Security & privacy
Trust starts
with clear boundaries.
Understand local secret handling, public-data lookups and the limits of each tool.
Key tools are unaudited. Local key tools and confirmed broadcast are available on dedicated tool pages. QBitcoin has not undergone an independent security audit. Do not use key tools with real funds.
Wallet secrets stay on-device
The architecture requires seed phrases, private keys and signing material to remain on the user’s device. They must never enter backend requests, analytics, logs, PostgreSQL or Redis.
Local signing. Explicit broadcast.
Dedicated key and legacy message-signing tools run locally in Rust/WASM using established libraries; wallet transaction signing is not implemented. Broadcasting an already signed transaction must follow an explicit review and user action.
Public data has privacy implications
A public address lookup can reveal interest in an address. Extended public keys can expose many related addresses. Avoid sharing more public wallet information than a feature requires.
The current pages
Pages contain no analytics or third-party scripts. Dedicated local tools accept sensitive inputs in memory and clear them on request or page exit. Fonts and branding assets are served locally. The explorer sends only public lookups through the backend; the homepage search opens results in the explorer.
What remains to be verified
Independent cryptographic review and production hardening remain required before using real funds. Review tool limitations and keep key material private; local processing alone is not a security guarantee.