Are browser-based Solana wallets safe?
A web wallet can be as safe as an app if the keys are made and locked on your device and the site cannot be quietly changed. The real risks are fake sites, malicious extensions and code swapped on the server, so check how a wallet handles each.
How a web wallet keeps keys
A non-custodial web wallet works like a phone app that happens to load in a browser:
- Keys are made on your device, by your browser’s own random number generator.
- They are locked with your password before they are saved anywhere, using your browser’s built-in encryption.
- The server only ever sees the locked copy, if it keeps one at all, and cannot open it.
- Transactions are signed in your browser. Only the signed transaction leaves your device.
Done that way, the company running the site never holds your keys, the same as Phantom or Solflare.
What can go wrong
| Risk | What happens | What protects you |
|---|---|---|
| A fake site | A lookalike address asks for your phrase or password | Typing the address yourself or using a bookmark; never entering your phrase on a site |
| Changed code | Someone who takes over the server sends you code that copies keys | Code served apart from the server that keeps accounts; strict security headers |
| A bad browser extension | An extension reads or changes the page | Few extensions, from sources you trust |
| A malicious transaction | You sign something that drains the wallet | A clear review of what will leave each wallet before you sign |
| Losing the device | The locked copy is gone with it | Your recovery words, kept offline |
The second row is the one specific to web wallets: an app’s code is fixed when you install it, but a website’s code is fetched each time you open it.
What to check before you trust one
- Where are keys made and locked? It should be your browser, with the encryption named, and never “on our servers”.
- Can you export your keys and recovery phrase? If not, you do not control the wallet.
- What does the server see? Ideally a locked file and nothing else.
- How is the code served? Look for strict security headers (a content security policy that blocks other sites' code) and code served apart from the server that holds accounts.
- What does the review show? Every amount that leaves every wallet, before you sign.
How Raven does it
Raven makes keys in your browser, inside a separate worker that the page itself cannot read, and locks them with your password (PBKDF2 with 600,000 rounds, then AES-256-GCM) before anything is saved. The server keeps only the locked copy and cannot open it. The pages and code come from Cloudflare, apart from the server that keeps accounts, so a server taken over could not change the code people run. The app may only load its own code and talk to its own server (and Privacy Cash’s relayer, for private moves), and every move ends in a review of what leaves each wallet before you sign. Your 12 words bring every wallet back.
Questions
Is a web wallet less safe than a browser extension?
Not by itself. Both run in your browser. An extension’s code is fixed until it updates; a website’s code is fetched each time, so how it is served matters more.
Should I keep my savings in a web wallet?
Keep savings on a hardware wallet or a wallet you never connect to sites, whatever the app. Use web wallets, extensions and apps for money you move.
What is the biggest risk with any wallet?
Signing something you did not read, and typing your recovery phrase into a site. Both happen in every kind of wallet.
Sources
Raven makes and locks your keys in your browser and serves its code apart from its server.
Join the waitlist