Secret passkeys · Solana · Privacy
Secret passkeys on Solana are a P-256 key in your secure enclave.
A developer's field guide to secret passkey wallets on Solana. The private key never leaves your device, but your public key, your domain and your device type can end up on-chain. Hover the redaction to see what.
01
Introduction
What a secret passkey is, what the browser sends, and which defaults leak identity.
02
LiveSecret passkeys & Solana
Sign with your secret passkey and watch it become a secp256r1 precompile instruction, byte by byte.
03
Privacy leaks
15 ways a secret passkey wallet leaks on Solana: on-chain, to RPCs and relayers, and by design.
04
NewKeygen
Generate a Solana keypair or grind a vanity address. Runs entirely in your browser.
Highest-impact leaks
all 15 →One secret passkey links every transaction
The secp256r1 instruction publishes the same 33-byte public key every time you sign.
Your public key gives away your vault address
Vault PDAs are derived from public seeds, so anyone with the key can compute the address.
clientDataJSON puts the website on-chain
Verifying the challenge on-chain means publishing the origin you signed on.
Your token holdings are one RPC call away
Associated token accounts are derived from the vault address and are public.