How to Create a Solidus Wallet, and What Happens Underneath

Creating one takes about a minute. Understanding what it did takes slightly longer, and this guide covers both, because the second part changes how you should treat the first.

The three steps

One, the phrase is generated and shown. Twelve words, drawn from the standard English wordlist, from 128 bits of entropy taken from your browser's cryptographic random source. It is generated on your device and never sent anywhere.

A second generator in the same codebase produces a twenty-four-word phrase at 256 bits. Twelve is what the shipped flow uses, not a limit of the library, and 128 bits is the standard's own baseline rather than a shortcut.

Two, three of the twelve are checked back. The confirmation screen mixes the three it asks for with six decoy words drawn from the same wordlist, so recognising the shape of a word is not enough.

Three, an identifier is created. Your device signs a chain transaction with the identity key derived from your phrase, and the result is your identifier.

The part most guides leave out

Your keys are never written to disk.

They exist in an in-memory reference for the life of the browser tab. Not local storage, not session storage, not a cookie. Reload the page and the keys are gone, the wallet reports itself locked, and you enter your phrase again to unlock it.

Two consequences, and both are real.

There is no encrypted vault to steal, which is a stronger position than the usual arrangement where a passphrase-encrypted keystore sits on disk waiting for somebody to attack it offline.

And you will re-enter twelve words more often than you expect. Every reload, every crash, every new tab. That is a genuine usability cost and it is the direct price of the property above. Nobody should discover it after storing something they care about.

What the server does, and what it cannot do

It relays. Your device signs the transaction; the backend forwards it to the chain.

It also pays. Fresh accounts have no balance, so a sponsor account funds them enough to transact. That account is value-only, has no identifier of its own, and its key is used for nothing except sponsoring. The code says in its own comment that it is never a user's key, and there is no path by which it could be.

So the honest description is: non-custodial in the strict sense. The server cannot move your funds, cannot sign as you, and cannot recover your wallet if you lose your phrase.

What to do with the phrase

Write it down on paper, once, before you leave the screen. Do not photograph it, do not put it in a password manager you also unlock on the same device, and do not type it into anything that is not this wallet.

Then set up recovery, because a phrase on paper is a single point of failure and paper burns. Guardian-based recovery exists precisely so the phrase is not the only route back in, and testing that setup matters more than configuring it.

What you are creating a wallet on