Owning a crypto wallet means taking responsibility for your recovery phrase. If you lose it, you lose access to your wallet. That's why people write it down on paper — but paper can be lost, photographed, stolen, or read by someone else.
Safely takes a different approach: it keeps encrypted copies of your recovery phrases across your own trusted devices. Create a wallet on one device, and it appears on the others. We call it Safely Sync.
Your recovery phrases are never sent over the internet in readable form. They are encrypted on your device before they leave it, and Safely's servers never receive the keys needed to decrypt them.
Safely uses an industry-standard encryption scheme to make it all work. The rest of this article explains why you can trust the protocol.
Setup
For example, you already have wallets on your phone — and you want to use them on your laptop too. But secret data — like recovery phrases — must never travel in the open. Before anything reaches your laptop, it has to be encrypted on the phone. The phone does this with the sync key — a key it generated locally when you first signed in. The sync key never leaves the device unencrypted.
Only your first device — your phone — holds the sync key. Without it, the laptop can never decrypt the ciphertext. So how do you deliver the key, secretly and securely?
Solution
To deliver the sync key to another device, we first establish a Shared Secret Key with which we encrypt the sync key. That key is created with the Diffie–Hellman key exchange — a protocol built on a well-known mathematical one-way operation: easy to compute in one direction, practically impossible to reverse.
The principle behind it is easiest to show with paint.
Anyone can quickly mix yellow and blue into green. But hand someone the green and the blue and ask which exact yellow went in — the task becomes impossible to solve: shade after shade, with no way to check except through trial and error.
Easy to mix, practically impossible to unmix. In math, this asymmetry is known as the discrete logarithm problem — the one at the heart of Diffie–Hellman.
The Diffie–Hellman handshake
Your phone and laptop perform the same one-way mixing — with numbers on an elliptic curve instead of paint. Each device generates its own ephemeral private key: the phone picks a, the laptop picks b.
The keys are called ephemeral because devices destroy them right after use — to make sure that transmitted ciphertext forever remains undecipherable noise to whoever logged it along the way.
Each device mixes its private key with the shared value G. The results, A and B, are ephemeral public keys — safe to exchange, because recovering a or b from them would take billions of years of computing. The private keys themselves never leave the devices.
The laptop shows its public key B as a QR code, and the phone scans it. No network is involved — you physically confirm which two devices are syncing.
Only scan QR codes from devices you trust. Whatever you sync with receives the keys to your account — scanning an attacker's code hands them everything.
The shared secret
The phone holds a and has just received B. It mixes them: a × B. And since B = b × G, that makes S = a × B = a × b × G — the Shared Secret Key.
Locking the sync key
The phone encrypts the sync key with the Shared Secret Key. The result is ciphertext — the sync key, turned into noise.
In practice, the devices exchange several more keys required for synchronization, but for clarity this article focuses only on the Sync Key. To get the full picture, see the technical specification of the protocol.
What the Safely server sees
The phone sends two things: the ciphertext and its public key A. They travel through Safely's server — it stores and relays the data, but cannot read it: everything it handles is encrypted. Anyone watching the traffic, the server included, sees a stream of noise and an ephemeral public key — nothing that can be used to recover your secret data.
Arriving at the same shared key
The laptop now holds A — and performs the same mixing from its side: b × A = b × a × G = the same Shared Secret Key.
Same ingredients — same key. The laptop decrypts the ciphertext, and the sync key is now on both devices. Note what just happened: the Shared Secret Key was never transmitted — both devices built it independently.
Sync comes alive
With the sync key now available to both devices, sync runs on its own. Every change is encrypted with keys derived from the sync key and sent to the server; the other device picks it up from there and decrypts it. Create a wallet on the laptop — it appears on the phone. Add a contact on the phone — it shows up on the laptop.
During and after the sync, your recovery phrases are encrypted on your devices — and can only be decrypted by another device of yours. Safely's servers never have access to your secret data. They are just the transport layer.
What an outside observer sees
Notice what actually traveled between the devices: ciphertext and ephemeral public keys. Nothing else. The public keys are used once for the exchange, then destroyed. And even with every public key in hand, an attacker would need billions of years of brute force to recover a private key.
One thing the math can't do for you: choose the right devices. Whatever you sync with gets the sync key — so sync only with devices you own and trust. Never scan a QR code from a device you don't recognize.
The scheme used by Safely is an industry standard: the same protocol protects key exchange in popular messengers and every connection your web browser makes.
Your recovery phrases do travel between your devices — but only as encrypted data. They are never exposed to Safely's servers or sent over the internet in readable form.
Want to go deeper? Learn about elliptic curve Diffie–Hellman (ECDH). We will also publish the detailed technical specification before launch.