Skip to main content

How it works

Wallet creation​

When a user signs into an application using their email or social logins for the first time, a wallet is generated on the user's device. The corresponding wallet key for this wallet is securely split into three shards using Shamir's Secret Sharing algorithm.

  1. Shard A is stored securely on the user's device. For web applications, this is stored on the browser, or for mobile apps, it is in a secure enclave.

  2. Shard B is encrypted and stored in Amazon KMS using a key known to thirdweb. This process uses hardware security modules (HSMs) to protect the confidentiality and integrity of keys. The encrypted string is stored in thirdweb's database.

  3. Shard C is encrypted by user authentication and stored in Amazon's KMS using hardware security modules (HSMs) to protect the confidentiality and integrity of keys. Despite the key stored on thirdweb's servers, thirdweb has no way of decrypting and accessing the key.

    embedded-wallet-architecture.svg

Recoverability​

Embedded Wallets are non-custodial, and users can export their private key anytime. Users may recover their wallet from any device by authenticating or signing into an application to receive access to their wallet. Threshold secret-sharing cryptography is used to recreate the private key; two of three shards are required. If a user loses access to their authentication method (email, social login, or custom authentication), they cannot recover their wallet.

info

thirdweb does not have the ability to access user accounts or reconstruct private keys.

Embedded Wallet Scope​

Embedded Wallets are scoped to applications per API key. If users use the same email to sign in to a different application using Embedded Wallets, the application will manage an entirely different wallet.

Benefits of single application scoped wallets

  • Each application has limited access only to wallets created through their application. It cannot manage wallets from other applications.
  • Users may only view tokens sent or purchased from your application.
  • To improve user experience, saved payment methods and KYC verification are only provided to thirdweb; applications cannot view this information.

Users may view all their application-scoped Embedded Wallets in a single view using the My Wallets dashboard. Learn more about My Wallets.

Untitled

Scalability​

We support up to 100 wallets generated/second by default and can support higher limits (up to 3,000 wallets generated/second) upon request. Contact Sales for more information.

Security & privacy​

TLS Encryption

To increase security and privacy, private keys or wallet "seed phrases" are never stored or sent over a network. TLS encryption is used in transit for internal and external communications with thirdweb's back-end and databases. TLS encryption is also required for third-party vendors.

AES-256

Data backups and storage are encrypted with AES-256.

Threshold secret sharing

Using threshold secret sharing, thirdweb cannot reconstruct a user's private key, thereby providing a non-custodial wallet. Additionally, a customer's assets are safe even if thirdweb or the application developer (you) is compromised. In a compromised situation, an attacker may only be able to access one of three shards, which is inadequate to reconstruct the wallet's private key.

GDPR & CCPA

Embedded wallets are compliant with GDPR and CCPA within 90 days.

Audit and Bounty Program

HackerOne has audited embedded Wallet private key security architecture, and there is an ongoing bounty program to ensure vulnerabilities are caught. View the Letter of Attestation.