Login with 2FA
A password and an authenticator code at every login, and repeated failures lock the account for a while.
Security
Locked by default.
Locked by default.
Opened by you.
Vault keys are encrypted on your device, and every send asks for your password. Keep scrolling for exactly what leaves your device, including the recovery copy.
Drag to turn · scroll to open
Key encryption
Keys are encrypted on your device
When you create or import a vault, the recovery phrase and private keys are handled locally and encrypted with a key derived from your vault password. Only the encrypted copy is written to storage.
- AES-256-GCM encryption at rest
- Password stretched with scrypt, a memory-hard key derivation function
- Decrypted keys held in memory only while the vault is unlocked
- Keys and phrases are never sent in readable form or included in logs
What leaves your device
For a self-custody vault:
- Public addresses, so balances can be read from the chain
- Signed transactions, after you approve them
- An encrypted recovery copy, unless you untick recovery
What never does
- Your recovery phrase or keys in readable form
- Your vault password
Recovery by support
On by default, and it matters
Unless you untick it, your device uploads a copy of your vault secret, encrypted so that only Aurix's offline recovery key can open it. That is what lets support help if you lose your phrase, and it means your vault is not yours alone while recovery is on.
- You ask for recovery with your login and a fresh 2FA code, and the owner approves it
- Your device can then restore the vault after a 24 hour wait, which you can cancel
- The Aurix owner holds the key that opens these copies, and can read your recovery words in the admin panel to tell them to you
- Turn recovery off when you create the vault or later in the app, and the encrypted copy is deleted. Only your phrase can restore it then
Access
Four layers between a stranger and your assets
Vault password
A separate password of at least 10 characters, typed again for every send from the vault.
Withdrawal rules
Account withdrawals go only to addresses you have added, with a fresh 2FA code, limits and staff approval above a set amount.
Auto-lock
The vault locks itself after 1 to 30 minutes of inactivity, your choice, and whenever the app closes.
Account
Rules on Account withdrawals
The custodial Account adds its own checks before money leaves it.
- Only to addresses you have added with a 2FA code
- Limits per withdrawal and per day
- Staff approval above a set amount
- An emergency switch that pauses all withdrawals
Withdrawals
Extra checks on the way out
Most mistakes happen in a hurry, so the checks sit where they help most: where money leaves your Account.
Confirmations
Nothing is signed silently
Every send shows what it does before you approve it, in plain words.
What moves, and where
The asset, the amount, the destination address and the network.
What it costs
The network fee is shown before you type your password. If it rises by more than 25 % it asks you to review it again.
Whether the address fits
The address format is checked against the network you picked, so a send to a mismatched address is blocked.
Aurix staff will never ask for your recovery phrase, private keys, password or 2FA code, by email or in a support chat. Anyone who does is not us.
Test networks
Practise with nothing at stake
This version runs only on test networks. Try a transfer, a swap or a vault send using test coins that have no value.
- Sepolia, Base Sepolia, Arbitrum Sepolia, Solana devnet, BNB testnet, Tron Nile and Bitcoin signet
- A TESTNET badge in the app shows which network mode you are in
Responsible disclosure
Found something? We would rather hear it from you than read about it later. Tell the person who invited you to test.
Please do not test against accounts you do not own.
Security you can check yourself
Install Aurix and watch exactly what it asks for, using test coins that have no value.