Split-Key Vanity Addresses: Buying Without Trusting the Seller

Whoever generates a vanity address also generates its private key — unless the search runs on a public key. Here is how split-key purchase works, the arithmetic behind it, what it does and does not protect you from, and how to verify it yourself.

Every shop selling ready-made vanity addresses has the same hole in it, and no amount of policy writing closes it: to create the address, the seller created its private key. You can be told the copy was deleted. You cannot be shown that it was.

Split-key purchase removes the premise instead of arguing about it. The seller does the expensive work — millions of candidate addresses per second on a GPU — and still never possesses the key you end up with.

The arithmetic

TRON keys live on the secp256k1 curve, where a private key is a number d and the matching public key is the point d·G. The useful property is that this map is additive:

`` (d + s)·G = d·G + s·G ``

So the search can be split in two:

1. Your browser picks a random d and sends out only P = d·G, the public half.
2. The farm tries offsets s = 1, 2, 3, …, computing P + s·G and checking the address each time. It never learns d, so it never learns d + s.
3. The farm returns the s that landed on your pattern.
4. Your browser computes d + s — the private key of the address that was found.

The offset travels in the clear because it is worthless on its own: without d it is just a number, and recovering d from P is the discrete logarithm problem that secp256k1 is built on.

What each side knows

There is no step at which the finished key exists on the seller's hardware. Not in memory, not in a log, not in a backup — the pieces never meet there.

What it does not protect you from

Split-key is not a cure-all, and a shop that implies otherwise is selling you comfort rather than security.

• It does not verify the seller's code. Your browser must actually generate the key locally. Open the developer tools, watch the Network tab while you order, and confirm that what leaves the page is 128 hex characters of public key — never 64 characters of private key.
• It does not protect a weak random number. If d came from a predictable source, the final key is predictable too. Any modern browser's crypto.getRandomValues is fine; a hand-typed "random" number is not.
• It does not remove address poisoning. A memorable ending makes it easier for a scammer to produce a lookalike. Keep checking the full address before every transfer.
• It does not back anything up for you. This is the real trade, and it is a hard one: the seller cannot restore your half, because the seller never had it. Lose it and the address is gone permanently.

Why it costs more time than buying from stock

A shelf address was generated in advance, so delivery is instant. A split-key address does not exist until someone searches for it with your public key, and nobody else's order can be reused. Expect the search time for the pattern length you chose, plus the time to bring a GPU online.

For four or five characters, this is the wrong tool: your own laptop finds such an address in seconds with a free in-browser generator, and then no second party exists at all. Split-key earns its place from roughly seven characters up, where the search needs hardware you would rather rent than own.

How to verify it worked

When the offset comes back, your browser should do two things before showing you anything: derive the address from d + s, and compare it to the address you were promised. If they differ, the key is wrong and nothing should be displayed.

You can repeat the check independently. Import the key into TronLink and compare all 34 characters of the address it shows. The wallet derives the address from the key itself, so a match proves the key is the right one — no trust in any website required.

FAQ

Is the offset secret?

No, and it does not need to be. The offset is only half of an addition, and the other half never left your browser. Publishing it tells an attacker nothing they could not already compute from the address.

Can the seller search for a key they can also use?

Not for your order. The farm is given P, and every address it can reach from P requires your d to spend from. It could of course generate an unrelated address and offer you that instead — which is exactly why your browser checks that the delivered key derives the exact address you were promised.

What if I lose my half of the key?

The address is lost, with no recovery path. Not a policy, an arithmetic fact: the seller holds one half of a sum and cannot reconstruct the other. Save your half the moment it is shown, somewhere other than the browser that created it.

Is this the same as a multi-signature wallet?

No. Multi-signature means several keys can each authorise transactions on one account. Split-key is a one-off construction trick: two numbers are added once, and what comes out is an ordinary single private key for an ordinary TRON account.

Does HaoKey offer this?

Yes, on every mask in the catalogue — the "Trustless" option next to the normal buy button. Our security page lists it as the first of three ways to avoid trusting us with a key.