scrypt turns your password into a key using 32 MB of memory per attempt, so every guess an attacker makes costs the same work and GPUs gain little. A random salt per wallet rules out precomputed tables.
Security Center
The Ownbit security model
The Ownbit cold wallet is a permanently offline signing device: your private key lives only on this non-networked phone, and its only channel to the outside world is a human-readable QR code. The goal isn't "absolute security" — no system achieves that — but to minimize what you must trust and make everything that remains verifiable by you.
How Ownbit encrypts your seed
Starting with Ownbit 5.1, the mnemonic, seed and passphrase on your phone are stored in the Ownbit Vault v2 format, whose specification and iOS implementation are open source. It replaces the original v1 encryption and makes a stolen copy of your wallet data practically useless.
| Ownbit v1 (old) | Ownbit Vault v2 | |
|---|---|---|
| Key derivation | One SHA-256 pass, no salt | scrypt N=32768, r=8, p=1, random 16-byte salt per wallet |
| Cipher | AES-CBC, fixed IV | AES-256-GCM, random 12-byte nonce for every field |
| Tamper check | None | Yes: the GCM tag rejects a wrong password or a modified record |
| Device binding | No | On the phone: yes, a device key in the Keychain (ThisDeviceOnly). Cloud backup: no |
| Offline brute force if the encrypted data leaks | Very easy: fast, and one precomputed table works for every user | Copy from the phone: practically impossible on another device. Cloud backup: every guess costs a full scrypt run with 32 MB of memory |
AES-256-GCM with a fresh random nonce for every field. Its authentication tag means a wrong password, or anyone tampering with the stored data, is detected and rejected.
On the phone, the AES key is HMAC-SHA256(device key, scrypt key). The device key is 32 random bytes in a Keychain item that never syncs and is never included in device backups, so a copied wallet database cannot be brute-forced anywhere else, however weak the password.
The optional iCloud mnemonic backup uses the same format without the device key, so you can restore it on a new phone with your password. It keeps the full scrypt protection, so give it a strong password.
Upgrading is automatic: mnemonic wallets created before 5.1 switch to Vault v2 the first time you enter their password, and an iCloud backup is rewritten in the new format the next time you back it up. The format is a self-describing envelope (OBV2), so its parameters can be raised later without breaking existing data.
Three foundations of its security
Each foundation rules out an entire class of attack. These are the design's real, defensible strengths.
The signing phone has no network channel. Removes remote intrusion, background exfiltration and cloud-backup leaks.
Keys and seed are never uploaded in plain text: they stay encrypted on your device and leave it only inside the optional encrypted iCloud backup, if you turn it on (never on a cold-wallet phone). You can generate the seed offline and import it. Removes custodial risk.
The only thing crossing the gap is plaintext QR you can inspect line by line — a public key or a signature, nothing hidden.
An honest threat model
No wallet that claims "absolute security" deserves your trust. What deserves trust is a product that states its risks plainly. The threat model page covers what this design removes (remote attacks, custodial risk, watch-side leakage) and the residual trust that remains (signer implementation, entropy quality, build integrity) — and how each is bounded.
How it relates to hardware wallets
This isn't about which is "absolutely stronger," but what you choose to trust. Each model has real trade-offs.
| Dimension | Hardware cold wallet | Ownbit cold wallet |
|---|---|---|
| Key isolation | Dedicated secure element | Permanently offline general device |
| What you must trust | Closed firmware + supply chain | Open standards + public contracts |
| Interaction channel | Proprietary (USB/BT/QR) | QR only, plaintext-inspectable |
| Independently verifiable | Limited | Contracts / encoding / determinism |
| Vendor lock-in | Usually present | None; standard seed is portable |
It isn't strictly either/or: a hardware wallet is strong on physical isolation, Ownbit on verifiability and no lock-in. For high-value assets, the sounder approach is to spread single-key risk across a MultiSig rather than bet everything on one device.
Don't trust — verify
You don't have to believe us. Every claim here is something you can check by hand: decode a signing QR to plaintext, test the signing determinism, read the public contracts, and verify standard seed import. The verify-it-yourself page walks through each check.
Threat model
An honest threat model states what a design removes and what it does not. Ownbit's cold wallet removes several whole classes of attack by architecture; a few residual risks remain, which we name plainly below along with how they're bounded.
OpenAudits and code
Here is our audit stance, stated plainly. We would rather put our budget and attention into architecture you can verify than into a certificate.
OpenVerify it yourself
You don't have to believe us. Every claim in the security model is something you can check by hand — no source-code access required. Here are four black-box checks anyone can run.
OpenSecurity FAQ
Straight answers to the security questions we're asked most. For the full reasoning, see the security model, threat model, and verify-it-yourself pages.
OpenLast updated:
Download
Download Ownbit
Install the app, then set up a cold wallet or MultiSig for the setup you need.