Security built on proof, not promises

Keys never leave your device

Your private keys are generated locally on your device using cryptographically secure random number generation. They are stored in encrypted local storage and are never transmitted to any server, API endpoint, or third party. When you send a transaction, the signing happens entirely on your device before the signed transaction is broadcast to the blockchain network.

This non-custodial architecture means that even if Jaxx Liberty's infrastructure were compromised, your keys would remain safe. There is no central database of private keys, no server-side wallet, and no way for anyone other than you to access your funds. You hold the keys, and only you can authorize transactions.

The wallet derives addresses using industry-standard BIP-39 mnemonic phrases and BIP-44 hierarchical deterministic key derivation. Your twelve-word backup phrase is the master key to all your wallets across all supported blockchains. Guard it carefully — it is the only way to recover your funds if you lose access to your device.

Passkey on every spend

Every outgoing transaction in Jaxx Liberty requires biometric or hardware confirmation before it can be signed and broadcast. This means that even if someone gains physical access to your unlocked device, they cannot send your funds without your fingerprint, face scan, or hardware key approval.

This passkey requirement applies to every single transaction — there is no way to disable it, no "remember for 15 minutes" option, and no bypass. Each spend is a deliberate, confirmed action. This design eliminates an entire category of attacks where malware or unauthorized users attempt to initiate transactions from an unlocked wallet.

Hardware signing

For users who want the highest level of security, Jaxx Liberty integrates with Trezor and Ledger hardware wallets. When hardware signing is enabled, your private keys live inside the secure element of your hardware device — they never exist on your phone or computer, even temporarily.

The wallet prepares the transaction on your phone, sends it to the hardware device for signing, and broadcasts the signed result. The private key never crosses the boundary between the hardware device and your phone. This separation of concerns means that even a fully compromised phone cannot steal your keys.

Open source and auditable

The entire Jaxx Liberty codebase is open source under the MIT license. Every line of code that handles your keys, signs your transactions, and communicates with blockchain networks is available for public inspection. Security researchers, developers, and users can read the source, verify the implementation, and report any issues they find.

Open source is not just a feature — it is a security requirement. Closed-source wallets ask you to trust that their code is safe. Jaxx Liberty gives you the means to verify it yourself. The wallet also undergoes regular independent security audits to provide additional assurance beyond community review.

Reproducible builds

Open source code only matters if you can verify that the binary you download actually matches the published source. Jaxx Liberty uses reproducible builds, which means anyone can compile the source code and produce a binary that is bit-for-bit identical to the official release.

This eliminates the supply chain attack vector where a malicious actor could insert backdoors into the build pipeline. You do not need to trust the build server — you can verify the result independently by comparing SHA-256 hashes.

No server, no target

Jaxx Liberty operates without a central server that stores user data. There is no account system, no email registration, no phone number verification, and no identity checks. The wallet communicates directly with blockchain networks to broadcast transactions and fetch balances.

This serverless architecture eliminates the most common attack vector in cryptocurrency: a centralized database of user keys and personal information. There is nothing to hack because there is nothing stored. Your wallet exists only on your device, protected by your passkey and optional hardware signing.