route that server’s requests through Tor. No Tor or I2P relay is configured.
Read the privacy threat model →Remove this device’s vault
Deletes the encrypted browser copy, not your blockchain assets or any exported backups. You must have a recovery phrase or working backup.
Cryptographic self-check
Runs real public-vector derivation, encryption, tamper rejection, and signature checks in your browser. It uses no personal wallet keys and sends no network requests. Not an independent security audit.