Version 4.0

Security & Transparency

Non-custodial wallet architecture — Bad Vault on the web and the wallet in the Bad Place app

Non-Custodial by Design

Bad Place is non-custodial on every surface. In the mobile app, your wallet is encrypted on your device. On the website, Bad Vault encrypts your wallet in your browser, and we store only an encrypted copy that we cannot decrypt. Either way, only you can move your funds.

Not Your Keys? Not Here.

We hold no key material we can use. In the app, your 12-word seed phrase lives on your device, encrypted with a key derived from your wallet password. In Bad Vault, your browser encrypts it, and the keys that open it come from your passkey or your seed phrase — never from us. A breach of our servers exposes no readable keys.

Where Things Live

Your Device

Encrypted wallet

AES-256-GCM

Your Seed Phrase

12 words, only you

Your backup

Our Servers

No readable keys

Account data and encrypted Bad Vault copies
Non-custodial: only you can unlock your wallet

Custodial Model

  • •Provider stores your key, or a share of it
  • •A server breach can drain user funds
  • •Accounts can be frozen or locked

Our Non-Custodial Model

  • •Keys are generated and encrypted on your device or in your browser
  • •Our servers hold nothing that can unlock a wallet
  • •Only you can decrypt and sign