HomeAboutDocsLinks
Add to Chrome

Security

Local-first and non-custodial. Your keys never leave your device.

Architecture

Subslot is a Chrome extension (Manifest V3) that runs entirely in your browser. There are no backend servers, no databases, and no accounts. Everything happens locally:

Key Encryption

All private keys are encrypted at rest using industry-standard cryptography:

  1. Password derivation: Your password is run through PBKDF2 with 100,000 iterations and a random salt to derive an encryption key.
  2. Encryption: The private key is encrypted with AES-256-GCM using the derived key and a random IV (initialization vector).
  3. Storage: The encrypted blob, salt, and IV are stored together in Chrome's local storage. The password itself is never stored.
  4. Decryption: When you unlock, your password re-derives the key and decrypts. If the password is wrong, decryption fails.
Why PBKDF2 with 100K iterations? It makes brute-force password guessing computationally expensive. Even if someone extracted the encrypted data from Chrome storage, they'd have to try billions of password combinations, each taking time to derive.

Non-Custodial by Design

No custodial backend ever holds your keys. Signing happens on-device, keys are derived only from your password, and nothing about your wallet is synced to a server. If you lose your password and your backups, no one — including us — can recover your funds.

dApp Signing

Subslot registers as a Solana Wallet Standard wallet, so any dApp can detect it and request a connection. Every connection and every signature raises an explicit approval popup — nothing is ever signed silently. You see what you are approving before it is signed, and you can reject it. See Connect to dApps.

Memory Management

When your wallet is unlocked, decrypted private keys are held in the service worker's memory — not in Chrome storage. This memory is:

Auto-Lock

Configurable inactivity timeout (default: 15 minutes). When triggered:

  1. All decrypted private keys are deleted from memory.
  2. The side panel switches to the lock screen.
  3. No transactions can be signed until you re-enter your password.

Transaction Signing

All transactions are signed locally in the service worker:

  1. The extension builds the transaction (swap, send, trigger order, launch, etc.).
  2. It is signed with your decrypted private key in memory.
  3. The signed transaction is sent to the blockchain via your RPC endpoint.
  4. At no point does the private key or an unsigned transaction leave the extension's process — private keys never touch the network.

Content Security Policy

Extension pages enforce a strict CSP:

This prevents XSS attacks, malicious script injection, and code tampering.

Network Communication

The extension communicates only with these external services:

No private keys or wallet balances are ever sent to any of these services.

No Personal Data

Subslot collects no personally identifiable information. The only telemetry is optional, anonymous usage analytics, which you can turn off in one tap under Privacy in Settings. Your keys, password, and balances are never collected.

Balance Hiding

Toggle the eye icon in the wallet card to hide all balance displays. Useful when:

Best Practices

Previous← ThemesNextFees & Cashback →