Security Features

0xio provides multiple layers of security to protect your funds and privacy. The protections below apply across the browser extension, desktop app, and mobile app, with a few platform-specific additions noted where relevant.

Biometric Unlock

All three clients support biometric unlock with a password or PIN fallback:

• Extension: a passkey (Touch ID, Windows Hello or a security key) can unlock the wallet instead of the password. Set it up in Settings > Security. The lock screen opens the passkey prompt only when you tap Use passkey. Passkeys are not available on Firefox, and changing or removing the password turns the passkey off.
• Desktop: Touch ID / Windows Hello. On desktop, biometrics are the primary prompt for sensitive actions, with your password as the fallback
• Mobile: Face ID / Touch ID / fingerprint for transaction approval and unlock, with PIN fallback

Auto-Lock

Automatically lock your wallet after periods of inactivity.

Configuration

1. Navigate to Settings > Security and open the auto-lock setting
2. Select timeout period:
   • 5 minutes
   • 15 minutes
   • 30 minutes
   • 1 hour
   • Never (not recommended)

How It Works

• Timer resets with any wallet interaction
• Locked wallet requires your password (or passkey) to reopen
• Locking clears decrypted private balances and wallet data held in memory, and shuts down the private balance engine
• While the extension is locked, its toolbar icon shows a padlock and sites receive no address or balances

Password Management

Changing Your Password

Password Requirements

• Minimum: 8 characters (12+ recommended)
• Recommended:
  • Mix of uppercase and lowercase
  • Include numbers
  • Include special characters (!@#$%^&*)
  • Avoid common words or patterns

Recovery Phrase Management

Viewing Your Recovery Phrase

1. Settings > Backup, then the recovery phrase (extension). On a new wallet, the Back up tag on Home opens the same backup
2. Enter your password
3. Write down all 12 words in order
4. Hide or close the view immediately

Multiple Devices

Use your Recovery Phrase to access the same wallet on multiple devices:

• Each device can have its own password
• Balance changes sync via blockchain automatically
• Transactions from any device reflect on all devices
• No cloud synchronization required

Device Security

Recommended:

• Different passwords per device
• Enable auto-lock on all devices
• Never store recovery phrase digitally
• Regular security audits

Advanced Security Options

Export Private Key

Use Cases:

• Importing to other Octra-compatible wallets
• Advanced development and testing
• Cold storage solutions

How to Export:

1. Settings > Backup, then the private key (extension). With EVM on, the EVM key is shown too, with its own QR code
2. Enter password
3. Copy private key (never screenshot)
4. Store securely (treat like recovery phrase)

Transaction Signing

All transactions require explicit approval:

• Review: Every transaction, approval included, shows full details before anything is signed (including the contract method and its arguments for contract calls)
• Confirm: In the extension the review ends with a button pair: Back and Send for your own sends, Reject and the action (Connect, Sign, Send and so on) for site requests. The desktop menu bar asks for Touch ID or your password after its review. On mobile every send, approval, signature and connection is confirmed with a slide, then Face ID or the PIN when Ask before sending (sends) or Ask for PIN before signing (sites) is on
• Fee shown is fee signed: the network fee on the review is read live, and that fee is the one signed. A fee that cannot be read blocks the action instead of falling back to a default
• Signing wallet shown: Every approval, message signatures included, names the wallet and network it signs with
• Bound to what you reviewed: a transaction is signed only on the wallet and network its review showed. Switching wallet or network before it is sent refuses it
• What you see is what is signed: site reviews show the exact arguments, amounts and memo that are signed. The extension refuses a site request whose fields disagree before any review
• Never re-signed on its own: a busy node gets the same signed transaction again; a used nonce or an unclear result asks you to review or check History, never signs a new one
• No Auto-Sign: Even for connected dApps
• Cancel Anytime: Before signing completes

Connection Management

Connected dApps

View and manage website connections:

1. Settings > Connections > Connected sites (extension)
2. See every connected site with its wallets and network
3. Open a site to remove a wallet from it or disconnect it
4. Disconnecting does not revoke token approvals already on chain

See Connecting to Sites.

Permission Types

Octra sites ask for these permissions when they connect: EVM sites see only the 0x address of the wallet in use and its balances.

Session Security

Connected dApp Sessions

Each connected site holds a session scoped to the permissions you granted. Review and revoke them under Connected sites (see Connection Management). Disconnecting immediately ends that site’s session.

Secure Logout

Always lock the wallet on shared devices:

1. Extension: Settings > Lock wallet
2. Desktop: Lock in the menu bar panel, or Cmd+L while the panel is open
3. Unlock requires your password, PIN, passkey or biometrics

Watch-Only and Balance Privacy

• Watch-only mode: Import an address without its private key to monitor balances and history. Watch-only wallets cannot send, sign, or run privacy operations.
• Hide balances: Toggle the eye control to mask balance amounts on screen, useful in public or shared settings.

Mobile-Specific Protections

The mobile app adds device-level safeguards:

• Screenshot and screen-recording prevention on sensitive screens
• Secure clipboard handling for copied addresses and keys
• Jailbreak / root detection with an on-screen warning when a compromised device is detected
• PIN lock with auto-lock and rate limiting, backed by the device keychain/keystore
• Honest browser lock: the in-app browser shows a lock only on https pages, marks plain http as not secure, and shows none for oct:// content
• Lookalike site warnings: the in-app browser flags a site whose name is spelt close to a listed app, or uses another alphabet, and warns before it can connect, sign or send (on by default, in Browser settings)
• https sites only: only pages served over https can reach the wallet from the in-app browser
• Verified WalletConnect sites: a WalletConnect site is named by its verified address, or tagged Unverified; a site that fails verification or is flagged as a scam is refused
• Erase this phone: lists each wallet as backed up or not before anything is erased, and asks once more when one is not

Network Security

RPC Endpoint Validation

0xio validates RPC endpoints before connecting:

• Known Networks: Pre-configured RPCs for Octra mainnet and devnet and the built-in EVM networks
• Custom Octra Networks: a node must answer as an Octra node before it is added, with a warning that it sees your address and the transactions you sign there. Its URL must be http or https
• Custom EVM Networks: the RPC must be https and must answer with the network’s chain ID before it is saved. A site can never change the RPC, name or symbol of a network you already have
• Optional RPC proxy: wallets talk to the Octra node directly. The 0xio RPC proxy is used only when you turn it on, never as a silent fallback

Phishing Protection

Built-in protections against common attacks:

• Address Validation: Octra addresses must be oct plus 44 Base58 characters; pasted spaces are stripped. Sends to your own address are refused
• Transaction Preview: Always shows full details, the signing wallet and the network
• Spam filtering: tokens and NFT collections that look like spam (links or bait words in the name, or a symbol imitating a known token) start hidden, and EVM history leaves out zero-value transfers and spam tokens, so address-poisoning transfers never show
• Lookalike sites (mobile): see below
• Wallet pictures: Each wallet’s picture is drawn from its address, the same in the mobile app and the extension, so a wrong wallet looks wrong before you check the address
• Isolated content: living NFTs run sandboxed with no access to the wallet or its keys; a program may reach only its own network’s RPC. On desktop, oct:// pages and the Circles preview also run in isolated frames with a security policy of their own

Security Best Practices

DO:

• Enable auto-lock (15 minutes or less)
• Use a strong, unique password
• Store recovery phrase offline securely
• Regularly review connected dApps
• Verify addresses before sending
• Start with small test transactions
• Keep browser and extension updated

DON’T:

• Share password or recovery phrase with anyone
• Store recovery phrase digitally
• Screenshot or photograph sensitive information
• Use the same password across services
• Leave wallet unlocked on shared devices
• Approve transactions without review
• Connect to untrusted dApps

Emergency Procedures

Compromised Device

If you suspect your device is compromised:

Lost Recovery Phrase

Prevention:

• Maintain multiple secure backups
• Consider metal backup solutions
• Store in separate physical locations
• Test recovery on a second device

Security Audit

Regular Security Checks

Perform monthly security audits:

• Recovery phrase backed up securely
• Password is strong and unique
• Auto-lock enabled
• Connected dApps reviewed
• No suspicious transaction history
• Wallet apps are on the latest version
• Device security software updated

Reporting Security Issues

Found a vulnerability? Report to: [email protected]

• Do not publicly disclose until patched
• Include detailed reproduction steps