Pearl Safe

What actually protects your money.

In plain language first, then in detail. Including what is not finished.

Two of three.

Your phone generates one secret and splits it into three parts.

  • Phone. In secure hardware, released by your face or fingerprint.
  • Passkey. In your iCloud Keychain or Google Password Manager.
  • Recovery. With Turnkey, for the day you lose the phone.

Two parts sign. One part is noise. At rest the app is watch-only.

Your key, in three parts Three holders — your phone, your passkey, and the recovery service. A line connects each possible pair, and any one of those pairs is enough to sign a payment. No holder can sign alone. Phone Passkey Recovery any two can sign

If something goes wrong.

Recovery

Confirm by email, then at least 48 hours. We alert every device and address we have, and any alert cancels it.

Phone confirmation is a second factor we have not switched on. Turnkey has not enabled SMS for us, so recovery is email-only today.

The phrase

Twelve words, exported whenever you like. No service, no waiting, works in the desktop wallet.

Lose both your email and your phrase and nobody can help you. The app says this at setup.

For people who want the details.

Keys and addresses

BIP-39 entropy generated on-device from the platform CSPRNG. Addresses are Taproot, derived per BIP-86, encoded bech32m — the same layout the official Pearl desktop wallet uses. On import the app scans both derivation conventions, because a small fraction of seeds resolve differently under each.

The split

Shamir 2-of-3 over GF(2⁸), applied to the BIP-39 entropy itself rather than a derived key, using Privy's audited implementation. We do not write our own.

  • S1, device. Wrapped by a Secure Enclave / StrongBox key with biometric-only access, dropped when enrolled biometrics change. The enclave wraps this share; it does not sign. It is P-256 and Pearl is secp256k1.
  • S2, passkey. AES-256-GCM under HKDF-SHA256 of the WebAuthn PRF output. The PRF output never leaves your device, so our copy of the ciphertext is inert to us.
  • S3, recovery. In a Turnkey sub-organisation created for your wallet, root quorum 3-of-3: your email, your phone, our time-lock key. Our parent organisation is not a member and cannot rewrite the quorum.

The time-lock is a vote

Our server does not stand in front of the custodian deciding what to forward. It holds one of three votes inside the quorum and withholds it until the wait has elapsed and nobody has cancelled. Measured against the live API, not assumed: our key alone returns CONSENSUS_NEEDED, and a parent-org rewrite is refused.

Your device checks this rather than trusting it. Before storing S3 it reads the quorum back and refuses unless the shape is exactly right.

What a hostile server cannot do

The fee you see is computed from the same prevouts the signature commits to, so an indexer that lies about your coins cannot inflate a fee behind a correct-looking screen. The app also says when it could not see all of a wallet, rather than showing a number that looks complete.

If the phone has no biometric

A device without Face ID or a fingerprint falls back to a passphrase, and the app labels that as the weaker setup on the screen where it happens. It never does this silently.

What is not done yet.

  • No independent audit. Required before mainnet. Until then we do not use the word "audited".
  • SMS is not switched on. Recovery is email-only today, which is one factor rather than two.
  • Mainnet is closed. Testnet coins are worth nothing, which is the point while the above is open.

A wallet cannot protect a phone that is already compromised, and nothing protects you from approving a payment under duress.

How to spot a fake.

The only official links

Website
pearlsafe.xyz. Nothing else.
Apps
The two store listings, once they exist. There is no app to download today.
App ID
money.flux.wallet
Passkey prompt
Says pearlsafe.xyz. Anything else, stop.
Email
Only from @pearlsafe.xyz

What a fake will try

  • We never ask for your 12 words. Nobody real ever will.
  • We never message you first. Support only replies.
  • No download link outside the two stores. An APK in a chat is not a beta.
  • An urgent "security migration" is always someone else's urgency.

When in doubt, close everything and type pearlsafe.xyz yourself. Never through a link someone sent you.

Found something? Tell us.

Write to security@pearlsafe.xyz. We reply within 72 hours, ask for 90 days before you publish, and credit you unless you would rather stay anonymous.

Please do not test against other people's wallets, degrade the service, or access data that is not yours.

No paid bounty, and we will not pretend otherwise.

Preferred languages: English, Dutch. This page is the canonical location of our security contact details.