Skip to content
keylo
Log inCreate wallet

Built so we can't touch your money

Keylo gives you an email login without handing us your keys. Your wallet is created and encrypted in your browser, and the only thing that reaches our servers is a locked copy we can't open.

What happens when you create a wallet

  1. Step 1

    You choose a password

    It stays in your browser. Before anything else happens, Keylo checks it against known breaches using only the first five characters of its SHA-1 hash, so the password itself is never shared.

  2. Step 2

    Your device stretches it with Argon2id

    64 MiB of memory and three passes, run in a background worker. That makes every guess expensive for anyone trying to crack a stolen copy.

  3. Step 3

    Two separate keys come out

    HKDF-SHA256 splits the result into a login key and a vault key. The login key proves it's you. The vault key is created as non-extractable inside the browser's crypto engine and never leaves your device.

  4. Step 4

    Your wallet is locked with AES-256-GCM

    The recovery phrase is encrypted with the vault key. Tampering with the locked copy makes decryption fail instead of producing a different wallet.

  5. Step 5

    Only the locked copy is uploaded

    Our servers store the ciphertext and hash your login key again with Argon2id. Even with full database access, nobody can open your wallet without your password.

  6. The result

    Your keys exist in readable form only inside your unlocked browser tab. Signing happens there too.

The trade-off, said plainly

Because we never hold your keys, we can't recover your wallet for you. Your recovery phrase is the backup.

  • Forgot your password? You can reset it by email, then restore your wallet with your 12-word recovery phrase. Your old locked wallet stays saved, so it opens again if you remember the old password.
  • Lost your phrase but still know your password? Open Settings while logged in and write it down again. Nothing is lost.
  • Lost both? No one, including Keylo, can open the wallet. That's the same guarantee that stops anyone else from opening it.

Protecting your account

Two-step verification

Add an authenticator app for a six-digit code at every login. Ten one-time backup codes keep you in if you lose your phone.

Anti-phishing code

Pick a word that appears in every email we send. If a message claims to be from Keylo without it, delete it.

New device alerts

We email you when someone logs in from a browser we haven't seen before, and whenever your password changes.

Sessions you control

See every device that's logged in, when it was last active and where from, and sign any of them out.

Auto-lock

Your unlocked wallet lives only in the tab's memory and locks itself after the idle time you choose.

Slow, limited login attempts

Repeated wrong passwords lock the account for a while, and attempts are rate limited by address and network.

Catching mistakes before you sign

Addresses checked per network

Each address is validated with the rules of the network you're sending on, including checksums, so a typo or the wrong chain's address is caught before you sign.

Simulated before you sign

On EVM networks Keylo simulates the transaction first and stops if it would fail, so you don't pay a fee for nothing.

Exact token approvals

When a swap needs to spend a token, Keylo approves only the amount you're swapping, never an unlimited allowance.

Clear summaries

Every send and swap shows the recipient, amount, network fee and anything the network requires, like an XRP destination tag or a Cosmos memo.

How the service is hardened

  • A strict Content Security Policy with per-request nonces on every page that handles keys, so injected scripts can't run.
  • All blockchain requests go through Keylo's servers, so RPC providers never see your IP address, and API keys stay off your device.
  • HTTPS only, with HSTS, clickjacking protection and no third-party scripts or trackers inside the wallet.
  • Session cookies are HttpOnly, Secure and SameSite, and every state-changing request checks where it came from.
  • Secrets such as SMTP passwords and paid RPC keys are encrypted at rest with AES-256-GCM.
  • Every admin action is written to an audit log.

Found a security issue?

Report it through support and choose “Security concern”. We reply to every report, and we ask that you give us time to fix the issue before sharing it publicly.

Report an issue

Keylo staff will never ask for your password, recovery phrase or backup codes, by email, chat or phone.