Security Overview
Anon is built on a non-custodial model: you control the spending keys. Public transaction details and service request metadata can still be visible to other parties. Mobile Sync transfers recovery material directly between your screens as an encrypted QR; it does not upload it to Anon.
Non-Custodial Model
"Non-custodial" means you are the sole holder of the private keys that control your funds. Anon:
- Does not store your private keys or mnemonic on its servers
- Does not require an account on Anon's platform
- Cannot freeze, reverse, or access your transactions
- Cannot recover your account if you lose your mnemonic
The trade-off: you are responsible for backing up your recovery phrase.
What's Stored Where
| Data | Location | Access |
|---|---|---|
| Encrypted mnemonic | Browser IndexedDB | Decryptable only with your passkey/password |
| IDB encryption key | chrome.storage.local |
Encrypted with PRF-derived key |
| Public address | chrome.storage.local |
Plaintext (public by design) |
| RPC configuration | chrome.storage.local |
Plaintext |
| Session keys (view-only, spending) | Memory only | Cleared on lock/logout |
| PRF key | Memory only | Exists only during auth flow |
| Transaction history | Railgun SDK IndexedDB | Encrypted locally |
No key material, mnemonic, or note contents are sent to Anon's servers. The network calls Anon makes, and what each one exposes:
| Call | Purpose | What it can see |
|---|---|---|
Digest CDN (digest.anon.inc) |
Downloading shielded-pool history | Your IP. Requests are identical for every user and contain nothing derived from your keys |
Indexer head API (api.anon.inc) |
Staying current between CDN updates | Your IP and your position in the chain — how far behind you are, not what you hold |
| PPOI aggregator, via Anon's proxy | Proof of Innocence compliance checks | Your IP and which blinded commitments you asked about. Wallet-specific — see below |
| RPC endpoints | Public balances, gas, broadcasting | Your IP and the public addresses you query. Endpoints are configurable |
| Waku peer-to-peer | Broadcaster communication | On-chain submission is delegated; network metadata may remain visible |
| Paymaster API (optional) | Gas sponsorship | Your IP and that a sponsored transaction was requested |
.anon.buzz registry (optional) |
Username resolution | Your IP and the username being resolved |
The first row is the one that carries the bulk of the data, and it is deliberately query-free: your wallet fetches the same public files as everyone else and decrypts them locally, so no server learns which notes are yours. Wallet Syncing covers this in full.
PPOI is a separate privacy surface: the aggregator receives queries about specific commitments derived from the viewing key. The current Anon proxy can cache those reads and retain request parameters in cache metadata. Hashing the cache key does not anonymize the parameters or prevent correlation with network metadata. Review operator retention and access controls; do not assume this path is uncached.
Threat Model
Threats Anon Protects Against
- On-chain observers: zk-SNARKs hide amounts, senders, and recipients in private transactions
- IP correlation: delivery methods change who sees connection metadata; broadcasting through Waku is not an IP anonymity guarantee
- An indexer learning which notes you own: history is fetched as uniform public files rather than per-wallet queries, and decryption happens on your device — there is no filter for a server to read. See Wallet Syncing
- Passphrase brute force: Argon2id with high memory cost makes offline dictionary attacks slow
- Storage theft: encrypted at rest; protection depends on the authentication secret and implementation
- A captured Mobile Sync QR by itself: opening it also requires the phone-generated 120-bit pairing code and the one-time password entered on both devices
Threats Anon Does Not Protect Against
- Compromised device: if malware runs on your device, it may intercept keys in memory or capture your password
- Browser extension vulnerabilities: a bug in Anon's extension code could expose key material
- Complete pairing capture: anyone who captures the encrypted QR, the phone's pairing code, and the one-time pairing password can recover the transferred account. An offline QR copy cannot expire or rate-limit guesses.
- Pairing-code clipboard sync: tapping the phone code can copy it through Universal Clipboard or another sync service onto the desktop. If that clipboard and the QR are captured together, the one-time pairing password is the remaining protection; Anon's 30-second clipboard clearing is best-effort.
- Phone screen capture: Anon asks the OS to block supported screenshots and recordings and warns after a detected screenshot attempt. Platform capture defenses reduce exposure but are not a guarantee; delete any recovery image from Photos and Recently Deleted.
- Network-level traffic analysis: delegating submission does not eliminate network metadata or traffic analysis
- Sync traffic shape: the volume and timing of history downloads suggest roughly how recently a given IP synced, though not which notes are theirs. A VPN or Tor changes which parties can observe this traffic; it does not erase its timing and volume
- Proof of Innocence queries: compliance checks are wallet-specific by construction and reach a third-party aggregator through Anon's proxy
- Lost mnemonic: there is no recovery path without your 12-word phrase
Open Source
Anon's plan is to be open source. We are working toward publishing our repositories and tooling at github.com/anondotinc, and will do so progressively rather than all at once — components are released as they are ready to be maintained in public.
Some pieces are already there, including the paymaster relay, whose full Go, Docker, and Cloudflare Worker implementation is public.
Independently of Anon's own code, the underlying Railgun protocol contracts and cryptographic circuits are open source and have been audited by multiple independent firms; audit reports are available in the Railgun GitHub organization. The digest data your wallet syncs from is public and content-addressed, so anyone can verify it against on-chain logs without access to Anon infrastructure — see Digest Sync.