Built to know as little about you as possible.
Carnet can’t touch your funds, doesn’t ask you to create an account and never talks to a server run by its publisher. Here’s what it does, what it doesn’t, and where its limits are.
Never type in your 24 words.
Your recovery phrase (12 or 24 words) gives full access to your funds. Carnet never asks for it, and only accepts public addresses and extended public keys (xpubs). If an app, a website or a person asks you for those words, someone is trying to rob you.
What leaves your device, and where it goes.
Three possible destinations. The first two get only what they strictly need. The third gets nothing: there is no Carnet server.
Your device
- The vaultAddresses, transactions, corrections, settings: one encrypted file.
- The interfaceNo network access.
- The core, in RustThe only part that connects, over HTTPS or through Tor.
-
the addresses of the wallet being synced, one circuit per wallet
Public blockchain servicesmempool.space, Blockscout, Koios… They see those addresses, and your IP address unless you use Tor.but not your IP address.
-
the list of cryptos that need a price
Price sourcesDefiLlama, ECB rates… Never your addresses, quantities or transaction dates.
-
nothing
Carnet’s publisherNo account, no telemetry, no crash reports.
Read-only, by design.
Carnet only knows public identifiers: the same ones you give out to receive crypto. With those, anyone can read a wallet’s history, but nobody can spend from it. Carnet signs no transactions and doesn’t connect to your Ledger.
For Bitcoin, Litecoin, Dogecoin, Bitcoin Cash and Zcash, addresses are derived from the xpub on your device: the xpub itself is never sent to any service.
No server, no account, no telemetry.
Carnet runs locally, and its publisher operates no server for it: there’s no account to create, no “cloud” sync, no analytics, no crash reports and no automatic updates. Nothing you do in Carnet is sent to its publisher.
An encrypted vault, on your device.
Everything Carnet knows about you (addresses, transactions, corrections, settings) lives in a single file, encrypted with your password:
- the key is derived from your password with Argon2id, which is deliberately heavy on computing time and memory to slow down attackers trying one password after another;
- the contents are encrypted and authenticated with XChaCha20-Poly1305, and the file size is rounded so it doesn’t give away exactly how much data you have;
- every save is atomic, and the previous version is kept next to the vault;
- the vault locks itself after 10 minutes of inactivity (adjustable from 1 to 240 minutes) and, on a computer, when you close the window. A sync in progress counts as activity: the vault locks once it has finished.
The password (12 characters minimum) isn’t stored anywhere and can’t be recovered. If you forget it, you’ll have to create a new vault: your wallets sync again from the blockchains, but your imports and manual corrections are lost. Exported backups stay encrypted.
Your Coinbase statements aren’t kept.
On import, Carnet takes the transactions out of the CSV files: dates, quantities, amounts in euros. Your name, IBAN, card numbers and email addresses are left out, and the file itself isn’t copied. Once the import is done, delete the files from your device or put them somewhere encrypted: they contain your personal details.
Discreet on screen.
On a computer, Carnet asks the system by default to keep its window out of screenshots and screen sharing (how well that works depends on the capture tool), and a single button hides every amount. The app accepts no extensions, no files dragged onto it and no developer tools.
Who Carnet contacts, and what they learn.
Carnet’s interface has no network access: its security policy (CSP) only lets it talk to the app’s core. Only that core, written in Rust, connects to the internet, and only over HTTPS (or to .onion addresses through Tor), with no cookies, no Referer header and a generic browser identifier. It only contacts public services, with no API key or account:
| Used for | Default services | What they see |
|---|---|---|
| Bitcoin | mempool.space (its .onion address with Tor), with blockstream.info as a fallback | The addresses of the wallet being synced, and your IP address unless you use Tor |
| Litecoin | litecoinspace.org | |
| Ethereum | Blockscout (eth.blockscout.com), with Routescan as a fallback, public nodes (Tenderly, dRPC, MEV Blocker, Blast, PublicNode) and PublicNode’s validator API | |
| Solana | The Solana Foundation’s public node (api.mainnet-beta.solana.com) | |
| Cardano | Koios (api.koios.rest) | |
| XRP Ledger | Ripple’s servers (s1, s2), honeycluster.io, xrplcluster.com | |
| Dogecoin | Blockbook (dogecoin.atomicwallet.io), Ledger’s explorer as a fallback (explorers.api.live.ledger.com) | |
| Bitcoin Cash | Haskoin (api.haskoin.com), Blockchain.com, Blockbook (bchblockexplorer.com) as a fallback | |
| Zcash | Zelcore’s Blockbook (blockbook.zec.zelcore.io), Ledger’s explorer as a fallback | |
| Arbitrum One, Avalanche, BNB Smart Chain, Cronos, HyperEVM | Routescan, 3xpl, Ledger’s explorers and Etherscan proxies (proxyetherscan.api.live.ledger.com…), each network’s public nodes (Arbitrum, Avalanche, BNB Chain, Cronos, Hyperliquid, dRPC, PublicNode, 1RPC) | |
| Prices | DefiLlama (coins.llama.fi), ECB rates via Frankfurter (with the ECB data portal as a fallback), Coinbase Exchange (public prices), Binance (public prices, as a fallback, never with Tor) | The list of cryptos that need a price. Never your addresses, quantities or transaction dates: price histories are requested on a fixed grid. |
The lists of recognised tokens and known Coinbase addresses are built into the app: nothing is downloaded on the fly. A transaction’s link to a block explorer only opens your browser after you confirm. In the advanced settings, you can replace each blockchain service with your own node.
Tor, with no silent leaks.
Without Tor, a provider can tie the addresses you look up to your IP address. On a computer, Carnet can go through Tor. It doesn’t bundle Tor: once the option is on in its settings, it uses Tor Browser (left open) or the tor service. With Tor, Carnet:
- uses a separate circuit for each wallet, and another one for prices, so a provider can’t link your wallets to each other or to your IP address;
- has Tor resolve domain names, and uses .onion addresses where they exist;
- refuses to connect if Tor stops responding, rather than falling back to a direct connection;
- asks you to confirm in a system window, outside the interface, before Tor is turned off or a server is changed: a compromised interface can’t do either quietly.
What Carnet can’t promise.
- A blockchain provider sees all the addresses of one wallet together: there’s no syncing them otherwise. Tor only stops them being linked to you and to your other wallets.
- Encryption protects the vault at rest. It won’t protect you from malware running on your device while the vault is open.
- The vault is only as strong as your password: pick a long one that you don’t use anywhere else.
- What you see depends on public services that can be wrong or go down. Carnet flags the discrepancies it spots in “To review” and leaves the fix to you.
- Carnet hasn’t had an independent security audit yet.
Carnet is coming soon.
On its way to Mac, Windows, iPhone and Android. No sign-up, and your data stays on your device.