Security & custody
How wallet keys are generated, encrypted and exported.
TokenBundle is fully non-custodial: it does not receive, store, or have access to your private keys or seed phrase. Keys remain on your device. Transactions are signed locally, and only signed transactions are submitted for execution.
Your keys remain under your control
| Wallet or key | Stored by TokenBundle? | How |
|---|---|---|
| Workspace wallets (all networks) | No | Keys remain on your device; transactions are signed locally |
| Custom Bundle wallets | No | Keys remain on your device; only signed transactions are submitted |
| Service wallets (fee tiers) | Not user keys | TokenBundle's own fee-receiving wallets; no access to your wallet keys |
| Deployer / Master keys pasted into Custom Bundle | No | Remain on your device; Fund / Execute submits only signed transactions |
| Deployer key pasted into Deploy Token or Manage Token | No | Remain on your device; transactions are signed locally |
| One-time deposit addresses (Disperse) | No | Keys remain on your device; distribution transactions are signed locally |
Exporting a wallet
Every workspace wallet can be exported. On the Wallets page, click the key icon, confirm, and copy the key. It hides itself after 15 seconds. EVM wallets are plain EOAs and import into MetaMask with the same address. Solana keys are base58 and import into Phantom or Solflare.
Good practice
- Reveal keys only on a private screen. Anyone who sees a key can spend its funds.
- Withdraw or collect before deleting a wallet. TokenBundle does not store its private key; keep your own backup before removing the wallet. A wallet still holding native balance can't be deleted.
- Keep launch wallets for launches. Move profits to a wallet you control yourself.
- Only use official explorers: Solscan, Etherscan, and
robinhoodchain.blockscout.com.
TokenBundle will never ask for your personal wallet's seed phrase
Deployer and Master keys used in Custom Bundle and Deploy Token remain on your device and are never sent to or stored by TokenBundle. Anyone asking for a seed phrase in TokenBundle's name is running a scam.