Live on Sepolia Built on Zama FHEVM

A stolen key
isn't enough.

A smart account whose second factor lives in the contract. Your PIN, spending limit and trusted addresses are encrypted on-chain, so whoever steals your key can't drain the account — or even see the rules.

Create your account How it works

Open source · MITResearch prototype, not audited

The problem

Keys leak. A phishing page, malware, a seed phrase in a cloud backup. Once someone has your key, a regular wallet gives them everything — in one transaction.

2FA, guardians and co-signers usually live on servers or with other people. Encrypted Account puts the second factor where the money is: in the contract.

Same key, different ending

What a thief can do with your key

Regular wallet
  • ✕Everything leaves in one transaction
  • ✕A signed permit drains your tokens later
  • ✕No second factor and no way back
balance: 2.40 ETH → 0.00 ETH
Encrypted Account
  • ✓New addresses need your PIN, which the thief doesn't have
  • ✓About 12 guesses a month at most, each one counted on-chain
  • ✓Limits and trusted addresses are hidden, even from the key holder
  • ✓A permit signed with the key alone is void
  • ✓An escape sends everything to your backup address
balance: 2.40 ETH → 2.40 ETH

How it works

A PIN the contract checks without ever seeing it

Fully homomorphic encryption lets the contract compare encrypted values. The PIN is never decrypted; only the yes-or-no answer is.

  1. 01

    Set a PIN

    Your browser stretches it with Argon2id and encrypts the fingerprint. The PIN itself never leaves the page.

  2. 02

    Send as usual

    Everyday transfers to addresses you trust stay within your hidden limit. Anything unusual opens a PIN check with a fresh challenge.

  3. 03

    Checked under FHE

    The contract compares encrypted values and records the attempt before anyone learns the result.

  4. 04

    Only yes or no comes out

    Zama's threshold network decrypts a single bit. Correct: the transfer goes. Wrong: nothing moves, and the next try waits longer.

Under the hood

Built for the day your key leaks

Every guess counts

Attempts are written on-chain before the result is decrypted. From the third wrong guess, the wait grows from 15 minutes up to 7 days.

A tripwire nobody knows

Your limit hides a random threshold somewhere inside it. Not even you know where.

An encrypted address book

30 recipients and 10 spenders, stored as ciphertext. The key holder can't read them.

An escape without FHE

If your key leaks, start an escape: after a delay, funds can only go to your backup address. Even if the thief starts it.

No 2FA server

The second factor is not a code from an app or a server. Its state and its rules live in the contract.

Open and measured

The contracts were deployed and measured on Sepolia end to end: latency, gas and FHE cost. Every number in the repository points to raw data.

Try it on Sepolia

See it for yourself

Create an account in about two minutes, send with your PIN, then try a wrong one and watch it get counted.

Launch app Read the code

You need a browser wallet and a little Sepolia ETH. Testnet only.

Roadmap

What's next

Live

Hidden inheritance

No PIN for months? Your ERC-7984 tokens go to heirs whose addresses and shares stay encrypted, even after. Try it in the app.

Next

Steal this wallet

A Sepolia account whose seed phrase is public. Try to move the funds without the PIN.

Private mode

Encrypted balances and amounts with ERC-7984 tokens, and a duress PIN.

Agent accounts

An AI agent holds the key; a human holds the PIN.