Generate
A 12 or 24-word phrase is created in your browser or app using your device's own randomness. It is never sent anywhere at creation time.
Security
Encrypted on your device. Nowhere else.
Coinmidco is built so that you never have to trust a company with your crypto — including us. Your recovery phrase is generated locally, encrypted with a device-derived key, and used on your device to authorise every action.
Architecture
Four layers, none of them ours
Each layer protects a different thing — the phrase, the device, the session and the network in between. Removing any one of them does not hand your funds to anyone else.
- Non-custodial by architectureYour phrase is created and used locally. Signing happens on your device, not on a server.
- Encrypted seed vaultThe phrase is stored with authenticated encryption under a key derived per device — not a shared secret.
- Three layers of access controlBiometric unlock, a 4-digit PIN and optional two-factor authentication on account features.
- Session controlEvery signed-in device is listed and can be revoked instantly, without touching your funds.
Lifecycle
What happens to your key, step by step
Encrypt
The phrase is sealed with authenticated encryption under a key derived on that device, so storage never holds a readable copy.
Sign
When you send, swap or stake, the transaction is composed electronically and signed locally. Only the signed result leaves your device.
Back up
You keep the phrase offline. That backup — not an account, not a support desk — is the only thing that can restore your wallet.
Standards
Nothing proprietary, everything verifiable
We use the same open standards as every other serious wallet, so your phrase is portable and your addresses are reproducible. You can check them yourself in any compatible app.
| Standard | What it governs | Why it matters to you |
|---|---|---|
| BIP39 | How a recovery phrase maps to a seed | Your 12 or 24 words restore in any BIP39-compatible wallet |
| BIP44 | Derivation paths for each network | One phrase produces addresses on many chains, in a predictable order |
| SLIP-0010 | Key derivation for ed25519 chains | Solana, Cardano and Polkadot addresses match other wallets |
| EIP-1193 | How apps request wallet actions | dApps see a standard provider and every request needs your approval |
| WalletConnect | Pairing with external dApps | You connect without exporting a key or installing a second wallet |
The trade-off
What self-custody rules out
Honesty is part of security. These are the things Coinmidco deliberately cannot do.
We cannot
- Recover your phrase for youNo support agent, engineer or database can read or reconstruct it.
- Reverse a transactionOn-chain transfers settle on the network and cannot be recalled.
- Freeze or seize your fundsThere is no switch to flip, which is the point.
You should
- Write the phrase down offlinePaper or metal, stored somewhere only you can reach. Never a screenshot or a cloud note.
- Enable PIN and biometricsThey protect the app on a device someone else may pick up.
- Verify addresses before sendingCheck the first and last characters at minimum — clipboard malware swaps them.
- Keep the app updatedUpdates ship security fixes as well as features.
Nobody legitimate will ever ask for your recovery phrase. Not support, not an
"airdrop", not a wallet "validation" page. If someone has your words, they have your funds —
permanently. Treat any request for them as an attack.
A wallet you never have to ask permission to use
Create one in under a minute, or import the phrase you already trust. Your keys stay yours either way.