Keep it safe

What you’ll do: Understand the one secret that matters — your recovery phrase — and the handful of mistakes that drain wallets.

This is mainnet. Balances are real money, and on-chain transfers are irreversible. The threat model is simple: whoever holds your recovery phrase controls your funds.

The recovery phrase is a root key

Your 12–24 words deterministically derive your wallet’s private keys. Treat the phrase exactly as you’d treat a root private key or an unencrypted id_rsa.

Do

• Write it on paper and store it offline, ideally in two separate secure locations.
• Keep it out of any system that syncs to the cloud.

Don’t

• Screenshot it, photograph it, or paste it into notes, chat, or email.
• Type it into any website. No legitimate site — TOSS included — ever asks for it.
• Store it in a general password manager unless it’s a vault feature designed for seed phrases.

PIN vs. phrase

The wallet’s PIN/password locks the app on one device. The recovery phrase restores the wallet on any device. Losing the device is recoverable with the phrase; losing the phrase is not recoverable at all.

What TOSS will and won’t ask for

TOSS asks you to approve transactions in your wallet (connect, deploy, fund). It will never ask for your recovery phrase, PIN, or private key. Any prompt that does is a phishing attempt — stop and verify the domain.

Verify what you sign

Before approving a sign prompt, glance at what it is: the asset, the amount, and the destination. For connecting a wallet to a bounty you’ll approve an authorization; for funding you’ll approve a USDC transfer with a visible network fee. If an amount or destination looks wrong, reject it.

Recovering on a new device

Install the wallet, choose “Recover” (or “Import”), and enter your recovery phrase. The wallet and its balances reappear — which is exactly why the phrase must stay private.

Next: choose a path — Maintainer · Contributor

Questions? FAQ · Troubleshooting