Is Zerion Wallet safe?

Zerion is non-custodial and audited by professional security firms, including Cure53, SlowMist, Zokyo, and Secfault Security. The browser extension's code is open source, and an active bug bounty on Immunefi rewards white-hat hackers who find anything the audits missed.

Can Zerion access my recovery phrase?

No. Zerion is non-custodial. Your recovery phrase is stored locally on your device, so Zerion has no access to it and no way to move your funds.

Does Zerion store my recovery phrase in iCloud?

Only if you choose to. On mobile, Zerion offers an optional encrypted backup of your recovery phrase to iCloud (iPhone) or Google Drive (Android). You set the password that encrypts it, and Zerion can never access your phrase or restore it if you forget that password.

Which encryption does Zerion use?

Cloud backups use Apple's or Google's own encryption, on top of a password you set. That password must be at least 14 characters and mix numbers, symbols, and upper- and lower-case letters.

What is the safest way to create and store my recovery phrase?

For an extra layer of security, create your recovery phrase on a Ledger hardware wallet and connect it to Zerion — both the browser extension and the mobile app support Ledger signing, so your keys stay in cold storage.

Can Zerion recover my password?

No. The password isn't stored anywhere in Zerion's systems, so only you know it and nobody can reset it for you. If you forget it, you reinstall the app and import your wallets with your recovery phrase. That's the responsibility that comes with self-custody.

What happens to my funds if Zerion goes offline?

Nothing. Your assets live on the blockchain, not with Zerion, and nobody can suspend your wallet or stop your transactions. Your recovery phrase restores your wallet in Zerion or any other compatible wallet, whenever you want.

Wallet Security

Safely explore all of Web3

Zerion can never access your recovery phrase or private keys. Independent audits, open extension code, and a live bug bounty are there so you don't have to take our word for it.

Download Zerion Report a vulnerability

Don't trust. Verify.

Four independent firms have audited Zerion Wallet, the extension's code is public, and there is no key for us to lose.

Independent audit firms

Keys Zerion can access

Immunefi

Live bug bounty

Ledger

Hardware wallet support

Before you sign

Know what you're signing

Every transaction is previewed in plain language — from NFT mints to staking — so a malicious message can't hide behind hex.

The exact assets leaving and entering your wallet
The app requesting it, and the contract it routes through
Network fee and total, before you approve

Zerion Wallet transaction preview — a Uniswap trade shown as the exact assets paid and received before signing

Before you connect

Phishing caught at the door

Known phishing sites and malicious apps are flagged automatically, before you connect a wallet to them.

Malicious apps blocked at connection time
Spam tokens and scam NFTs filtered out of your portfolio
Report anything that slips through, from inside the app

Zerion Wallet flagging a malicious application before the wallet connects to it

After you approve

Approvals on your terms

Set your own spending limit on every approval, so no dapp gets more access to your funds than it actually needs.

Edit the allowance before signing, not after
Grant exactly the amount a trade needs
Review and revoke what you've already approved

Zerion Wallet custom token allowance editor — setting a spending limit on an approval

You hold the keys — not Zerion

Self-custody isn't a setting you switch on. It's how the wallet is built, and it's what every other guarantee on this page rests on.

Self-custodial by design

Your recovery phrase is generated on your device and stays there. Zerion can never read it, move your funds, or freeze your wallet.

Nobody can freeze your funds

Your assets live on the blockchain, not with Zerion. No one can suspend your wallet or stop a transaction you've signed.

Recovery stays with you

Back up your recovery phrase to iCloud or Google Drive behind a password only you know — entirely optional, and Zerion can't decrypt it.

Ledger support

Pair a Ledger device to keep your keys in cold storage while still using every Zerion feature on mobile, extension, and web.

No signup, no KYC

There's no account to create and no identity to verify. Download the wallet and it's ready.

Watch-only wallets

Follow any address without importing a key, so you can track a vault or a hardware wallet without exposing it.

Audited by four independent firms

Professional security firms audit Zerion Wallet, and the browser extension's code is public so you can read it yourself.

Cure53 — independent security audit of Zerion Wallet

SlowMist — independent security audit of Zerion Wallet

Zokyo — independent security audit of Zerion Wallet

Secfault Security — independent security audit of Zerion Wallet

Open source: you can read the code

The browser extension’s code is public on GitHub, so you can see exactly what it does before you install it.

View on GitHub →

Bug bounty for white hats

Found something the audits missed? Disclose it through our Immunefi program rather than exploiting it, and get rewarded.

Report a vulnerability →

If something looks wrong

Three things you can do the moment a transaction, a token, or the wallet itself doesn't look right.

1
Reject the transaction
Read the preview before you approve. If the assets moving aren't the ones you expect, reject it — nothing is signed until you say so.
2
Report the token or NFT
Flag scam tokens and spam NFTs from inside the app. Reports feed the filters that protect every other Zerion user.
3
Disclose a vulnerability
Found a bug in Zerion itself? Report it through our Immunefi program rather than exploiting it, and get rewarded for it.
Open the bounty