Tor-only networking
An embedded Tor client carries every request. If the circuit is not ready, the app stops. It does not quietly fall back to your carrier or home IP.
Threat modelA Tor-native wallet for Android
Private money.
By default.
Every RPC, price lookup and update check is routed through the Tor network. Your keys stay sealed on your phone. No account, no cloud backup, no direct connection.
Fail-closedNo clearnet fallback
9:41TORProtected
Total balance
$1,238.63Updated through Tor · just now
SendReceiveSwap
₮USDTBNB Chain1,235.05$1,233.49
ΞETHEthereum0.000576$1.33
AAVAXAvalanche0.0056$0.05
Keys on deviceKeystore · AES-256-GCM
Powered by Tor
Keys never leave the device
DNS resolves inside Tor
Independent, community-funded
Why Tor Wallet
Privacy is not a feature. It is the architecture.
Most wallets ask you to trust a server, an analytics SDK and a cloud backup. Tor Wallet removes all three from the path that matters.
Your keys, your phone
The recovery phrase is sealed with the Android Keystore and AES-256-GCM, then revealed only after your master password. No server-side key exists.
Backup guideNo account, no profile
No email, no phone number, no sign-up. The control plane sees a random install ID, app version and device model — never your keys or addresses.
Privacy policyFail closed
There is no direct route.
Tor Wallet opens one door: SOCKS5 to the embedded Tor client. Hosts are checked against an allowlist. DNS is resolved remotely. When Tor is unavailable, the request fails instead of leaking.
- No clearnet fallback. A dropped circuit is an error, not a downgrade.
- DNS inside Tor. Your carrier never sees the RPC or price hostnames.
- Host allowlist. Only the RPC, price and update endpoints the app needs.
- Honest state. The header says Protected, Connecting or Offline — never a fake green dot.
net/TorHttp.kt
// fail-closed by design
suspend fun request(host: String, path: String) {
if (phase != READY) throw TorUnavailable()
route = SOCKS5(127.0.0.1:9050, dns = remote)
require(host in allowlist) { "blocked" }
// no direct socket. no fallback.
}
suspend fun request(host: String, path: String) {
if (phase != READY) throw TorUnavailable()
route = SOCKS5(127.0.0.1:9050, dns = remote)
require(host in allowlist) { "blocked" }
// no direct socket. no fallback.
}
Getting started
Three minutes to a private wallet.
No forms to fill. No identity to verify. The app creates the wallet locally and never sends the secret anywhere.
Create on the device
Generate a BIP39 wallet locally. Set a master password that unlocks the encrypted vault on this phone.
Write down the phrase
Back up 12 or 24 words on paper. The app can show them after your password — never through an email or cloud service.
Send through Tor
Pick a network, paste an address, review the quote and sign locally. The signed transaction leaves through the Tor circuit.
The route
One route. No shortcuts.
Your device joins a Tor circuit before it talks to a blockchain RPC. The RPC sees a Tor exit, not your home connection.
If the circuit drops, requests fail closed. The app never opens a direct socket to a node, price API or update server.
- Your phoneKeys stay here
- GuardEncrypted hop
- MiddleEncrypted hop
- ExitTor exit node
- BlockchainRPC endpoint
Latest signed release
Take the quiet route.
Direct APK for Android 8.0 and newer. No Play Store account, no sign-up, no bundled analytics. Verify the SHA-256 before you install.
Android may ask you to allow installs from this browser. That is normal for direct distribution.
Fund independence
No ads. No data deals. Just people.
Tor Wallet is funded by the people who use it. Donations pay for servers, security work and releases. Crypto only, straight on-chain.
Bitcoin
BTC · Native SegWit
bc1qd5azl99c44rgetewqupmutvvxftz2grjnuve06
Ethereum & EVM
ETH · BNB · USDT · ERC-20 / BEP-20
0xdaafed5a61d8c9e1a050b0fd75f8dd8f33c3bb17
TRON
TRX · USDT TRC-20
TXW4MKJGaggY3iNP5TtdeKnuzSmX1FZwiv
We will never DM you a donation address. Always verify it on this page before sending. Crypto transfers are final.
Questions
The short answers.
Is Tor Wallet affiliated with the Tor Project?
No. Tor Wallet is an independent project built on the open Tor network. The Tor Project does not operate, endorse or review this wallet. Tor® is a registered trademark of the Tor Project, Inc.
Does the server ever see my keys or recovery phrase?
No. The wallet is generated on your phone and sealed with the Android Keystore. The control plane receives a random install ID, app version, device model, OS version and locale for update delivery. It never receives keys, addresses, balances or transaction history.
What happens when Tor is blocked?
The app fails closed. RPC, price and update requests return an error instead of using a direct connection. You can retry when the circuit is available.
Which networks are supported?
BNB Smart Chain, Ethereum, TRON and Avalanche, with token support for USDT and the native assets. More EVM networks can be added without changing the key model.
How do I verify the APK?
Download the APK and the published SHA-256, then run sha256sum TorWallet-0.2.0.apk. Compare the output with the value on the download page. Do not install builds from mirrors or file-sharing sites.
Your keys. Your route. Your silence.
Download the signed Android build, or read the threat model before you trust any wallet with your money.