Keeping your Ethereum wallet secure

Your private key gives control over your assets. Anyone with the key or recovery phrase may be able to transfer your funds. ETH Wallet creates and signs transactions in your browser, but local processing does not remove every risk.

Back up your account before sending funds

When you create a wallet, save the private key and recovery phrase in a secure offline location. You may optionally download an encrypted JSON keystore. A recovery phrase can derive multiple accounts; this wallet currently opens the default derivation path when a phrase is imported.

Understand persistent sessions

The wallet can restore a previously connected account on the same browser after restart. Encrypted session material and a browser-held key remain on that device. Anyone who can run malicious code in your browser environment may still compromise the account. Close the wallet to remove its saved session when you finish on a shared device.

Review every transaction

Before signing, verify the destination, asset, amount, network and estimated gas fee. Token names, QR codes and messages from strangers can be misleading. Do not assume a transaction can be reversed after it is confirmed.

Independent security review

This package has not received a completed independent security audit. Test with a disposable account and small amounts before considering more substantial use. Keep your browser, operating system and web-hosting environment secure.