Use this page to see what runs on each kind of device and why the wallets behave differently. Every Rand Wallet is the same wallet with a different shell. One Rust core, built from the full node’s own crates, holds the keys and does the cryptography on every device. The one real difference is memory: a bundle proof peaks at about 6 GB. A desktop or a large phone makes it on the spot, and anything smaller hands that one proof to a prover. The downloads and build steps for each client are on /clients.
One core, five shapes
| device and client | the core inside it | proves a transfer | where the spend key is kept |
|---|---|---|---|
| iPhone: the iOS app, iOS 16 or later | an XCFramework | with about 8 GB of memory, in a minute or two; otherwise through a paired prover | the Keychain, only while the device is unlocked; never synced |
| Android: the Android app, Android 8 or later | a native library | with about 8 GB of memory, in a foreground service; otherwise through a paired prover | encrypted under a key the Android Keystore holds |
| Laptop and desktop: the desktop app for macOS, Windows and Linux | the Rust crate, linked in | on the machine, about a minute on a laptop CPU; it will not start one below 8 GiB of RAM | a password vault (AES-256-GCM, PBKDF2 at 600,000 iterations); unlocked, only in the app’s memory |
| Browser: the Chrome and Firefox extensions, the web wallet | WebAssembly | never: WebAssembly gets 4 GiB, so a paired prover always makes the bundle proof | the same kind of vault; unlocked, in the page’s memory or the tab’s session storage |
A laptop and a desktop run the same desktop app. The only difference is the memory the machine has for proving. A wallet created on any of them imports into the others and into the rand command line, and back: the key file, the address format and the rules are the same everywhere.
Which wallet sends on chain 21
Chain 21, live since 2026-10-12 10:31 UTC, runs constraint set 9: every verifier key and the proof encoding changed, so a wallet needs fullnode v0.8.0 to send on it, and a proof from an older wallet does not even decode (the genesis binding introduced by chain 20 still applies on top). Rand Wallet v0.8.0, released on 2026-10-12, is that wallet: every app’s core vendors fullnode v0.8.0, every app can sign for a private multisig, and by default the bundle proof is made by the RandProtocol prover, with a prover of your own as the private choice. The 0.7.x apps, built for chain 20, refuse chain 21, and v0.8.0 refuses chain 20; keys, addresses and viewing keys carry over, and a wallet that scanned chain 20 shows a different-chain banner once and rescans from chain 21’s genesis. The rand command line from the fullnode v0.8.0 release (Command line) sends too, and takes the same key file.
What every client does
- Keeps the spend key on the device. It is generated from the operating system’s randomness and stored encrypted. No client ever sends it anywhere, and the network has no accounts to send it to.
- Finds its own notes. It scans the chain with its viewing key, so no server knows which notes are its own.
- Makes the authorisation proof itself. A transfer carries two proofs. The small one, over the spend key, takes seconds and is always made on the device (Validators, aggregators and provers).
- Gets the bundle proof made. It makes it on the device if there is memory for it, or else from a paired prover. Every proof it gets back is checked before anything is submitted.
- Submits to any RPC node. What it sends is what every node sees: commitments, nullifiers, sealed envelopes, the fee and the proofs.
Pairing a prover
A phone that is short of memory, and every browser wallet, pair a prover for the bundle proof. On the same computer, the desktop app does it (Settings → Prove for my other devices, then paste the link into the browser wallet’s Settings → Prover). Elsewhere it is a rand-prover you run (Running a node), or the validators’ pool at prover.randprotocol.org.
A paired prover is sent the wallet’s viewing key and a one-time salt, never the spend key. It can read that wallet’s whole history, past and future, and it cannot spend. Pair only a prover you would show that history to. For full privacy, prove on a desktop or an 8 GB phone, or run your own prover.