Your wallet and recovery phrase

Simple

Kalda is a wallet you look after yourself. No bank or company holds your money for you, and nobody at Kalda can see it, freeze it or get it back for you.

When you made your wallet, you were shown 12 words. This is your recovery phrase: the master key to every coin in your wallet. One set of words covers them all.

Write the 12 words on paper, in order, and keep the paper somewhere safe and private. If your phone is lost or broken, these words bring your money back on a new phone. Anyone who sees them can take everything, so never show them to anyone.

To see the words again, go to Profile → Backup & security → Recovery phrase; you'll confirm it's you with your fingerprint, face or phone PIN first. On a new phone, choose “I already have a recovery phrase” and type the words in order.

Profile → Backup & security → Secret sharing lets you split a backup between people you trust. Reset wallet, at the bottom of Backup & security, wipes the wallet from this phone; only use it once your words are safely written down.

Detailed

Self-custody

Your money lives on public blockchains, not inside the app. What the app holds is the key that proves you own it. Every payment is signed with that key on your phone, and the networks accept it because the signature checks out, not because any company approved it.

An open standard

Your recovery phrase follows BIP-39, an open standard most wallets share. It turns a large random number into words from a fixed public list of 2,048 words, and the last word carries a checksum, so most typing mistakes are caught when you restore.

One phrase, many coins

Open standards describe how a whole tree of keys can grow from one phrase, with a separate branch for each blockchain. That is why a single backup brings back Bitcoin, Ethereum, XRP, Zcash and the rest together, and why the same words can often be restored in other wallets that follow the same standards.

• Coins such as Bitcoin can use a fresh address for each payment; all of them belong to the same phrase.
• Restoring recreates the keys. The money itself never left the blockchains, so it is all still there.

What a backup can't do

No standard lets anyone reset a lost phrase. Without the words, nobody can rebuild the keys, and a wiped phone cannot reach the money again.

In depth

Entropy

A wallet begins with randomness. A 12-word phrase encodes 128 random bits plus a 4-bit checksum taken from a hash of those bits: 132 bits in total, split into twelve 11-bit numbers, each picking one word from a list of 2,048 (2^11).

2^128 ≈ 3.4 × 10^38 possible phrases

That number is far beyond what any computer could search by guessing, which is why a phrase never shown to anyone is safe, and why one that has been seen is not.

From words to a seed

The words are fed through a key-stretching function: a hash-based function repeated thousands of times. The output is a 512-bit seed. Stretching makes each guess slow and costly for an attacker, while costing one user almost nothing.

Hierarchical deterministic keys

From the seed, a one-way function produces a master key and then child keys, level by level, like branches of a tree. Each child is computed from its parent and an index number, so the same seed always rebuilds the same tree, while knowing one branch reveals nothing about its parent or siblings.

Public-key cryptography

Each private key is a secret number. Multiplying a fixed point on an elliptic curve by that number gives the public key; addresses are derived from public keys. Going forwards is easy, but going backwards, recovering the number from the point, is the elliptic-curve discrete logarithm problem, believed infeasible for today's computers.

public key = private key × G

A digital signature proves knowledge of the private key for one specific message without revealing the key, and anyone holding the public key can verify it. That is all a blockchain needs to decide whether a payment is valid.