Security  How Keon protects you

Read every request before it reaches your money.

A wallet's job is to say no at the right moment. Here is what Keon checks, when it checks it, and what it never does.

1.0

Your keys

2.0

Before you sign

3.0

Apps you connect

4.0

What Keon never does

1.0  Your keys

Only on your device.

Encrypted with your password

Your recovery phrase is encrypted on the device that created it. Without your password it is unreadable, including to us.

Locks itself

Keon locks after a few minutes away, and on Android unlocks with your fingerprint or face.

Sync that cannot read your wallet

Sync is safely encrypted on your device before anything is uploaded. Only the encrypted copy travels, and our server cannot read it.

2.0  Before you sign

Every request is run first.

Keon sends the transaction to Starknet as a simulation, reads what would happen, and shows it in plain words.

Balances
What leaves your wallet and what arrives, in tokens and dollars.
Approvals
Any app getting the right to spend your tokens, and whether that right is unlimited.
Failures
Transactions that would fail are stopped before you pay a fee for them.
Fee
The fee you will actually pay, not the inflated maximum.
Messages
Signature requests shown as readable fields, not raw data.
Keon flags a transaction from a site on a scam list: the simulation shows the call will fail, and Approve becomes Approve anyway in red
Fig 2.0 A request from a site on a scam list. The simulation shows it would fail, and Approve turns red.

3.0  Apps you connect

Apps get only what you allow.

Connecting shows your address. Everything else is a permission you choose, per app, and can take back.

3.1

Permissions per app

Sending transactions, signing messages, switching networks and adding tokens are each allowed or refused when the app connects.

3.2

Session keys with limits

Let a game or trading app approve its own small actions for a few minutes up to a day, only on contracts you pick and up to a spending cap.

3.3

One place to revoke

See every connected app and session in Settings, and disconnect any of them in one tap.

4.0  What Keon never does

Some things are off the table.

  • 01Ask for your recovery phrase, anywhere, for any reason.
  • 02Sign for you in the background. Every signature is one you approved, or one a session you set up allows.
  • 03Hold your funds. Staking and lending go straight from your account to the protocol.
  • 04Send error reports unless you turn them on.

Found a security issue?

Write to us privately before sharing it, so we can fix it first.

Report a vulnerability