OpenWallet ID

The sign-in that protects your wallet. It exists only to make recovery possible, and signing in moves no money.

How you sign in

• Email (a 6-digit code that works for 10 minutes) or Google, and
• an authenticator app (a 6-digit code that changes every 30 seconds), which everyone uses.

A recovery therefore needs two independent things at least: your email and your authenticator app, or your Google account, your email and your authenticator app. Taking over one account is never enough.

Choose an authenticator app that is not backed up to the same Google account you sign in with. Google Authenticator's cloud sync would put the code back inside Google.

Codes are typed only in the extension

OpenWallet never asks for codes on a website. Type email and authenticator codes only inside the extension.

• Email and authenticator codes go from the extension straight to OpenWallet ID. No web page asks for them.
• Google sign-in opens in the browser's own sign-in window. Where that is not available, a page on wallet.opensync.network handles the Google step. It has no code boxes of any kind, and it checks with the extension that your own browser opened it; if not, it says "Do not continue".
• This site never asks for your wallet password, recovery code or recovery kit.

Changing how you sign in

Changing your email, your authenticator app or your Google account needs all your current sign-in steps, and any recovery in the following 72 hours waits the full 72 hours from the change. Your old and new email addresses are both told.

What it emails you

Only security notices, from security@opensync.network: codes, a recovery started (with a pause link), reminders, a recovery paused or stopped, the wallet released to a new device, sign-in changed, and a new Recovery Kit. No email contains a link that approves anything, and every one ends with the reminder that OpenWallet never asks for your codes, your recovery code or your Recovery Kit on a website, by email or by message.

What it holds

Your email address, your authenticator secret (encrypted), your devices' public keys, and one of your wallet's three parts, encrypted. It never holds your 24 words, your password, your recovery code or a key that can sign. See the security model.