Non-custodial by construction
The project cannot move user funds because it never has the keys. The control plane serves metadata and an APK, nothing else.
The project
Built around one rule.
The server never gets the keys. Everything else follows from that: local signing, local encryption, a control plane that can only serve updates, and networking that fails closed instead of leaking.
Privacy is not a privilege. It is a right. That sentence is the product brief: no account, no email, no analytics, no cloud backup, no clearnet fallback.
Tor Wallet is independent and community-funded. It is not a token project, an exchange or a custody service. There is no company account holding your money, because there is no account. Read the sustainability model.
manifesto
// what we optimize for
01 Keys on the device.
02 No clearnet fallback.
03 No account, no profile.
04 No ads, no data deals.
05 Releases you can verify.
// everything else is detail
01 Keys on the device.
02 No clearnet fallback.
03 No account, no profile.
04 No ads, no data deals.
05 Releases you can verify.
// everything else is detail
Funded by users
No ads, no data sales, no token. Donations keep the infrastructure independent and the app free.
Small surface
A small Android app, a small control plane and an allowlist. Fewer moving parts means fewer places to leak.
Independence matters. Tor Wallet is not affiliated with the Tor Project, any exchange or any wallet vendor. Tor® is a registered trademark of the Tor Project, Inc.