Documentation

WHYUS? turns an email address into real, self-custodial wallets on Solana and every major EVM chain. There is no email verification step and no custody of your funds — the keys are yours, and this page documents exactly how they are created and how to use them elsewhere.

What happens when you sign in

• You create an account with an email address and a password. Signing up returns a session straight away — no confirmation email to click.
• The server generates a fresh 12-word BIP-39 recovery phrase and derives both wallets from that single phrase.
• The phrase and every private key are encrypted with AES-GCM before they are stored, so the database only ever holds ciphertext.
• Your wallets page shows each address as text, as a QR code, and with a link to a public block explorer.

Your wallets

Solana

Derived at m/44'/501'/0'/0' (SLIP-10, hardened), the same path Phantom and Solflare use, so the wallet works wherever a standard Solana wallet works.

EVM

Derived at m/44'/60'/0'/0/0 — the MetaMask default. The one address is valid on Ethereum, Base, Arbitrum One, Optimism, Polygon, BNB Smart Chain and Avalanche C-Chain, which is why those chains share an address and each gets its own card and QR code.

Importing your wallets into another wallet app

• Phantom / Solflare: Add account, choose Import recovery phrase, paste the 12 words from your wallets page.
• MetaMask / Rabby: Import an existing wallet with a recovery phrase, paste the 12 words, then add the EVM networks you want to use.
• Trust Wallet: Import wallet, choose recovery phrase, paste the 12 words.
• One chain at a time: use Show private key on a wallet card to reveal that chain's key and import it directly.

Recovery phrase and private keys

One 12-word phrase restores your Solana wallet and every EVM wallet. A private key restores a single chain only. Both are secrets: anyone who has either one owns the funds, and no support request can undo a key that has been shared. See the guidelines for how to store them.

Security model

• Keys are generated on the server and stored encrypted; only an authenticated request from your account can decrypt them.
• Row-level security in the database means one account can only ever read and write its own wallet rows.
• Revealing a phrase or key is an explicit, per-request action — nothing is decrypted to render the wallets page.
• WHYUS? never asks for your phrase or private key, in the app or by email.

Questions

Read the guidelines, the terms of service and the privacy policy. Anything else: support@whyus.fun.