Security
Security you can inspect.
Layer by layer: how releases are verified, how account material stays local, and what your operating system contributes.
Overview
Security you can inspect.
This page describes how the desktop wallet's security works in practice, and where responsibility sits with you.
The wallet combines release verification, local key handling, transaction review and operating-system safeguards. Each layer has a clear role in protecting your accounts and helping you verify every action.
Threat model
Threats covered
- A tampered or incomplete installer obtained from somewhere other than a verified release.
- Phishing that imitates a wallet interface or support channel and asks for recovery material.
- A mistaken transaction: wrong destination, wrong amount, or an unexpected fee.
- Compromise of the computer itself through malware or an unattended, unlocked session.
- Loss of the only copy of recovery material, which is unrecoverable by design.
Two different things
Application security and network security
MultiversX network security comes from its consensus and validator set — that is a property of the network, not of any wallet. Application security is about the software on your machine: how it is distributed, how it handles account material and how clearly it presents what you are about to sign.
Keeping the two separate matters. A secure network cannot protect you from approving a transaction you did not intend, and a careful wallet cannot change how the network reaches consensus.
Key handling
Local by design
Account material stays on the computer where you installed the wallet. That is the defining property of a self-custody desktop wallet: no third party holds your keys, and no third party can restore access for you.
Storage and encryption details follow the installed wallet version and its security documentation, giving you a clear reference for protecting account data.
Transaction review
Read before you sign
Signing is the moment a decision becomes irreversible. Check the destination address in full rather than the first and last few characters, confirm the amount, and note the fee. If anything looks unfamiliar, cancel — a transaction you did not send costs nothing.
Release integrity
One source for release data
Every version number, file name, size, checksum and signature comes from a single release configuration. This keeps download and verification details consistent across the website.
Verification
Check the file you downloaded
Calculate the SHA-256 checksum of your download and compare it with the release value. Validate the accompanying signature as well. The verification page lists the exact command for Windows, macOS and Linux.
Operating system
Your machine is part of the wallet
- Keep the operating system and its security updates current.
- Use full-disk encryption and a strong account password.
- Lock the screen whenever you step away.
- Avoid installing wallet software on a shared or administratively managed machine you do not control.
Recovery
Backups decide whether a bad day is recoverable
Whatever recovery material the wallet presents during setup is the only thing that restores access if the machine is lost. Write it down offline, store it somewhere physically safe, and never type it into a website, a chat window or a support form.
Follow the recovery flow shown by your installed wallet version and keep every backup offline, private and accessible only to you.
Reporting
Reporting a security issue
Send security concerns to support@multiversxwallet.com with the affected version, operating system and a clear description. Never include a recovery phrase, private key or other account secret.
Security FAQ