Passkey wallets typically derive the vault as a PDA from the passkey, for example <code>seeds = ["passkey", sha256(pubkey)]</code> under the wallet program. Seeds and program code are public, so the mapping is too. Anyone who sees your passkey's public key, from a single transaction, a backend log, or a shared signature, can run <code>findProgramAddressSync</code> and get your vault address. From there they can read your balances and full history.

Vault PDAs are derived from public seeds, so anyone with the key can compute the address.

Your public key gives away your vault address

A passkey never signs your Solana transaction directly. It signs <code>authenticatorData || SHA-256(clientDataJSON)</code>, where <code>clientDataJSON</code> is built by the browser: <code>{"type":"webauthn.get","challenge":"…","origin":"https://wallet.example"}</code> To prove that the challenge equals the transaction hash, a program has to receive the full <code>clientDataJSON</code> in instruction data and parse it. That publishes the exact origin, subdomain included, next to your public key. It also costs 100–200 bytes of a transaction that is capped at 1232 bytes.

Verifying the challenge on-chain means publishing the origin you signed on.

clientDataJSON puts the website on-chain

A passkey cannot be a native Solana signer, because Solana signatures are <code>ed25519</code> and passkeys are <code>P-256</code>. Instead, each transaction carries a <code>Secp256r1SigVerify1111111111111111111111111</code> precompile instruction. Its data holds the compressed public key, the signature, and the signed message, all in plaintext. The precompile's program id is in the transaction's account list, so an indexer can list every transaction that uses it and group them by the 33-byte key inside. Every vault, program, or app verified by the same passkey falls into one group, even if each vault has a different address.

The secp256r1 instruction publishes the same 33-byte public key every time you sign.