Account

Wallet-based account setup requests one wallet signature and saves local access by default. Returning to this browser opens the encrypted account independently of MetaMask, its selected network, or the public RPC. Disconnecting the transaction wallet keeps the account open. Hiding balances is only a display preference. When no account is open, overview shows $0.00; an open account retains cached values during network delays and labels missing valuations explicitly.

Your account file is encrypted on your device, in downloaded backups and in Google Drive. Wallet-based accounts use AES-GCM encryption with a key derived locally from your original wallet's SEAL unlock signature. There is no separate account-file password. Google receives encrypted account data, without your unlock signature or access to the decryption key; Google sign-in alone cannot decrypt a backup.

On a new device, sign the SEAL unlock message with the original compatible wallet to derive the same decryption key, then restore your backup. A browser with remembered access already has the derived key and can open or import the encrypted account without another signature. You do not need to copy or upload the signature yourself. Treat it as a secret.

Only a matching wallet on the selected network can submit wallet transactions. A different connected wallet does not replace the selected private account: choose Open this wallet’s account explicitly. Relayed private actions can use an open account without a transaction wallet. Proof validation and chain reconciliation still gate spending.

One tab owns each account's write lock. Open in this tab requests a handoff; the other tab releases ownership only when it is not saving or submitting. Background network scans are cancelled safely during handoff. No signature is requested to resolve a tab conflict. Forget device access is the separate action that revokes saved credentials. See Account recovery for the browser trust and recovery boundaries.

Without a wallet

For local storage, choose Create account → Use a passkey. The account uses random keys and an intent service for supported financial actions. Each reopening requires WebAuthn user verification and PRF; the app never saves a reusable unwrapped device key for this mode. Encrypted file exports include all saved networks and the wrapped account encryption key. Import uses the original passkey or the independently generated recovery key. There is no SEAL account backup server for this mode. See local passkey recovery.

Choose Create account → Use Google Drive backup on a deployment with a private intent service. Create a named account with a recovery password, then share its SEAL payment address after backup succeeds. No MetaMask or Ethereum signature is used. A sender deposits with their own wallet and gas, then sends you a private transfer. Claims, sends, combines, reclaims and withdrawals use the Rust intent service; fees come from the received or existing assets. Connect an EVM wallet for direct or permit deposits into this same account. Swaps and margin use the intent service when configured on the selected deployment. Terminal vault-share exits are not offered for independent accounts.

Use the account menu to create or restore another separate Google-backed identity, or choose Connect wallet to attach a funding wallet without changing the private identity. Accounts on the same Google Drive keep separate immutable backups. Recovery can use Google plus the recovery password or a previously linked wallet, or a self-contained password backup without Google.

To link MetaMask later, use Settings → Linked recovery wallets → Link a wallet and sign its recovery message. Linking preserves the same SEAL address, keys and balances, and does not replace a separate SEAL account already associated with that wallet. Choose Use linked wallet when restoring the Google-backed account. Transactions still use the intent service. See Google-backed accounts.

Balances and prices

Overview displays supported token balances and their estimated USD value. Net APY is weighted by asset value and includes the configured lending fee. Custody assets contribute no lending yield. The asset guide lists the chain-specific configuration. New pools launch with zero protocol fees. Net APY uses the live yield fee; see Fees for scheduled changes and hard caps.

An unlocked account may initially display its encrypted cached balance while synchronization runs. Cached values cannot authorize spending. Proof inputs come from reconciled notes and canonical events. Missing recovery data produces a warning rather than an empty balance.

Market prices use DefiLlama with CoinGecko fallback. Missing prices do not become zero-valued balances; token quantities remain visible. Requests use fixed asset identifiers without wallet balances or private transaction data. Historical USD charts are estimates, not accounting records.

The public Pool page shows SEAL's backing across registered assets, including pending payments and guardian shares. It does not show the size of the upstream Aave market.

Transactions

Review the asset, amount, destination, output minimums, submission method and fees before generating a proof. The proof authorizes that wallet or intent service and the agreed fees. The final button submits those fixed terms; changing the method or fees cancels the unsubmitted proof and requires a new one. Proof generation occurs locally. A completed proof does not mean a transaction was sent or confirmed.

Swaps request live Uniswap V3 quotes automatically after one second without edits, in both sandbox and account mode. The form starts at zero and shows loading placeholders while a quote is pending. Quotes expire after two minutes; refresh an expired quote before confirming. Changing the pair, amount, slippage or submission method invalidates the previous quote and requests a new one. Estimated price impact measures the trade’s effect on pool prices, excluding DEX fees. Maximum slippage is a separate limit, selectable with presets or a custom percentage; the displayed minimum received is bound into the live transaction. An unavailable or expired market quote cannot authorize a live swap.

The sandbox waits at most eight seconds for market quotes. If none is available, it displays a Demo estimate using fixed example prices, configured DEX fees and an assumed 0.5% price impact. The selected maximum slippage still determines the minimum received. Sandbox execution credits the reviewed output to demo balances and submits no transaction.

Each proof consumes at most eight notes. Combine, Separate and Custom grouping determine input selection. Multiple transactions confirm independently. An interrupted submission can be reconciled or retried using its saved transaction or intent service record; check status before creating a replacement.

Benchmarks and recovery

The browser benchmark generates and verifies proofs over synthetic notes without submitting transactions. It reports worker count and elapsed time; results depend on the device and cache. Sandbox balances and yield are illustrative and cannot be withdrawn.

Keep a current encrypted backup and verify restore on another device. Remembered browser access is not a backup. See Account recovery for wallet-signature requirements, archive availability and direct exits.

In Settings → Advanced → Account state, export a seal-account-….json file or import one into the same unlocked private identity. The file contains encrypted keys, note openings, history, contacts and recovery/submission records. Import merges records and then reconciles them with the chain; it cannot restore spent funds. A seal-tx-….json payment receipt is separate and does not back up the account.

Saved access and reset boundary

The app rejects unsupported account files and checksum-free recipient addresses. A missing or corrupt backup must never silently become a new empty account. Wallet attachment, private-account access and display privacy remain independent: disconnecting a wallet does not delete an account, and hiding a balance does not revoke its key. Forgetting device access explicitly revokes saved access across tabs while preserving encrypted account data.

Password-protected portable export

Google-created accounts use a self-contained password backup for Export account state. Passkey accounts also offer Export with password, alongside their existing passkey/recovery-key file. Choose Import account backup on the overview to restore on a fresh device without Google or WebAuthn. Import preserves the private identity and validates all saved networks before applying history; spending still requires chain reconciliation.

The versioned seal-password-account envelope encrypts the multichain bundle and its vault key using AES-256-GCM, a random 96-bit IV and a password-derived key. It uses the browser's WebCrypto PBKDF2-SHA256 implementation with a fixed 600,000 iterations and a random 32-byte salt, domain-separated from Google recovery passwords. The fixed format/KDF profile is authenticated; unsupported parameters and oversized files are rejected before decryption. Passwords are encoded as UTF-8 without trimming or normalization and are never persisted or uploaded. This implementation reuses the existing Google password recovery work factor; memory-hard Argon2id remains a possible future format, not a claim about this one.

A restored Google-created account starts with local-only storage and remembered browser access. An import into an already open account preserves its backup preference. Passkey accounts keep their passkey unlock requirement: if the original credential is unavailable, enroll a replacement from the account menu, or import the password file again after closing. Password import does not silently save a reusable passkey unlock key.

Google Drive backup is optional. Use local-only storage stops automatic uploads while retaining the same account, address and actions. Existing Drive files are preserved. An expired or failed Google upload does not silently opt out: while backup is enabled, submission waits for recovery data to be saved. Browser storage is not a separate recovery copy; download current backups before clearing site data or moving devices.

Anyone with the file can guess its password offline. Use a long, unique password, store it separately, and keep the latest snapshot. Changing a local passkey or deleting a file cannot revoke existing copies. Google sees file metadata, including account labels, but receives neither the password nor plaintext keys, balances or transfers.