Guide
Keep your TRAI safe
Protect your recovery phrase and password, recognize fake wallets and requests, and use the safety features of the Tenrai wallets.
On this page
Your recovery phrase
- Keep the words on paper, out of reach of fire, water and other people. A second copy in another place protects against loss.
- Do not store them as a photo, an email, a cloud note or a password-manager entry that syncs to many devices.
- Add a recovery passphrase if someone could find your written words.
Your device
The Tenrai Wallet keeps the wallet encrypted on the device and offers:
| Feature | What it does |
|---|---|
| Password | Opens the wallet; asked before coins move unless you change that |
| Lock | Removes the keys from memory after 15 minutes without input, or up to 12 hours as set under Settings, Security |
| Fingerprint | Opens the wallet and approves payments with the fingerprint, face or PIN of the device. Needs HTTPS and a device whose passkeys support the PRF extension |
| Several wallets | Each wallet has its own password, lock time and settings |
The command-line wallet asks for the password whenever it opens the wallet file. Scripts and the wallet daemon read it with --password-file; only the account that runs them should be able to read that file.
Fake sites and requests
- Open a wallet only from an address you trust and check it in the address bar. The Tenrai Wallet runs at
wallet.tenrai-technologies.org. - Before a large payment, compare the six verification words of the recipient's address with the recipient, on another channel.
- A payment request can only carry an address, an amount and a short message. The Tenrai wallets refuse a request with anything else in it, so a QR code cannot slip in hidden text.
- The Tenrai wallets show payloads of received payments only as text or hexadecimal. They never open, run or link them. Messenger messages appear only in the messenger, as text.
- Every payload and the first message of a chat are public. Messenger messages after the first are end-to-end encrypted.
The service your wallet talks to
A wallet reads the chain through a service: a public Tenrai API or a node you choose. Every answer is signed. On first contact the wallet pins the service's signing key and from then on accepts only answers signed with it. If the key changes, the wallet stops until you forget the pinned key yourself; do that only when the service's operator confirms the change. Compare a newly pinned key with the one the operator publishes.
The service never sees your words, keys or password. It does see which addresses you ask about. For full privacy, connect the wallet to your own node: Network in the Tenrai Wallet, --service node on the command line.
Large amounts
- Keep long-term savings in a wallet created offline, such as with the paper wallet, and spend from a separate everyday wallet.
- Teams can use 2-of-3 or 3-of-5 multisig addresses, so no single key can move the funds. On the command line,
tenrai-wallet multisig-createstarts one; in the Tenrai Wallet, switch on Settings, General, Multisig.