Verify xmrwallet

Read the source

The whole wallet lives at github.com/vinamega/xmrwallet-core under the MIT license. It is a standard Node.js app with a PostgreSQL database, no exotic dependencies, and a small enough surface to read in an afternoon. The parts that matter:

• server/src/wallets/seedstore.ts, seeds are sealed with AES-256-GCM under a per-wallet data key, which is itself wrapped by a master key that only ever lives in the server environment
• server/src/api/app.ts, every route, the rate limits, and the security headers
• web/, the entire frontend, vanilla JavaScript with zero third-party scripts

Check what the hosted instance actually serves

You can verify some properties without running anything:

• Content-Security-Policy, inspect the headers on any page: script-src 'self' https://js.hcaptcha.com. The only third-party script allowed is the invisible CAPTCHA on wallet creation, everything else is first-party
• No trackers, no analytics, no ads, no fonts or scripts loaded from anywhere else. Check the network tab once
• HTTPS only, plain HTTP redirects to HTTPS
• Seed exposure, the seed phrase appears exactly once, in the response to wallet creation or import. No API endpoint returns it afterwards

Run your own instance

The strongest verification is self-hosting. Quick start:

1. A machine with Node.js 20 or newer and PostgreSQL
2. A Monero node to point at (your own, or any remote node you trust)
3. git clone https://github.com/vinamega/xmrwallet-core
4. cp server/.env.example server/.env and fill in your database URL, a fresh master key, and your node address
5. npm install && npm run build then node server/dist/server/src/index.js

Full details in the README, including systemd unit examples and monitoring scripts that ship in the repo.

The honest trust model

A hosted wallet is semi-custodial: the server holds your encrypted seed and does the signing. Open source does not remove that, it makes it inspectable. You can read exactly what the server does with your seed, you can run the same code yourself, and you can walk away with your 25 words at any time. That is the trade this project makes, stated plainly.