Phobia Wallet holds private keys for 18 chains on a user's own machine. These notes describe what it protects, how, and where the protection stops. They reflect release v4.10.0-beta.5.

Threat model in one paragraph

The wallet is non-custodial: nobody — including its developer — can freeze, seize or recover funds. It defends the seed and keys on the device, hides the user's IP address from block explorers and price APIs, and refuses to leak data through insecure endpoints. It does not make transparent chains private: Tor hides who is asking, not what the public ledger already shows.

Keys and the vault

The 24-word seed is generated locally from the OS CSPRNG with 256 bits of entropy (BIP39) and never leaves the device.
The vault is sealed with the user's password through Argon2id (m = 64 MiB, t = 4, p = 2) and AES-256-GCM with versioned associated data.
Keys are decrypted into memory only when used, then zeroed.
Every send asks for the password again before signing.
Signing uses NBitcoin, Nethereum and BouncyCastle.

Network privacy: Tor with a kill-switch

Tor is bundled. The wallet runs its own client (port 9250 or the next free one), separate from Tor Browser.
Balance lookups, prices and broadcasts go through Tor, each request type on its own circuit; names are resolved by Tor, not local DNS.
With the kill-switch on, a request that cannot go through Tor does not go at all.
A .onion node is never used without Tor and never silently swapped for a clearnet one. Plain http:// endpoints are refused.
Any chain can point at another server or your own node; Settings → Privacy lists every server and what it learns.

Monero without a remote wallet

The real monero-wallet-rpc runs locally on loopback only, behind a random login that only the current OS user can read — so a web page or another local account cannot ask it to send. The Tor and Monero binaries are pinned to upstream's signed sums.

Before you press send

Privacy Radar analyses a transaction offline and reports what it would reveal on-chain — mainly whether it links previously unconnected coins. Security Center reads the live settings and says what is actually protecting the wallet, for example that the IP is visible to explorers when Tor is off.

On the device

Seed and key screens are excluded from screen capture on Windows (WDA_EXCLUDEFROMCAPTURE) and Android (FLAG_SECURE).
Auto-lock on idle and on minimise; Ctrl+L locks at once. A duress password is available.

Supply chain

Every release ships SHA256SUMS, build attestations (verifiable with gh attestation verify) and an SBOM.
Windows executables and the Android APK are signed by the author.
The managed assemblies that derive keys and sign are byte-identical when rebuilt from source.

Known limits

No external security audit has been done yet. It is planned; until then, treat the wallet as beta software.
Installers are not yet reproducible byte-for-byte (planned).
The Windows signing certificate is self-signed, so Windows shows no publisher name.
Linux cannot exclude sensitive screens from capture — the Security Center says so.
Zcash support covers transparent addresses only.